Airworthiness Criteria: Special Class Airworthiness Criteria for the Matternet, Inc. M2 Unmanned Aircraft, 10699-10710 [2022-03867]

Download as PDF Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations DEPARTMENT OF TRANSPORTATION Federal Aviation Administration 14 CFR Part 21 [Docket No. FAA–2020–1085] Airworthiness Criteria: Special Class Airworthiness Criteria for the Matternet, Inc. M2 Unmanned Aircraft Federal Aviation Administration (FAA), DOT. ACTION: Issuance of final airworthiness criteria. AGENCY: The FAA announces the special class airworthiness criteria for the Matternet, Inc. Model M2 unmanned aircraft (UA). This document sets forth the airworthiness criteria the FAA finds to be appropriate and applicable for the UA design. DATES: These airworthiness criteria are effective March 28, 2022. FOR FURTHER INFORMATION CONTACT: Christopher J. Richards, Emerging Aircraft Strategic Policy Section, AIR– 618, Strategic Policy Management Branch, Policy and Innovation Division, Aircraft Certification Service, Federal Aviation Administration, 6020 28th Avenue South, Room 103, Minneapolis, MN 55450, telephone (612) 253–4559. SUPPLEMENTARY INFORMATION: SUMMARY: lotter on DSK11XQN23PROD with RULES1 Background Matternet, Inc. (Matternet) applied to the FAA on May 21, 2018, for a special class type certificate under Title 14, Code of Federal Regulations (14 CFR) 21.17(b) for the Model M2 unmanned aircraft system (UAS). The Model M2 consists of a rotorcraft UA and its associated elements (AE) including communication links and components that control the UA. The Model M2 UA has a maximum gross takeoff weight of 29 pounds. It is approximately 50 inches in width, 50 inches in length, and 10 inches in height. The Model M2 UA uses batterypowered electric motors for vertical takeoff, landing, and forward flight. The UAS operations would rely on high levels of automation and may include multiple UA operated by a single pilot, up to a ratio of 20 UA to 1 pilot. Matternet anticipates operators will use the Model M2 for transporting medical materials. The proposed concept of operations (CONOPS) for the Model M2 identifies a maximum operating altitude of 400 feet above ground level (AGL), a maximum cruise speed of 39 knots (45 mph), operations beyond visual line of sight (BVLOS) of the pilot, and operations over human beings. VerDate Sep<11>2014 15:59 Feb 24, 2022 Jkt 256001 Matternet has not requested type certification for flight into known icing for the Model M2. The FAA issued a notice of proposed airworthiness criteria for the Matternet M2 UAS, which published in the Federal Register on November 20, 2020 (85 FR 74294). Summary of Changes From the Proposed Airworthiness Criteria Based on the comments received, these final airworthiness criteria reflect the following changes, as explained in more detail under Discussion of Comments: A new section containing definitions; revisions to the CONOPS requirement; changing the term ‘‘critical part’’ to ‘‘flight essential part’’ in D&R.135; changing the basis of the durability and reliability testing from population density to limitations prescribed for the operating environment identified in the applicant’s CONOPS per D&R.001; and, for the demonstration of certain required capabilities and functions as required by D&R.310. Additionally, the FAA re-evaluated its approach to type certification of lowrisk UA using durability and reliability testing. Safe UAS operations depend and rely on both the UA and the AE. As explained in FAA Memorandum AIR600–21–AIR–600–PM01, dated July 13, 2021, the FAA has revised the airworthiness criteria to define a boundary between the UA type certification and subsequent operational evaluations and approval processes for the UAS (i.e., waivers, exemptions, and/ or operating certificates). To reflect that these airworthiness criteria rely on durability and reliability (D&R) testing for certification, the FAA changed the prefix of each section from ‘‘UAS’’ to ‘‘D&R.’’ Lastly, the FAA revised D&R.001(g) to clarify that the operational parameters listed in that paragraph are examples and not an all-inclusive list. Discussion of Comments The FAA received responses from 15 commenters. The majority of the commenters were individuals. Other commenters included the European Union Aviation Safety Agency (EASA), unmanned aircraft manufacturers, a helicopter operator, and organizations such as the Air Line Pilots Association (ALPA), Droneport Texas, LLC, the National Agricultural Aviation Association (NAAA), Northeast UAS Airspace Integration Research Alliance, Inc. (NUAIR), and the Small UAV Coalition. PO 00000 Frm 00013 Fmt 4700 Sfmt 4700 10699 Support Comment Summary: ALPA, NUAIR, and the Small UAV Coalition expressed support for type certification as a special class of aircraft and establishing airworthiness criteria under § 21.17(b). The Small UAV Coalition also supported the FAA’s proposed use of performance-based standards. Terminology: Loss of Flight Comment Summary: An individual commenter requested the FAA define the term ‘‘loss of flight’’ and clarify how it is different from ‘‘loss of control.’’ The commenter questioned whether loss of flight meant the UA could not continue its intended flight plan but could safely land or terminate the flight. FAA Response: The FAA has added a new section, D&R.005, to define the terms ‘‘loss of flight’’ and ‘‘loss of control’’ for the purposes of these airworthiness criteria. ‘‘Loss of flight’’ refers to a UA’s inability to complete its flight as planned, up to and through its originally planned landing. ‘‘Loss of flight’’ includes scenarios where the UA experiences controlled flight into terrain or obstacles, or any other collision, or a loss of altitude that is severe or nonrecoverable. ‘‘Loss of flight’’ includes deploying a parachute or ballistic recovery system that leads to an unplanned landing outside the operator’s designated recovery zone. ‘‘Loss of control’’ means an unintended departure of an aircraft from controlled flight. It includes control reversal or an undue loss of longitudinal, lateral, and directional stability and control. It also includes an upset or entry into an unscheduled or uncommanded attitude with high potential for uncontrolled impact with terrain. ‘‘Loss of control’’ means a spin, loss of control authority, loss of aerodynamic stability, divergent flight characteristic, or similar occurrence, which could generally lead to a crash. Terminology: Skill and Alertness of Pilot Comment Summary: Two commenters requested the FAA clarify terminology with respect to piloting skill and alertness. Droneport Texas LLC stated that the average pilot skill and alertness is currently undefined, as remote pilots do not undergo oral or practical examinations to obtain certification. NUAIR noted that, despite the definition of ‘‘exceptional piloting skill and alertness’’ in Advisory Circular (AC) 23–8C, Flight Test Guide for Certification of Part 23 Airplanes, there is a significant difference between the average skill and alertness of a remote E:\FR\FM\25FER1.SGM 25FER1 10700 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations lotter on DSK11XQN23PROD with RULES1 pilot certified under 14 CFR part 107 and a pilot certified under 14 CFR part 61. The commenter requested the FAA clarify the minimum qualifications and ratings to perform as a remote pilot of a UAS with a type certificate. FAA Response: These airworthiness criteria do not require exceptional piloting skill and alertness for testing. The FAA included this as a requirement to ensure the applicant passes testing by using pilots of average skill who have been certificated under part 61, as opposed to highly trained pilots with thousands of hours of flight experience. Concept of Operations The FAA proposed a requirement for the applicant to submit a CONOPS describing the UAS and identifying the intended operational concepts. The FAA explained in the preamble of the notice of proposed airworthiness criteria that the information in the CONOPS would determine parameters for testing and flight manual operating limitations. Comment Summary: One commenter stated that the airworthiness criteria are generic and requested the FAA add language to proposed UAS.001 to clarify that some of the criteria may not be relevant or necessary. FAA Response: Including the language requested by the commenter would be inappropriate, as these airworthiness criteria are projectspecific. Thus, in this case, each element of these airworthiness criteria is a requirement specific to the type certification of Matternet’s proposed UA design. Comment Summary: ALPA requested the criteria specify that the applicant’s CONOPS contain sufficient detail to determine the parameters and extent of testing, as well as operating limitations placed on the UAS for its operational uses. FAA Response: The FAA agrees and has updated D&R.001 to clarify that the information required for inclusion in the CONOPS proposal (D&R.001(a) through (g)) must be described in sufficient detail to determine the parameters and extent of testing and operating limitations. Comment Summary: ALPA requested the CONOPS include a description of a means to ensure separation from other aircraft and perform collision avoidance maneuvers. ALPA stated that its requested addition to the CONOPS is critical to the safety of other airspace users, as manned aircraft do not easily see most UAs. FAA Response: The FAA agrees and has updated D&R.001 to require that the applicant identify collision avoidance equipment (whether onboard the UA or VerDate Sep<11>2014 15:59 Feb 24, 2022 Jkt 256001 part of the AE), if the applicant requests to include that equipment. Comment Summary: ALPA requested the FAA add security-related (other than cyber-security) requirements to the CONOPS criteria, including mandatory reporting of security occurrences, security training and awareness programs for all personnel involved in UAS operations, and security standards for the transportation of goods, similar to those for manned aviation. FAA Response: The type certificate only establishes the approved design of the UA. Operations and operational requirements, including those regarding security occurrences, security training, and package delivery security standards (other than cybersecurity airworthiness design requirements) are beyond the scope of the airworthiness criteria established by this document and are not required for type certification. Comment Summary: UAS.001(c) proposed to require that the applicant’s CONOPS include a description of meteorological conditions. ALPA requested the FAA change UAS.001(c) to require a description of meteorological and environmental conditions and their operational limits. ALPA stated the CONOPS should include maximum wind speeds, maximum or minimum temperatures, maximum density altitudes, and other relevant phenomena that will limit operations or cause operations to terminate. FAA Response: D&R.001(c) and D&R.125 address meteorological conditions, while D&R.001(g) addresses environmental considerations. The FAA determined that these criteria are sufficient to cover the weather phenomena mentioned by the commenter without specifically requiring identification of related operational limits. Control Station To address the risks associated with loss of control of the UA, the FAA proposed that the applicant design the control station to provide the pilot with all information necessary for continued safe flight and operation. Comment Summary: ALPA and two individual commenters requested the FAA revise the proposed criteria to add requirements for the control station. Specifically, these commenters requested the FAA include the display of data and alert conditions to the pilot, physical security requirements for both the control station and the UAS storage area, design requirements that minimize negative impact of extended periods of low pilot workload, transfer of control between pilots, and human factors/ PO 00000 Frm 00014 Fmt 4700 Sfmt 4700 human machine interface considerations for handheld controls. NUAIR requested the FAA designate the control station as a flight critical component for operations. EASA and an individual commenter requested the FAA consider flexibility in some of the proposed criteria. EASA stated that the list of information in proposed UAS.100 is too prescriptive and contains information that may not be relevant for highly automated systems. The individual commenter requested that the FAA allow part-time or non-continuous displays of required information that do not influence the safety of the flight. FAA Response: Although the scope of the proposed airworthiness criteria applied to the entire UAS, the FAA has re-evaluated its approach to type certification of low-risk unmanned aircraft using durability and reliability testing. A UA is an aircraft that is operated without the possibility of direct human intervention from within or on the aircraft.1 A UAS is defined as a UA and its AE, including communication links and the components that control the UA, that are required to operate the UAS safely and efficiently in the national airspace system.2 As explained in FAA Memorandum AIR600–21–AIR–600– PM01, dated July 13, 2021, the FAA determined it will apply the regulations for type design approval, production approval, conformity, certificates of airworthiness, and maintenance to only the UA and not to the AE. However, because safe UAS operations depend and rely on both the UA and the AE, the FAA will consider the AE in assessing whether the UA meets the airworthiness criteria that comprise the certification basis. While the AE items themselves will be outside the scope of the UA type design, the applicant will provide sufficient specifications for any aspect of the AE, including the control station, which could affect airworthiness. The FAA will approve either the specific AE or minimum specifications for the AE, as identified by the applicant, as part of the type certificate by including them as an operating limitation in the type certificate data sheet and flight manual. The FAA may impose additional operating limitations specific to the AE through conditions and limitations for inclusion in the operational approval (i.e., waivers, exemptions, or a combination of these). In accordance with this approach, the FAA will 1 See 2 See E:\FR\FM\25FER1.SGM 49 U.S.C. 44801(11). 49 U.S.C. 44801(12). 25FER1 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations lotter on DSK11XQN23PROD with RULES1 consider the entirety of the UAS for operational approval and oversight. Accordingly, the FAA has revised the criteria by replacing proposed section UAS.100, applicable to the control station design, with D&R.100, UA Signal Monitoring and Transmission, with substantively similar criteria that apply to the UA design. The FAA has also added a new section, D&R.105, UAS AE Required for Safe UA Operations, which requires the applicant to provide information concerning the specifications of the AE. The FAA has moved the alert function requirement proposed in UAS.100(a) to new section D&R.105(a)(1)(i). As part of the clarification of the testing of the interaction between the UA and AE, the FAA has added a requirement to D&R.300(h) for D&R testing to use minimum specification AE. This addition requires the applicant to demonstrate that the limits proposed for those AE will allow the UA to operate as expected throughout its service life. Finally, the FAA has revised references throughout the airworthiness criteria from ‘‘UAS’’ to ‘‘UA,’’ as appropriate, to reflect the FAA determination that the regulations for type design approval, production approval, conformity, certificates of airworthiness, and maintenance apply to only the UA. Software The FAA proposed criteria on verification, configuration management, and problem reporting to minimize the existence of errors associated with UAS software. Comment Summary: ALPA requested the FAA add language to the proposed criteria to ensure that some level of software engineering principles are used without being too prescriptive. FAA Response: By combining the software testing requirement of D&R.110(a) with successful completion of the requirements in the entire ‘‘Testing’’ subpart, the acceptable level of software assurance will be identified and demonstrated. The configuration management system required by D&R.110(b) will ensure that the software is adequately documented and traceable both during and after the initial type certification activities. Comment Summary: EASA suggested the criteria require that the applicant establish and correctly implement system requirements or a structured software development process for critical software. FAA Response: Direct and specific evaluation of the software development process is more detailed than what the FAA intended with the proposed criteria, which use D&R testing to VerDate Sep<11>2014 15:59 Feb 24, 2022 Jkt 256001 evaluate the UAS as a whole system, rather than evaluating individual components within the UA. Successful completion of the testing requirements provides confidence that the components that make up the UA provide an acceptable level of safety, commensurate to the low-risk nature of this aircraft. The FAA finds no change to the airworthiness criteria is needed. Comment Summary: Two individual commenters requested the FAA require the manned aircraft software certification methodology in RTCA DO– 178C, Software Considerations in Airborne Systems and Equipment Certification, for critical UA software. FAA Response: Under these airworthiness criteria, only software that may affect the safe operation of the UA must be verified by test. To verify by test, the applicant will need to provide an assessment showing that other software is not subject to testing because it has no impact on the safe operation of the UA. For software that is subject to testing, the FAA may accept multiple options for software qualification, including DO–178C. Further, specifying that applicants must comply with DO– 178 would be inconsistent with the FAA’s intent to issue performance-based airworthiness criteria. Comment Summary: NAAA stated that an overreliance of software in aircraft has been and continues to be a source of accidents and requested the FAA include criteria to prevent a midair collision. FAA Response: The proper functioning of software is an important element of type certification, particularly with respect to flight controls and navigation. The airworthiness criteria in D&R.110 are meant to provide an acceptable level of safety commensurate with the risk posed by this UA. Additionally, the airworthiness criteria require contingency planning per D&R.120 and the demonstration of the UA’s ability to detect and avoid other aircraft in D&R.310, if requested by the applicant. The risk of a midair collision will be minimized by the operating limitations that result from testing based on the operational parameters identified by the applicant in its CONOPS (such as geographic operating boundaries, airspace classes, and congestion of the proposed operating area), rather than by specific mitigations built into the aircraft design itself. These criteria are sufficient due to the low-risk nature of the Model M2. Cybersecurity Because the UA requires a continuous wireless connection, the FAA proposed PO 00000 Frm 00015 Fmt 4700 Sfmt 4700 10701 criteria to address the risks to the UAS from cybersecurity threats. Comment Summary: ALPA requested adding a requirement for cybersecurity protection for navigation and position reporting systems such as Global Navigation Satellite System (GNSS). ALPA further requested the FAA include criteria to address specific cybersecurity vulnerabilities, such as jamming (denial of signal) and spoofing (false position data is inserted). ALPA stated that, for navigation, UAS primarily use GNSS—an unencrypted, open-source, low power transmission that can be jammed, spoofed, or otherwise manipulated. FAA Response: The FAA will assess elements directly influencing the UA for cybersecurity under D&R.115 and will assess the AE as part of any operational approvals an operator may seek. D&R.115 (proposed as UAS.115) addresses intentional unauthorized electronic interactions, which includes, but is not limited to, hacking, jamming, and spoofing. These airworthiness criteria require the high-level outcome the UA must meet, rather than discretely identifying every aspect of cybersecurity the applicant will address. Contingency Planning The FAA proposed criteria requiring that the UAS be designed to automatically execute a predetermined action in the event of a loss of communication between the pilot and the UA. The FAA further proposed that the predetermined action be identified in the Flight Manual and that the UA be precluded from taking off when the quality of service is inadequate. Comment Summary: ALPA requested the criteria encompass more than loss or degradation of the command and control (C2) link, as numerous types of critical part or systems failures can occur that include degraded capabilities, whether intermittent or sustained. ALPA requested the FAA add language to the proposed criteria to address specific failures such as loss of a primary navigation sensor, degradation or loss of navigation capability, and simultaneous impact of C2 and navigation links. FAA Response: The airworthiness criteria address the issues raised by the commenter. Specifically, D&R.120(a) addresses actions the UA will automatically and immediately take when the operator no longer has control of the UA. Should the specific failures identified by ALPA result in the operator’s loss of control, then the criteria require the UA to execute a predetermined action. Degraded navigation performance does not raise E:\FR\FM\25FER1.SGM 25FER1 10702 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations lotter on DSK11XQN23PROD with RULES1 the same level of concern as a degraded or lost C2 link. For example, a UA may experience interference with a GPS signal on the ground, but then find acceptable signal strength when above a tree line or other obstruction. The airworthiness criteria require that neither degradation nor complete loss of GPS or C2, as either condition would be a failure of that system, result in unsafe loss of control or containment. The applicant must demonstrate this by test to meet the requirements of D&R.305(a)(3). Under the airworthiness criteria, the minimum performance requirements for the C2 link, defining when the link is degraded to an unacceptable level, may vary among different UAS designs. The level of degradation that triggers a loss is dependent upon the specific UA characteristics; this level will be defined by the applicant and demonstrated to be acceptable by testing as required by D&R.305(a)(2) and D&R.310(a)(1). Comment Summary: An individual commenter requested the FAA use distinct terminology for ‘‘communication,’’ used for communications with air traffic control, and ‘‘C2 link,’’ used for command and control between the remote pilot station and UA. The commenter questioned whether, in the proposed criteria, the FAA stated ‘‘loss of communication between the pilot and the UA’’ when it intended to state ‘‘loss of C2 link.’’ FAA Response: Communication extends beyond the C2 link and specific control inputs. This is why D&R.001 requires the applicant’s CONOPS to include a description of the command, control, and communications functions. As long as the UA operates safely and predictably per its lost link contingency programming logic, a C2 interruption does not constitute a loss of control. Lightning The FAA proposed criteria to address the risks that would result from a lightning strike, accounting for the size and physical limitations of a UAS that could preclude traditional lightning protection features. The FAA further proposed that without lightning protection for the UA, the Flight Manual must include an operating limitation to prohibit flight into weather conditions with potential lightning. Comment Summary: An individual requested the FAA revise the criteria to include a similar design mitigation or operating limitation for High Intensity Radiated Fields (HIRF). The commenter noted that HIRF is included in proposed UAS.300(e) as part of the expected environmental conditions that must be replicated in testing. VerDate Sep<11>2014 15:59 Feb 24, 2022 Jkt 256001 FAA Response: The airworthiness criteria, which are adopted as proposed, address the issue raised by the commenter. The applicant must identify tested HIRF exposure capabilities, if any, in the Flight Manual to comply with the criteria in D&R.200(a)(5). Information regarding HIRF capabilities is necessary for safe operation because proper communication and software execution may be impeded by HIRFgenerated interference, which could result in loss of control of the UA. It is not feasible to measure HIRF at every potential location where the UA will operate; thus, requiring operating limitations for HIRF as requested by the commenter would be impractical. Adverse Weather Conditions The FAA proposed criteria either requiring that design characteristics protect the UAS from adverse weather conditions or prohibiting flight into known adverse weather conditions. The criteria proposed to define adverse weather conditions as rain, snow, and icing. Comment Summary: ALPA and two individual commenters requested the FAA expand the proposed definition of adverse weather conditions. These commenters noted that because of the size and physical limitations of the Model M2, adverse weather should also include wind, downdraft, low-level wind shear (LLWS), microburst, and extreme mechanical turbulence. FAA Response: No additional language needs to be added to the airworthiness criteria to address wind effects. The wind conditions specified by the commenters are part of normal UA flight operations. The applicant must demonstrate by flight test that the UA can withstand wind without failure to meet the requirements of D&R.300(b)(9). The FAA developed the criteria in D&R.130 to address adverse weather conditions (rain, snow, and icing) that would require additional design characteristics for safe operation. Any operating limitations necessary for operation in adverse weather or wind conditions will be included in the Flight Manual as required by D&R.200. Comment Summary: One commenter questioned whether the criteria proposed in UAS.130(c)(2), requiring a means to detect adverse weather conditions for which the UAS is not certificated to operate, is a prescriptive requirement to install an onboard detection system. The commenter requested, if that was the case, that the FAA allow alternative procedures to avoid flying in adverse weather conditions. PO 00000 Frm 00016 Fmt 4700 Sfmt 4700 FAA Response: The language referred to by the commenter is not a prescriptive design requirement for an onboard detection system. The applicant may use any acceptable source to monitor weather in the area, whether onboard the UA or from an external source. Critical Parts The FAA proposed criteria for critical parts that were substantively the same as those in the existing standards for normal category rotorcraft under § 27.602, with changes to reflect UAS terminology and failure conditions. The criteria proposed to define a critical part as a part, the failure of which could result in a loss of flight or unrecoverable loss of control of the aircraft. Comment Summary: EASA requested the FAA avoid using the term ‘‘critical part,’’ as it is a well-established term for complex manned aircraft categories and may create incorrect expectations on the oversight process for parts. FAA Response: For purposes of the airworthiness criteria established for the Matternet Model M2, the FAA has changed the term ‘‘critical part’’ to ‘‘flight essential part.’’ Comment Summary: An individual commenter requested the FAA revise the proposed criteria such that a failure of a flight essential part would only occur if there is risk to third parties. FAA Response: The definition of ‘‘flight essential’’ does not change regardless of whether on-board systems are capable of safely landing the UA when it is unable to continue its flight plan. Tying the definition of a flight essential part to the risk to third parties would result in different definitions for the part depending on where and how the UA is operated. These criteria for the Model M2 UA apply the same approach as for manned aircraft. Flight Manual The FAA proposed criteria for the Flight Manual that were substantively the same as the existing standards for normal category airplanes, with minor changes to reflect UAS terminology. Comment Summary: ALPA requested the FAA revise the criteria to include normal, abnormal, and emergency operating procedures along with their respective checklist. ALPA further requested the checklist be contained in a quick reference handbook (QRH). FAA Response: The FAA did not intend for the airworthiness criteria to exclude abnormal procedures from the flight manual. In these final airworthiness criteria, the FAA has changed ‘‘normal and emergency operating procedures’’ to ‘‘operating E:\FR\FM\25FER1.SGM 25FER1 lotter on DSK11XQN23PROD with RULES1 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations procedures’’ to encompass all operating conditions and align with 14 CFR 23.2620, which includes the airplane flight manual requirements for normal category airplanes. The FAA has not made any changes to add language that would require the checklists to be included in a QRH. FAA regulations do not require manned aircraft to have a QRH for type certification. Therefore, it would be inconsistent for the FAA to require a QRH for the Matternet Model M2 UA. Comment Summary: ALPA requested the FAA revise the airworthiness criteria to require that the Flight Manual and QRH be readily available to the pilot at the control station. FAA Response: ALPA’s request regarding the Flight manual addresses an operational requirement, similar to 14 CFR 91.9 and is therefore not appropriate for type certification airworthiness criteria. Also, as previously discussed, FAA regulations do not require a QRH. Therefore, it would be inappropriate to require it to be readily available to the pilot at the control station. Comment Summary: Droneport Texas LLC requested the FAA revise the airworthiness criteria to add required Flight Manual sections for routine maintenance and mission-specific equipment and procedures. The commenter stated that the remote pilot or personnel on the remote pilot-incommand’s flight team accomplish most routine maintenance, and that the flight team usually does UA rigging with mission equipment. FAA Response: The requested change is appropriate for a maintenance document rather than a flight manual because it addresses maintenance procedures rather than the piloting functions. The FAA also notes that, similar to the criteria for certain manned aircraft, the airworthiness criteria require that the applicant prepare instructions for continued airworthiness (ICA) in accordance with Appendix A to Part 23. As the applicant must provide any maintenance instructions and mission-specific information necessary for safe operation and continued operational safety of the UA, in accordance with D&R.205, no changes to the airworthiness criteria are necessary. Comment Summary: An individual commenter requested the FAA revise the criteria in proposed UAS.200(b) to require that ‘‘other information’’ referred to in proposed UAS.200(a)(5) be approved by the FAA. The commenter noted that, as proposed, only the information listed in UAS.200(a)(1) through (4) must be FAA approved. VerDate Sep<11>2014 15:59 Feb 24, 2022 Jkt 256001 FAA Response: The change requested by the commenter would be inconsistent with the FAA’s airworthiness standards for flight manuals for manned aircraft. Sections 23.2620(b), 25.1581(b), 27.1581(b), and 29.1581(b) include requirements for flight manuals to include operating limitations, operating procedures, performance information, loading information, and other information that is necessary safe operation because of design, operating, or handling characteristics, but limit FAA approval to operating limitations, operating procedures, performance information, and loading information. Under § 23.2620(b)(1), for low-speed level 1 and level 2 airplanes, the FAA only approves the operating limitations. In applying a risk-based approach, the FAA has determined it would not be appropriate to hold the lowest risk UA to a higher standard than what is required for low speed level 1 and level 2 manned aircraft. Accordingly, the FAA has revised the airworthiness criteria to only require FAA approval of the operating limitations. Comment Summary: NUAIR requested the FAA recognize that § 23.2620 is only applicable to the aircraft and does not address off-aircraft components such as the control station, control and non-payload communications (CNPC) data link, and launch and recovery equipment. The commenter noted that this is also true of industry consensus-based standards designed to comply with § 23.2620. FAA Response: As explained in more detail in the Control Station section of this document, the FAA has revised the airworthiness criteria for the AE. The FAA will approve AE or minimum specifications for the AE that could affect airworthiness as an operating limitation in the UA flight manual. The FAA will establish the approved AE or minimum specifications as operating limitations and include them in the UA type certificate data sheet and Flight Manual in accordance with D&R.105(c). The establishment of requirements for and the approval of AE will be in accordance with FAA Memorandum AIR600–21–AIR–600–PM01, dated July 13, 2021. Durability and Reliability The FAA proposed durability and reliability testing that would require the applicant to demonstrate safe flight of the UAS across the entire operational envelope and up to all operational limitations, for all phases of flight and all aircraft configurations described in the applicant’s CONOPS, with no failures that result in a loss of flight, loss PO 00000 Frm 00017 Fmt 4700 Sfmt 4700 10703 of control, loss of containment, or emergency landing outside the operator’s recovery area. The FAA further proposed that the unmanned aircraft would only be certificated for operations within the limitations, and for flight over areas no greater than the maximum population density, as described in the applicant’s CONOPS and demonstrated by test. Comment Summary: ALPA requested that the proposed certification criteria require all flights during testing be completed in both normal and nonnormal or off-nominal scenarios with no failures that result in a loss of flight, loss of control, loss of containment, or emergency landing outside of the operator’s recovery zone. Specifically, ALPA stated that testing must not require exceptional piloting skill or alertness and include, at a minimum: All phases of the flight envelope, including the highest UA to pilot ratios; the most adverse combinations of the conditions and configuration; the environmental conditions identified in the CONOPS; the different flight profiles and routes identified in the CONOPS; and exposure to EMI and HIRF. FAA Response: No change is necessary because the introductory text and paragraphs (b)(7), (b)(9), (b)(10), (b)(13), (c), (d), (e), and (f) of D&R.300, which are adopted as proposed, contain the specific testing requirements requested by ALPA. Comment Summary: Droneport Texas LLC requested the FAA revise the testing criteria to include, for operation at night, testing both with and without night vision aids. The commenter stated that because small UAS operation at night is waivable under 14 CFR part 107, manufacturers will likely make assumptions concerning a pilot’s familiarity with night vision deviceaided and unaided operations. FAA Response: Under D&R.300(b)(11), the applicant must demonstrate by flight test that the UA can operate at night without failure using whatever equipment is onboard the UA itself. The pilot’s familiarity, or lack thereof, with night vision equipment does not impact whether the UA is reliable and durable to complete testing without any failures. Comment Summary: EASA requested the FAA clarify how testing durability and reliability commensurate to the maximum population density, as proposed, aligns with the Specific Operations Risk Assessment (SORA) approach that is open to operational mitigation, reducing the initial ground risk. An individual commenter requested the FAA provide more details about the correlation between the E:\FR\FM\25FER1.SGM 25FER1 lotter on DSK11XQN23PROD with RULES1 10704 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations number of flight hours tested and the CONOPS environment (e.g., population density). The commenter stated that this is one of the most fundamental requirements, and the FAA should ensure equal treatment to all current and future applicants. FAA Response: In developing these testing criteria, the FAA sought to align the risk of UAS operations with the appropriate level of protection for human beings on the ground. The FAA proposed establishing the maximum population density demonstrated by durability and reliability testing as an operating limitation on the type certificate. However, the FAA has reevaluated its approach and determined it to be more appropriate to connect the durability and reliability demonstrated during certification testing with the operating environment defined in the CONOPS. Basing testing on maximum population density may result in limitations not commensurate with many actual operations. As population density broadly refers to the number of people living in a given area per square mile, it does not allow for evaluating variation in a local operating environment. For example, an operator may have a route in an urban environment with the actual flight path along a greenway; the number of human beings exposed to risk from the UA operating overhead would be significantly lower than the population density for the area. Conversely, an operator may have a route over an industrial area where few people live, but where, during business hours, there may be highly dense groups of people. Specific performance characteristics such as altitude and airspeed also factor into defining the boundaries for safe operation of the UA. Accordingly, the FAA has revised D&R.300 to require the UA design to be durable and reliable when operated under the limitations prescribed for its operating environment. The information in the applicant’s CONOPS will determine the operating environment for testing. For example, the minimum hours of reliability testing will be less for a UA conducting agricultural operations in a rural environment than if the same aircraft will be conducting package deliveries in an urban environment. The FAA will include the limitations that result from testing as operating limitations on the type certificate data sheet and in the UA Flight Manual. The FAA intends for this process to be similar to the process for establishing limitations prescribed for special purpose operations for restricted category aircraft. This allows for added VerDate Sep<11>2014 15:59 Feb 24, 2022 Jkt 256001 flexibility in determining appropriate operating limitations, which will more closely reflect the operating environment. Finally, a comparison of these criteria with EASA’s SORA approach is beyond the scope of this document because the SORA is intended to result in an operational approval rather than a type certificate. Comment Summary: EASA requested the FAA clarify how reliability at the aircraft level to ensure high-level safety objectives would enable validation of products under applicable bilateral agreements. FAA Response: As the FAA and international aviation authorities are still developing general airworthiness standards for UA, it would be speculative for the FAA to comment on the validation process for any specific UA. Comment Summary: EASA requested the FAA revise the testing criteria to include a compliance demonstration related to adverse combinations of the conditions and configurations and with respect to weather conditions and average pilot qualification. FAA Response: No change is necessary because D&R.300(b)(7), (b)(9), (b)(10), (c), and (f), which are adopted as proposed, contain the specific testing requirements requested by EASA. Comment Summary: EASA noted that, under the proposed criteria, testing involving a large number of flight hours will limit changes to the configuration. FAA Response: Like manned aircraft, the requirements of 14 CFR part 21, subpart D, apply to UA for changes to type certificates. The FAA is developing procedures for processing type design changes for UA type certificated using durability and reliability testing. Comment Summary: EASA requested the FAA clarify whether the proposed testing criteria would require the applicant to demonstrate aspects that do not occur during a successful flight, such as the deployment of emergency recovery systems and fire protection/ post-crash fire. EASA asked if these aspects are addressed by other means and what would be the applicable airworthiness criteria. FAA Response: Equipment not required for normal operation of the UA do not require an evaluation for their specific functionality. D&R testing will show that the inclusion of any such equipment does not prevent normal operation. Therefore, the airworthiness criteria would not require functional testing of the systems described by EASA. Comment Summary: An individual commenter requested the FAA specify PO 00000 Frm 00018 Fmt 4700 Sfmt 4700 the acceptable percentage of failures in the testing that would result in a ‘‘loss of flight.’’ The Small UAV Coalition requested the FAA clarify what constitutes an emergency landing outside an operator’s landing area, as some UAS designs could include an onboard health system that initiates a landing to lessen the potential of a loss of control event. The commenter suggested that, in those cases, a landing in a safe location should not invalidate the test. FAA Response: The airworthiness criteria require that all test points and flight hours occur with no failures result in a loss of flight, control, containment, or emergency landing outside the operator’s recovery zone. The FAA has determined that there is no acceptable percentage of failures in testing. In addition, while the recovery zone may differ for each UAS design, an emergency or unplanned landing outside of a designated landing area would result in a test failure. Comment Summary: The Small UAV Coalition requested that a single failure during testing not automatically restart counting the number of flight test operations set for a particular population density; rather, the applicant should have the option to identify the failure through root-cause and fault-tree analysis and provide a validated mitigation to ensure it will not recur. An individual commenter requested the FAA to clarify whether the purpose of the tests is to show compliance with a quantitative safety objective. The commenter further requested the FAA allow the applicant to reduce the number of flight testing hours if the applicant can present a predicted safety and reliability analysis. FAA Response: The intent of the testing criteria is for the applicant to demonstrate the aircraft’s durability and reliability through a successful accumulation of flight testing hours. The FAA does not intend to require analytical evaluation to be part of this process. However, the applicant will comply with these testing criteria using a means of compliance, accepted by the FAA, through the issue paper process. The means of compliance will be dependent on the CONOPS the applicant has proposed to meet. Probable Failures The FAA proposed criteria to evaluate how the UAS functions after probable failures, including failures related to propulsion systems, C2 link, GPS, critical flight control components with a single point of failure, control station, and any other equipment identified by the applicant. E:\FR\FM\25FER1.SGM 25FER1 lotter on DSK11XQN23PROD with RULES1 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations Comment Summary: Droneport Texas LLC requested the FAA add a bird strike to the list of probable failures. The commenter stated that despite sense and avoid technologies, flocks of birds can overcome the maneuver capabilities of a UA and result in multiple, unintended failures. FAA Response: Unlike manned aircraft, where aircraft size, design, and construct are critical to safe control of the aircraft after encountering a bird strike, the FAA determined testing for bird strike capabilities is not necessary for the Model M2 UA. The FAA has determined that a bird strike requirement is not necessary because the smaller size and lower operational speed of the M2 reduce the likelihood of a bird strike, combined with the reduced consequences of failure due to no persons onboard. Instead, the FAA is using a risk-based approach to tailor airworthiness requirements commensurate to the low-risk nature of the Model M2 UA. Comment Summary: ALPA requested the FAA require that all probable failure tests occur at the critical phase and mode of flight and at the highest aircraft-to-pilot ratio. ALPA stated the proposed criteria are critically important for systems that rely on a single source to perform multi-label functions, such as GNSS, because failure or interruption of GNSS will lead to loss of positioning, navigation, and timing (PNT) and functions solely dependent on PNT, such as geo-fencing and contingency planning. FAA Response: No change is necessary because D&R.300(c) requires that the testing occur at the critical phase and mode of flight and at the highest UA-to-pilot ratio. Comment Summary: Droneport Texas LLC requested the FAA add recovery from vortex ring state (VRS) to the list of probable failures. The commenter stated the UA uses multiple rotors for lift and is therefore susceptible to VRS. The commenter further stated that because recovery from settling with power is beyond a pilot’s average skill for purposes of airworthiness testing, the aircraft must be able to sense and recover from this condition without pilot assistance. FAA Response: D&R.305 addresses probable failures related to specific components of the UAS. VRS is an aerodynamic condition a UA may encounter during flight testing; it is not a component subject to failure. Comment Summary: Droneport Texas LLC also requested the FAA add a response to the Air Traffic Control-Zero (ATC-Zero) command to the list of probable failures. The commenter VerDate Sep<11>2014 15:59 Feb 24, 2022 Jkt 256001 stated, based on lessons learned after the attacks on September 11, 2001, aircraft that can fly BVLOS should be able to respond to an ATC-Zero condition. FAA Response: The commenter’s request is more appropriate for the capabilities and functions testing criteria in D&R.310 than probable failures testing in D&R.305. D&R.310(a)(3) requires the applicant to demonstrate by test that the pilot has the ability to safely discontinue a flight. A pilot may discontinue a flight for a wide variety of reasons, including responding to an ATC-zero command. Comment Summary: EASA stated the proposed language seems to require an additional analysis and safety assessment, which would be appropriate for the objective requirement of ensuring a probable failure does not result in a loss of containment or control. EASA further stated that an applicant’s basic understanding of the systems architecture and effects of failures is essential. FAA Response: The FAA agrees with the expectation that applicants understand the system architecture and effects of failures of a proposed design, which is why the criteria include a requirement for the applicant to test the specific equipment identified in D&R.305 and identify any other equipment that is not specifically identified in D&R.305 for testing. As the intent of the criteria is for the applicant to demonstrate compliance through testing, some analysis may be necessary to properly identify the appropriate equipment to be evaluated for probable failures. Comment Summary: An individual requested that probable failure testing apply not only to critical flight control components with a single point of failure, but also to any critical part with a single point of failure. FAA Response: The purpose of probable failure testing in D&R.305 is to demonstrate that if certain equipment fails, it will fail safely. Adding probable failure testing for critical (now flight essential) parts would not add value to testing. If a part is essential for flight, its failure by definition in D&R.135(a) could result in a loss of flight or unrecoverable loss of control. For example, on a traditional airplane design, failure of a wing spar in flight would lead to loss of the aircraft. Because there is no way to show that a wing spar can fail safely, the applicant must provide its mandatory replacement time if applicable, structural inspection interval, and related structural inspection procedure in the PO 00000 Frm 00019 Fmt 4700 Sfmt 4700 10705 Airworthiness Limitations section of the ICA. Similarly, under these airworthiness criteria, parts whose failure would inherently result in loss of flight or unrecoverable loss of control are not subjected to probable failure testing. Instead, they must be identified as flight essential components and included in the ICA. To avoid confusion pertaining to probable failure testing, the FAA has removed the word ‘‘critical’’ from D&R.305(a)(5). In the final airworthiness criteria, probable failure testing required by D&R.305(a)(5) applies to ‘‘Flight control components with a single point of failure.’’ Capabilities and Functions The FAA proposed criteria to require the applicant to demonstrate by test the minimum capabilities and functions necessary for the design. UAS.310(a) proposed to require the applicant to demonstrate, by test, the capability of the UAS to regain command and control of the UA after a C2 link loss, the sufficiency of the electrical system to carry all anticipated loads, and the ability of the pilot to override any preprogramming in order to resolve a potential unsafe operating condition in any phase of flight. UAS.310(b) proposed to require the applicant to demonstrate by test certain features if the applicant requests approval of those features (geo-fencing, external cargo, etc.). UAS.310(c) proposed to require the design of the UAS to safeguard against an unintended discontinuation of flight or release of cargo, whether by human action or malfunction. Comment Summary: ALPA stated the pilot-in-command must always have the capability to input control changes to the UA and override any preprogramming without delay as needed for the safe management of the flight. The commenter requested that the FAA retain the proposed criteria that would allow the pilot to command to: Regain command and control of the UA after loss of the C2 link; safely discontinue the flight; and dynamically re-route the UA. In support, ALPA stated the ability of the pilot to continually command (reroute) the UA, including termination of the flight if necessary, is critical for safe operations and should always be available to the pilot. Honeywell requested the FAA revise paragraphs (a)(3) and (a)(4) of the criteria (UAS.310) to allow for either the pilot or an augmenting system to safely discontinue the flight and re-route the UA. The commenter stated that a system comprised of detect and avoid, onboard autonomy, and ground system can be used for these functions. Therefore, the E:\FR\FM\25FER1.SGM 25FER1 lotter on DSK11XQN23PROD with RULES1 10706 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations criteria should not require that only the pilot can do them. An individual commenter requested the FAA remove UAS.310(a)(4) of the proposed criteria because requiring the ability for the pilot to dynamically reroute the UA is too prescriptive and redundant with the proposed requirement in UAS.310(a)(3), the ability of the pilot to discontinue the flight safely. FAA Response: Because the pilot in command is directly responsible for the operation of the UA, the pilot must have the capability to command actions necessary for continued safety. This includes commanding a change to the flight path or, when appropriate, safely terminating a flight. The FAA notes that the ability for the pilot to safely discontinue a flight means the pilot has the means to terminate the flight and immediately and safely return the UA to the ground. This is different from the pilot having the means to dynamically re-route the UA, without terminating the flight, to avoid a conflict. Therefore, the final airworthiness criteria include D&R.310(a) as proposed (UAS.310(a)). Comment Summary: ALPA requested the FAA revise the criteria to require that all equipment, systems, and installations conform, at a minimum, to the standards of § 25.1309. FAA Response: The FAA determined that traditional methodologies for manned aircraft, including the system safety analysis required by §§ 23.2510, 25.1309, 27.1309, or 29.1309, would be inappropriate to require for the Matternet Model M2 due to its smaller size and reduced level of complexity. Instead, the FAA finds that system reliability through testing will ensure the safety of this design. Comment Summary: ALPA requested the FAA revise the criteria to add a requirement to demonstrate the ability of the UA and pilot to perform all of the contingency plans identified in proposed UAS.120. FAA Response: No change is necessary because D&R.120 and D&R.305(a)(2), together, require what ALPA requests in its comment. Under D&R.120, the applicant must design the UA to execute a predetermined action in the event of a loss of the C2 link. D&R.305(a)(2) requires the applicant to demonstrate by test that a lost C2 link will not result in a loss of containment or control of the UA. Thus, if the applicant does not demonstrate the predetermined contingency plan resulting from a loss of the C2 link when conducting D&R.305 testing, the test would be a failure due to loss of containment. VerDate Sep<11>2014 15:59 Feb 24, 2022 Jkt 256001 Comment Summary: ALPA and an individual commenter requested the FAA revise the criteria so that geofencing is a required feature and not optional due to the safety concerns that could result from a UA exiting its operating area. FAA Response: To ensure safe flight, the applicant must test the proposed safety functions, such as geo-fencing, that are part of the type design of the Model M2 UA. The FAA determined that geo-fencing is an optional feature because it is one way, but not the only way, to ensure a safely contained operation. Comment Summary: ALPA requested the FAA revise the criteria so that capability to detect and avoid other aircraft and obstacles is a required feature and not optional. FAA Response: D&R.310(a)(4) requires the applicant demonstrate the ability for the pilot to safely re-route the UA in flight to avoid a dynamic hazard. The FAA did not prescribe specific design features such as a collision avoidance system to meet D&R.310(a)(4) because there are multiple means to minimize the risk of collision. Comment Summary: McMahon Helicopter Services requested that the airworthiness criteria require a demonstration of sense-and-avoid technology that will automatically steer the UA away from manned aircraft, regardless of whether the manned aircraft has a transponder. NAAA and an individual commenter requested that the FAA require ADS–B in/out and traffic avoidance software on all UAS. The Small UAV Coalition requested the FAA establish standards for collision avoidance technology, as the proposed criteria are not sufficient for compliance with the operational requirement to see and avoid other aircraft (§ 91.113). The commenters stated that these technologies are necessary to avoid a mid-air collision between UA and manned aircraft. FAA Response: D&R.310(a)(4) requires the applicant demonstrate the ability for the UA to be safely re-routed in flight to avoid a dynamic hazard. The FAA did not prescribe specific design features, such as the technologies suggested by the commenters, to meet D&R.310(a)(4) because they are not the only means for complying with the operational requirement to see and avoid other aircraft. If an applicant chooses to equip their UA with onboard collision avoidance technology, those capabilities and functions must be demonstrated by test per D&R.310(b)(5). PO 00000 Frm 00020 Fmt 4700 Sfmt 4700 Verification of Limits The FAA proposed to require an evaluation of the UA’s performance, maneuverability, stability, and control with a factor of safety. Comment Summary: EASA requested that the FAA revise its approach to require a similar compliance demonstration as EASA’s for ‘‘light UAS.’’ EASA stated the FAA’s proposed criteria for verification of limits, combined with the proposed Flight Manual requirements, seem to replace a traditional Subpart Flight. 3 EASA further stated the FAA’s approach in the proposed airworthiness criteria might necessitate more guidance and means of compliance than the traditional structure. FAA Response: The FAA’s airworthiness criteria will vary from EASA’s light UAS certification requirements, resulting in associated differences in compliance demonstrations. At this time, comment on means of compliance and related guidance material, which are still under development with the FAA and with EASA, would be speculative. Propulsion Comment Summary: ALPA requested the FAA conduct an analysis to determine battery reliability and safety, taking into account wind and weather conditions and their effect on battery life. ALPA expressed concern with batteries as the only source of power for an aircraft in the NAS. ALPA further requested the FAA not grant exemptions for battery reserve requirements. FAA Response: Because batteries are a flight essential part, the applicant must establish mandatory instructions or life limits for batteries under the requirements of D&R.135. In addition, when the applicant conducts its D&R testing, D&R.300(i) prevents the applicant from exceeding the maintenance intervals or life limits for those batteries. To the extent the commenter’s request addresses fuel reserves, that is an operational requirement, not a certification requirement, and therefore beyond the scope of this document. Additional Airworthiness Criteria Identified by Commenters Comment Summary: McMahon Helicopter Services requested that the criteria require anti-collision and navigation lighting certified to existing FAA standards for brightness and size. The commenter stated that these 3 In the FAA’s aircraft airworthiness standards (parts 23, 25, 27 and 29), subpart B of each is titled Flight. E:\FR\FM\25FER1.SGM 25FER1 lotter on DSK11XQN23PROD with RULES1 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations standards were based on human factors for nighttime and daytime recognition and are not simply a lighting requirement. An individual commenter requested that the criteria include a requirement for position lighting and anti-collision beacons meeting TSO–30c Level III. NAAA requested the criteria require a strobe light and high visibility paint scheme to aid in visual detection of the UA by other aircraft. FAA Response: The FAA determined it is unnecessary for these airworthiness criteria to prescribe specific design features for anti-collision or navigation lighting. The FAA will address anticollision lighting as part of any operational approval, similar to the rules in 14 CFR 107.29(a)(2) and (b) for small UAS. Comment Summary: ALPA requested the FAA add a new section with minimum standards for Global Navigation Satellite System (GNSS), as the UAS will likely rely heavily upon GNSS for navigation and to ensure that the UA does not stray outside of its approved airspace. ALPA stated that technological advances have made such devices available at an appropriate size, weight, and power for UAs. FAA Response: The airworthiness criteria in D&R.100 (UA Signal Monitoring and Transmission), D&R.110 (Software), D&R.115 (Cybersecurity), and D&R.305(a)(3) (probable failures related to GPS) sufficiently address design requirements and testing of navigation systems. Even if the applicant uses a TSO-approved GNSS, these airworthiness criteria require a demonstration that the UA operates successfully without loss of containment. Successful completion of these tests demonstrates that the navigation subsystems are acceptable. Comment Summary: ALPA requested the FAA revise the criteria to add a new section requiring equipage to comply with the FAA’s new rules on Remote Identification of Unmanned Aircraft (86 FR 4390, Jan. 15, 2021). An individual commenter questioned the need for public tracking and identification of drones in the event of a crash or violation of FAA flight rules. FAA Response: The FAA issued the final rule, Remote Identification of Unmanned Aircraft, after providing an opportunity for public notice and comment. The final rule is codified at 14 CFR part 89. Part 89 contains the remote identification requirements for unmanned aircraft certificated and produced under part 21 after September 16, 2022. VerDate Sep<11>2014 15:59 Feb 24, 2022 Jkt 256001 10707 Pilot Ratio Noise Comment Summary: ALPA and one individual questioned the safety of multiple Model M2 UA operated by a single pilot, up to a ratio of 20 UA to 1 pilot. ALPA stated that even with high levels of automation, the pilot must still manage the safe operation and maintain situational awareness of multiple aircraft in their flight path, aircraft systems, integration with traffic, obstacles, and other hazards during normal, abnormal, and emergency conditions. As a result, ALPA recommended the FAA conduct additional studies to better understand the feasibility of a single pilot operating multiple UA before developing airworthiness criteria. The Small UAV Coalition requested the FAA provide criteria for an aircraft-to-pilot ratio higher than 20:1. FAA Response: These airworthiness criteria are specific to the Model M2 UA and, as discussed previously in this preamble, operations of the Model M2 UA may include multiple UA operated by a single pilot, up to a ratio of 20 UA to 1 pilot. Additionally, these airworthiness criteria require the applicant to demonstrate the durability and reliability of the UA design by flight test, at the highest aircraft-to-pilot ratio, without exceptional piloting skill or alertness. In addition, D&R.305(c) requires the applicant to demonstrate probable failures by test at the highest aircraft-to-pilot ratio. Should the pilot ratio cause a loss of containment or control of the UA, then the applicant will fail this testing. Comment Summary: ALPA stated that to allow a UAS-pilot ratio of up to 20:1 safely, the possibility that the pilot will need to intervene with multiple UA simultaneously must be ‘‘extremely remote.’’ ALPA questioned whether this is feasible given the threat of GNSS interference or unanticipated wind gusts exceeding operational limits. FAA Response: The FAA’s guidance in AC 23.1309–1E, System Safety Analysis and Assessment for Part 23 Airplanes defines ‘‘extremely remote failure conditions’’ as failure conditions not anticipated to occur during the total life of an airplane, but which may occur a few times when considering the total operational life of all airplanes of the same type. When assessing the likelihood of a pilot needing to intervene with multiple UA simultaneously, the minimum reliability requirements will be determined based on the applicant’s proposed CONOPS. Comment Summary: An individual commenter expressed concern about noise pollution. FAA Response: The Model M2 will need to comply with FAA noise certification standards. If the FAA determines that 14 CFR part 36 does not contain adequate standards for this design, the agency will propose and seek public comment on a rule of particular applicability for noise requirements under a separate rulemaking docket. PO 00000 Frm 00021 Fmt 4700 Sfmt 4700 Operating Altitude Comment Summary: ALPA, McMahon Helicopter Services, and NAAA commented on the operation of UAS at or below 400 feet AGL. ALPA, McMahon Helicopter Services, and NAAA requested the airworthiness criteria contain measures for safe operation at low altitudes so that UAS are not a hazard to manned aircraft, especially operations involving helicopters; air tours; agricultural applications; emergency medical services; air tanker firefighting; power line and pipeline patrol and maintenance; fish and wildlife service; animal control; military and law enforcement; seismic operations; ranching and livestock relocation; and mapping. FAA Response: The type certificate only establishes the approved design of the UA. These airworthiness criteria require the applicant show compliance for the UA altitude sought for type certification. While this may result in operating limitations in the flight manual, the type certificate is not an approval for operations. Operations and operational requirements are beyond the scope of this document. Guidance Material Comment Summary: NUAIR requested the FAA complete and publish its draft AC 21.17–XX, Type Certification Basis for Unmanned Aircraft Systems (UAS), to provide additional guidance, including templates, to those who seek a type design approval for UAS. NUAIR also requested the FAA recognize the industry consensus-based standards applicable to UAS, as Transport Canada has by publishing its AC 922–001, Remotely Piloted Aircraft Systems Safety Assurance. FAA Response: The FAA will continue to develop policy and guidance for UA type certification and will publish guidance as soon as practicable. The FAA encourages consensus standards bodies to develop E:\FR\FM\25FER1.SGM 25FER1 10708 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations means of compliance and submit them to the FAA for acceptance. Regarding Transport Canada AC 922–001, that AC addresses operational approval rather than type certification. Safety Management Comment Summary: ALPA requested the FAA ensure that operations, including UA integrity, fall under the safety management system. ALPA further requested the FAA convene a Safety Risk Management Panel before allowing operators to commence operations and that the FAA require operators to have an active safety management system, including a nonpunitive safety culture, where incident and continuing airworthiness issues can be reported. FAA Response: The type certificate only establishes the approved design of the UA, including the Flight Manual and ICA. Operations and operational requirements, including safety management and oversight of operations and maintenance, are beyond the scope of this document. lotter on DSK11XQN23PROD with RULES1 Process Comment Summary: ALPA supported the FAA’s type certification of UAS as a ‘‘special class’’ of aircraft under § 21.17(b) but requested that it be temporary. FAA Response: As the FAA stated in its notice of policy issued August 11, 2020 (85 FR 58251, September 18, 2020), the FAA will use the type certification process under § 21.17(b) for some unmanned aircraft with no occupants onboard. The FAA further stated in its policy that it may also issue type certificates under § 21.17(a) for airplane and rotorcraft UAS designs where the airworthiness standards in part 23, 25, 27, or 29, respectively, are appropriate. The FAA, in the future, may consider establishing appropriate generally applicable airworthiness standards for UA that are not certificated under the existing standards in parts 23, 25, 27, or 29. Out of Scope Comments The FAA received and reviewed several comments that were general, stated the commenter’s viewpoint or opposition without a suggestion specific to the proposed criteria, or did not make a request the FAA can act on. These comments are beyond the scope of this document. Applicability These airworthiness criteria, established under the provisions of § 21.17(b), are applicable to the Matternet Model M2 UA. Should VerDate Sep<11>2014 15:59 Feb 24, 2022 Jkt 256001 Matternet wish to apply these airworthiness criteria to other UA models, it must submit a new type certification application. Conclusion This action affects only certain airworthiness criteria for the Matternet Model M2 UA. It is not a standard of general applicability. Authority Citation The authority citation for these airworthiness criteria is as follows: Authority: 49 U.S.C. 106(g), 40113, and 44701–44702, 44704. Airworthiness Criteria Pursuant to the authority delegated to me by the Administrator, the following airworthiness criteria are issued as part of the type certification basis for the Matternet Model M2 unmanned aircraft. The FAA finds that compliance with these criteria appropriately mitigates the risks associated with the design and concept of operations and provides an equivalent level of safety to existing rules. General D&R.001 Concept of Operations The applicant must define and submit to the FAA a concept of operations (CONOPS) proposal describing the unmanned aircraft system (UAS) operation in the national airspace system for which unmanned aircraft (UA) type certification is requested. The CONOPS proposal must include, at a minimum, a description of the following information in sufficient detail to determine the parameters and extent of testing and operating limitations: (a) The intended type of operations; (b) UA specifications; (c) Meteorological conditions; (d) Operators, pilots, and personnel responsibilities; (e) Control station, support equipment, and other associated elements (AE) necessary to meet the airworthiness criteria; (f) Command, control, and communication functions; (g) Operational parameters (such as population density, geographic operating boundaries, airspace classes, launch and recovery area, congestion of proposed operating area, communications with air traffic control, line of sight, and aircraft separation); and (h) Collision avoidance equipment, whether onboard the UA or part of the AE, if requested. PO 00000 Frm 00022 Fmt 4700 Sfmt 4700 D&R.005 Definitions For purposes of these airworthiness criteria, the following definitions apply. (a) Loss of Control: Loss of control means an unintended departure of an aircraft from controlled flight. It includes control reversal or an undue loss of longitudinal, lateral, and directional stability and control. It also includes an upset or entry into an unscheduled or uncommanded attitude with high potential for uncontrolled impact with terrain. A loss of control means a spin, loss of control authority, loss of aerodynamic stability, divergent flight characteristics, or similar occurrence, which could generally lead to crash. (b) Loss of Flight: Loss of flight means a UA’s inability to complete its flight as planned, up to and through its originally planned landing. It includes scenarios where the UA experiences controlled flight into terrain, obstacles, or any other collision, or a loss of altitude that is severe or non-reversible. Loss of flight also includes deploying a parachute or ballistic recovery system that leads to an unplanned landing outside the operator’s designated recovery zone. Design and Construction D&R.100 UA Signal Monitoring and Transmission The UA must be designed to monitor and transmit to the AE all information required for continued safe flight and operation. This information includes, at a minimum, the following: (a) Status of all critical parameters for all energy storage systems; (b) Status of all critical parameters for all propulsion systems; (c) Flight and navigation information as appropriate, such as airspeed, heading, altitude, and location; and (d) Communication and navigation signal strength and quality, including contingency information or status. D&R.105 UAS AE Required for Safe UA Operations (a) The applicant must identify and submit to the FAA all AE and interface conditions of the UAS that affect the airworthiness of the UA or are otherwise necessary for the UA to meet these airworthiness criteria. As part of this requirement— (1) The applicant may identify either specific AE or minimum specifications for the AE. (i) If minimum specifications are identified, they must include the critical requirements of the AE, including performance, compatibility, function, E:\FR\FM\25FER1.SGM 25FER1 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations reliability, interface, pilot alerting, and environmental requirements. (ii) Critical requirements are those that if not met would impact the ability to operate the UA safely and efficiently. (2) The applicant may use an interface control drawing, a requirements document, or other reference, titled so that it is clearly designated as AE interfaces to the UA. (b) The applicant must show the FAA the AE or minimum specifications identified in paragraph (a) of this section meet the following: (1) The AE provide the functionality, performance, reliability, and information to assure UA airworthiness in conjunction with the rest of the design; (2) The AE are compatible with the UA capabilities and interfaces; (3) The AE must monitor and transmit to the pilot all information required for safe flight and operation, including but not limited to those identified in D&R.100; and (4) The minimum specifications, if identified, are correct, complete, consistent, and verifiable to assure UA airworthiness. (c) The FAA will establish the approved AE or minimum specifications as operating limitations and include them in the UA type certificate data sheet and Flight Manual. (d) The applicant must develop any maintenance instructions necessary to address implications from the AE on the airworthiness of the UA. Those instructions will be included in the instructions for continued airworthiness (ICA) required by D&R.205. lotter on DSK11XQN23PROD with RULES1 D&R.110 Software To minimize the existence of software errors, the applicant must: (a) Verify by test all software that may impact the safe operation of the UA; (b) Utilize a configuration management system that tracks, controls, and preserves changes made to software throughout the entire life cycle; and (c) Implement a problem reporting system that captures and records defects and modifications to the software. D&R.115 Cybersecurity (a) UA equipment, systems, and networks, addressed separately and in relation to other systems, must be protected from intentional unauthorized electronic interactions that may result in an adverse effect on the security or airworthiness of the UA. Protection must be ensured by showing that the security risks have been identified, assessed, and mitigated as necessary. (b) When required by paragraph (a) of this section, procedures and VerDate Sep<11>2014 15:59 Feb 24, 2022 Jkt 256001 instructions to ensure security protections are maintained must be included in the ICA. D&R.120 Contingency Planning (a) The UA must be designed so that, in the event of a loss of the command and control (C2) link, the UA will automatically and immediately execute a safe predetermined flight, loiter, landing, or termination. (b) The applicant must establish the predetermined action in the event of a loss of the C2 link and include it in the UA Flight Manual. (c) The UA Flight Manual must include the minimum performance requirements for the C2 data link defining when the C2 link is degraded to a level where remote active control of the UA is no longer ensured. Takeoff when the C2 link is degraded below the minimum link performance requirements must be prevented by design or prohibited by an operating limitation in the UA Flight Manual. D&R.125 Lightning (a) Except as provided in paragraph (b) of this section, the UA must have design characteristics that will protect the UA from loss of flight or loss of control due to lightning. (b) If the UA has not been shown to protect against lightning, the UA Flight Manual must include an operating limitation to prohibit flight into weather conditions conducive to lightning activity. D&R.130 Adverse Weather Conditions (a) For purposes of this section, ‘‘adverse weather conditions’’ means rain, snow, and icing. (b) Except as provided in paragraph (c) of this section, the UA must have design characteristics that will allow the UA to operate within the adverse weather conditions specified in the CONOPS without loss of flight or loss of control. (c) For adverse weather conditions for which the UA is not approved to operate, the applicant must develop operating limitations to prohibit flight into known adverse weather conditions and either: (1) Develop operating limitations to prevent inadvertent flight into adverse weather conditions; or (2) Provide a means to detect any adverse weather conditions for which the UA is not certificated to operate and show the UA’s ability to avoid or exit those conditions. D&R.135 Flight Essential Parts (a) A flight essential part is a part, the failure of which could result in a loss of PO 00000 Frm 00023 Fmt 4700 Sfmt 4700 10709 flight or unrecoverable loss of UA control. (b) If the type design includes flight essential parts, the applicant must establish a flight essential parts list. The applicant must develop and define mandatory maintenance instructions or life limits, or a combination of both, to prevent failures of flight essential parts. Each of these mandatory actions must be included in the Airworthiness Limitations Section of the ICA. Operating Limitations and Information D&R.200 Flight Manual The applicant must provide a Flight Manual with each UA. (a) The UA Flight Manual must contain the following information: (1) UA operating limitations; (2) UA operating procedures; (3) Performance information; (4) Loading information; and (5) Other information that is necessary for safe operation because of design, operating, or handling characteristics. (b) Those portions of the UA Flight Manual containing the information specified in paragraph (a)(1) of this section must be approved by the FAA. D&R.205 Instructions for Continued Airworthiness The applicant must prepare ICA for the UA in accordance with Appendix A to Part 23, as appropriate, that are acceptable to the FAA. The ICA may be incomplete at type certification if a program exists to ensure their completion prior to delivery of the first UA or issuance of a standard airworthiness certificate, whichever occurs later. Testing D&R.300 Durability and Reliability The UA must be designed to be durable and reliable when operated under the limitations prescribed for its operating environment, as documented in its CONOPS and included as operating limitations on the type certificate data sheet and in the UA Flight Manual. The durability and reliability must be demonstrated by flight test in accordance with the requirements of this section and completed with no failures that result in a loss of flight, loss of control, loss of containment, or emergency landing outside the operator’s recovery area. (a) Once a UA has begun testing to show compliance with this section, all flights for that UA must be included in the flight test report. (b) Tests must include an evaluation of the entire flight envelope across all phases of operation and must address, at a minimum, the following: E:\FR\FM\25FER1.SGM 25FER1 10710 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations lotter on DSK11XQN23PROD with RULES1 (1) Flight distances; (2) Flight durations; (3) Route complexity; (4) Weight; (5) Center of gravity; (6) Density altitude; (7) Outside air temperature; (8) Airspeed; (9) Wind; (10) Weather; (11) Operation at night, if requested; (12) Energy storage system capacity; and (13) Aircraft to pilot ratio. (c) Tests must include the most adverse combinations of the conditions and configurations in paragraph (b) of this section. (d) Tests must show a distribution of the different flight profiles and routes representative of the type of operations identified in the CONOPS. (e) Tests must be conducted in conditions consistent with the expected environmental conditions identified in the CONOPS, including electromagnetic interference (EMI) and high intensity radiated fields (HIRF). (f) Tests must not require exceptional piloting skill or alertness. (g) Any UAS used for testing must be subject to the same worst-case ground handling, shipping, and transportation loads as those allowed in service. (h) Any UA used for testing must use AE that meet, but do not exceed, the minimum specifications identified under D&R.105. If multiple AE are identified, the applicant must demonstrate each configuration. (i) Any UAS used for testing must be maintained and operated in accordance with the ICA and UA Flight Manual. No maintenance beyond the intervals established in the ICA will be allowed to show compliance with this section. (j) If cargo operations or external-load operations are requested, tests must show, throughout the flight envelope and with the cargo or external-load at the most critical combinations of weight and center of gravity, that— (1) The UA is safely controllable and maneuverable; and (2) The cargo or external-load are retainable and transportable. D&R.305 Probable Failures The UA must be designed such that a probable failure will not result in a loss of containment or control of the UA. This must be demonstrated by test. (a) Probable failures related to the following equipment, at a minimum, must be addressed: (1) Propulsion systems; (2) C2 link; (3) Global Positioning System (GPS); (4) Flight control components with a single point of failure; VerDate Sep<11>2014 15:59 Feb 24, 2022 Jkt 256001 (5) Control station; and (6) Any other AE identified by the applicant. (b) Any UA used for testing must be operated in accordance with the UA Flight Manual. (c) Each test must occur at the critical phase and mode of flight, and at the highest aircraft-to-pilot ratio. Issued in Washington, DC, on February 16, 2022. Ian Lucas Manager, Policy Implementation Section, Policy and Innovation Division, Aircraft Certification Service. D&R.310 DEPARTMENT OF TRANSPORTATION Capabilities and Functions (a) All of the following required UAS capabilities and functions must be demonstrated by test: (1) Capability to regain command and control of the UA after the C2 link has been lost. (2) Capability of the electrical system to power all UA systems and payloads. (3) Ability for the pilot to safely discontinue the flight. (4) Ability for the pilot to dynamically re-route the UA. (5) Ability to safely abort a takeoff. (6) Ability to safely abort a landing and initiate a go-around. (b) The following UAS capabilities and functions, if requested for approval, must be demonstrated by test: (1) Continued flight after degradation of the propulsion system. (2) Geo-fencing that contains the UA within a designated area, in all operating conditions. (3) Positive transfer of the UA between control stations that ensures only one control station can control the UA at a time. (4) Capability to release an external cargo load to prevent loss of control of the UA. (5) Capability to detect and avoid other aircraft and obstacles. (c) The UA must be designed to safeguard against inadvertent discontinuation of the flight and inadvertent release of cargo or external load. D&R.315 Fatigue The structure of the UA must be shown to withstand the repeated loads expected during its service life without failure. A life limit for the airframe must be established, demonstrated by test, and included in the ICA. D&R.320 Verification of Limits The performance, maneuverability, stability, and control of the UA within the flight envelope described in the UA Flight Manual must be demonstrated at a minimum of 5% over maximum gross weight with no loss of control or loss of flight. PO 00000 Frm 00024 Fmt 4700 Sfmt 4700 [FR Doc. 2022–03867 Filed 2–24–22; 8:45 am] BILLING CODE 4910–13–P Federal Aviation Administration 14 CFR Part 25 [Docket No. FAA–2020–1041; Special Conditions No. 25–805–SC] Special Conditions: Dassault Aviation Model Falcon 6X Airplane; Side Stick Controllers—Controllability and Maneuverability. Federal Aviation Administration (FAA), DOT. ACTION: Final special conditions; request for comments. AGENCY: These special conditions are issued for the Dassault Aviation (Dassault) Model Falcon 6X airplane. This airplane will have a novel or unusual design feature when compared to the state of technology envisioned in the airworthiness standards for transport category airplanes. This design feature is side-stick controllers for pitch and roll control. The applicable airworthiness regulations do not contain adequate or appropriate safety standards for this design feature. These special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards. DATES: This action is effective on Dassault on February 25, 2022. Send comments on or before April 11, 2022. ADDRESSES: Send comments identified by Docket No. FAA–2020–1041 using any of the following methods: • Federal eRegulations Portal: Go to https://www.regulations.gov/ and follow the online instructions for sending your comments electronically. • Mail: Send comments to Docket Operations, M–30, U.S. Department of Transportation (DOT), 1200 New Jersey Avenue SE, Room W12–140, West Building Ground Floor, Washington, DC 20590–0001. • Hand Delivery or Courier: Take comments to Docket Operations in Room W12–140 of the West Building Ground Floor at 1200 New Jersey Avenue SE, Washington, DC, between 9 a.m. and 5 p.m., Monday through Friday, except Federal holidays. SUMMARY: E:\FR\FM\25FER1.SGM 25FER1

Agencies

[Federal Register Volume 87, Number 38 (Friday, February 25, 2022)]
[Rules and Regulations]
[Pages 10699-10710]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-03867]



[[Page 10699]]

-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 21

[Docket No. FAA-2020-1085]


Airworthiness Criteria: Special Class Airworthiness Criteria for 
the Matternet, Inc. M2 Unmanned Aircraft

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Issuance of final airworthiness criteria.

-----------------------------------------------------------------------

SUMMARY: The FAA announces the special class airworthiness criteria for 
the Matternet, Inc. Model M2 unmanned aircraft (UA). This document sets 
forth the airworthiness criteria the FAA finds to be appropriate and 
applicable for the UA design.

DATES: These airworthiness criteria are effective March 28, 2022.

FOR FURTHER INFORMATION CONTACT: Christopher J. Richards, Emerging 
Aircraft Strategic Policy Section, AIR-618, Strategic Policy Management 
Branch, Policy and Innovation Division, Aircraft Certification Service, 
Federal Aviation Administration, 6020 28th Avenue South, Room 103, 
Minneapolis, MN 55450, telephone (612) 253-4559.

SUPPLEMENTARY INFORMATION:

Background

    Matternet, Inc. (Matternet) applied to the FAA on May 21, 2018, for 
a special class type certificate under Title 14, Code of Federal 
Regulations (14 CFR) 21.17(b) for the Model M2 unmanned aircraft system 
(UAS).
    The Model M2 consists of a rotorcraft UA and its associated 
elements (AE) including communication links and components that control 
the UA. The Model M2 UA has a maximum gross takeoff weight of 29 
pounds. It is approximately 50 inches in width, 50 inches in length, 
and 10 inches in height. The Model M2 UA uses battery-powered electric 
motors for vertical takeoff, landing, and forward flight. The UAS 
operations would rely on high levels of automation and may include 
multiple UA operated by a single pilot, up to a ratio of 20 UA to 1 
pilot. Matternet anticipates operators will use the Model M2 for 
transporting medical materials. The proposed concept of operations 
(CONOPS) for the Model M2 identifies a maximum operating altitude of 
400 feet above ground level (AGL), a maximum cruise speed of 39 knots 
(45 mph), operations beyond visual line of sight (BVLOS) of the pilot, 
and operations over human beings. Matternet has not requested type 
certification for flight into known icing for the Model M2.
    The FAA issued a notice of proposed airworthiness criteria for the 
Matternet M2 UAS, which published in the Federal Register on November 
20, 2020 (85 FR 74294).

Summary of Changes From the Proposed Airworthiness Criteria

    Based on the comments received, these final airworthiness criteria 
reflect the following changes, as explained in more detail under 
Discussion of Comments: A new section containing definitions; revisions 
to the CONOPS requirement; changing the term ``critical part'' to 
``flight essential part'' in D&R.135; changing the basis of the 
durability and reliability testing from population density to 
limitations prescribed for the operating environment identified in the 
applicant's CONOPS per D&R.001; and, for the demonstration of certain 
required capabilities and functions as required by D&R.310.
    Additionally, the FAA re-evaluated its approach to type 
certification of low-risk UA using durability and reliability testing. 
Safe UAS operations depend and rely on both the UA and the AE. As 
explained in FAA Memorandum AIR600-21-AIR-600-PM01, dated July 13, 
2021, the FAA has revised the airworthiness criteria to define a 
boundary between the UA type certification and subsequent operational 
evaluations and approval processes for the UAS (i.e., waivers, 
exemptions, and/or operating certificates).
    To reflect that these airworthiness criteria rely on durability and 
reliability (D&R) testing for certification, the FAA changed the prefix 
of each section from ``UAS'' to ``D&R.''
    Lastly, the FAA revised D&R.001(g) to clarify that the operational 
parameters listed in that paragraph are examples and not an all-
inclusive list.

Discussion of Comments

    The FAA received responses from 15 commenters. The majority of the 
commenters were individuals. Other commenters included the European 
Union Aviation Safety Agency (EASA), unmanned aircraft manufacturers, a 
helicopter operator, and organizations such as the Air Line Pilots 
Association (ALPA), Droneport Texas, LLC, the National Agricultural 
Aviation Association (NAAA), Northeast UAS Airspace Integration 
Research Alliance, Inc. (NUAIR), and the Small UAV Coalition.

Support

    Comment Summary: ALPA, NUAIR, and the Small UAV Coalition expressed 
support for type certification as a special class of aircraft and 
establishing airworthiness criteria under Sec.  21.17(b). The Small UAV 
Coalition also supported the FAA's proposed use of performance-based 
standards.

Terminology: Loss of Flight

    Comment Summary: An individual commenter requested the FAA define 
the term ``loss of flight'' and clarify how it is different from ``loss 
of control.'' The commenter questioned whether loss of flight meant the 
UA could not continue its intended flight plan but could safely land or 
terminate the flight.
    FAA Response: The FAA has added a new section, D&R.005, to define 
the terms ``loss of flight'' and ``loss of control'' for the purposes 
of these airworthiness criteria. ``Loss of flight'' refers to a UA's 
inability to complete its flight as planned, up to and through its 
originally planned landing. ``Loss of flight'' includes scenarios where 
the UA experiences controlled flight into terrain or obstacles, or any 
other collision, or a loss of altitude that is severe or non-
recoverable. ``Loss of flight'' includes deploying a parachute or 
ballistic recovery system that leads to an unplanned landing outside 
the operator's designated recovery zone.
    ``Loss of control'' means an unintended departure of an aircraft 
from controlled flight. It includes control reversal or an undue loss 
of longitudinal, lateral, and directional stability and control. It 
also includes an upset or entry into an unscheduled or uncommanded 
attitude with high potential for uncontrolled impact with terrain. 
``Loss of control'' means a spin, loss of control authority, loss of 
aerodynamic stability, divergent flight characteristic, or similar 
occurrence, which could generally lead to a crash.

Terminology: Skill and Alertness of Pilot

    Comment Summary: Two commenters requested the FAA clarify 
terminology with respect to piloting skill and alertness. Droneport 
Texas LLC stated that the average pilot skill and alertness is 
currently undefined, as remote pilots do not undergo oral or practical 
examinations to obtain certification. NUAIR noted that, despite the 
definition of ``exceptional piloting skill and alertness'' in Advisory 
Circular (AC) 23-8C, Flight Test Guide for Certification of Part 23 
Airplanes, there is a significant difference between the average skill 
and alertness of a remote

[[Page 10700]]

pilot certified under 14 CFR part 107 and a pilot certified under 14 
CFR part 61. The commenter requested the FAA clarify the minimum 
qualifications and ratings to perform as a remote pilot of a UAS with a 
type certificate.
    FAA Response: These airworthiness criteria do not require 
exceptional piloting skill and alertness for testing. The FAA included 
this as a requirement to ensure the applicant passes testing by using 
pilots of average skill who have been certificated under part 61, as 
opposed to highly trained pilots with thousands of hours of flight 
experience.

Concept of Operations

    The FAA proposed a requirement for the applicant to submit a CONOPS 
describing the UAS and identifying the intended operational concepts. 
The FAA explained in the preamble of the notice of proposed 
airworthiness criteria that the information in the CONOPS would 
determine parameters for testing and flight manual operating 
limitations.
    Comment Summary: One commenter stated that the airworthiness 
criteria are generic and requested the FAA add language to proposed 
UAS.001 to clarify that some of the criteria may not be relevant or 
necessary.
    FAA Response: Including the language requested by the commenter 
would be inappropriate, as these airworthiness criteria are project-
specific. Thus, in this case, each element of these airworthiness 
criteria is a requirement specific to the type certification of 
Matternet's proposed UA design.
    Comment Summary: ALPA requested the criteria specify that the 
applicant's CONOPS contain sufficient detail to determine the 
parameters and extent of testing, as well as operating limitations 
placed on the UAS for its operational uses.
    FAA Response: The FAA agrees and has updated D&R.001 to clarify 
that the information required for inclusion in the CONOPS proposal 
(D&R.001(a) through (g)) must be described in sufficient detail to 
determine the parameters and extent of testing and operating 
limitations.
    Comment Summary: ALPA requested the CONOPS include a description of 
a means to ensure separation from other aircraft and perform collision 
avoidance maneuvers. ALPA stated that its requested addition to the 
CONOPS is critical to the safety of other airspace users, as manned 
aircraft do not easily see most UAs.
    FAA Response: The FAA agrees and has updated D&R.001 to require 
that the applicant identify collision avoidance equipment (whether 
onboard the UA or part of the AE), if the applicant requests to include 
that equipment.
    Comment Summary: ALPA requested the FAA add security-related (other 
than cyber-security) requirements to the CONOPS criteria, including 
mandatory reporting of security occurrences, security training and 
awareness programs for all personnel involved in UAS operations, and 
security standards for the transportation of goods, similar to those 
for manned aviation.
    FAA Response: The type certificate only establishes the approved 
design of the UA. Operations and operational requirements, including 
those regarding security occurrences, security training, and package 
delivery security standards (other than cybersecurity airworthiness 
design requirements) are beyond the scope of the airworthiness criteria 
established by this document and are not required for type 
certification.
    Comment Summary: UAS.001(c) proposed to require that the 
applicant's CONOPS include a description of meteorological conditions. 
ALPA requested the FAA change UAS.001(c) to require a description of 
meteorological and environmental conditions and their operational 
limits. ALPA stated the CONOPS should include maximum wind speeds, 
maximum or minimum temperatures, maximum density altitudes, and other 
relevant phenomena that will limit operations or cause operations to 
terminate.
    FAA Response: D&R.001(c) and D&R.125 address meteorological 
conditions, while D&R.001(g) addresses environmental considerations. 
The FAA determined that these criteria are sufficient to cover the 
weather phenomena mentioned by the commenter without specifically 
requiring identification of related operational limits.

Control Station

    To address the risks associated with loss of control of the UA, the 
FAA proposed that the applicant design the control station to provide 
the pilot with all information necessary for continued safe flight and 
operation.
    Comment Summary: ALPA and two individual commenters requested the 
FAA revise the proposed criteria to add requirements for the control 
station. Specifically, these commenters requested the FAA include the 
display of data and alert conditions to the pilot, physical security 
requirements for both the control station and the UAS storage area, 
design requirements that minimize negative impact of extended periods 
of low pilot workload, transfer of control between pilots, and human 
factors/human machine interface considerations for handheld controls. 
NUAIR requested the FAA designate the control station as a flight 
critical component for operations.
    EASA and an individual commenter requested the FAA consider 
flexibility in some of the proposed criteria. EASA stated that the list 
of information in proposed UAS.100 is too prescriptive and contains 
information that may not be relevant for highly automated systems. The 
individual commenter requested that the FAA allow part-time or non-
continuous displays of required information that do not influence the 
safety of the flight.
    FAA Response: Although the scope of the proposed airworthiness 
criteria applied to the entire UAS, the FAA has re-evaluated its 
approach to type certification of low-risk unmanned aircraft using 
durability and reliability testing. A UA is an aircraft that is 
operated without the possibility of direct human intervention from 
within or on the aircraft.\1\ A UAS is defined as a UA and its AE, 
including communication links and the components that control the UA, 
that are required to operate the UAS safely and efficiently in the 
national airspace system.\2\ As explained in FAA Memorandum AIR600-21-
AIR-600-PM01, dated July 13, 2021, the FAA determined it will apply the 
regulations for type design approval, production approval, conformity, 
certificates of airworthiness, and maintenance to only the UA and not 
to the AE. However, because safe UAS operations depend and rely on both 
the UA and the AE, the FAA will consider the AE in assessing whether 
the UA meets the airworthiness criteria that comprise the certification 
basis.
---------------------------------------------------------------------------

    \1\ See 49 U.S.C. 44801(11).
    \2\ See 49 U.S.C. 44801(12).
---------------------------------------------------------------------------

    While the AE items themselves will be outside the scope of the UA 
type design, the applicant will provide sufficient specifications for 
any aspect of the AE, including the control station, which could affect 
airworthiness. The FAA will approve either the specific AE or minimum 
specifications for the AE, as identified by the applicant, as part of 
the type certificate by including them as an operating limitation in 
the type certificate data sheet and flight manual. The FAA may impose 
additional operating limitations specific to the AE through conditions 
and limitations for inclusion in the operational approval (i.e., 
waivers, exemptions, or a combination of these). In accordance with 
this approach, the FAA will

[[Page 10701]]

consider the entirety of the UAS for operational approval and 
oversight.
    Accordingly, the FAA has revised the criteria by replacing proposed 
section UAS.100, applicable to the control station design, with 
D&R.100, UA Signal Monitoring and Transmission, with substantively 
similar criteria that apply to the UA design. The FAA has also added a 
new section, D&R.105, UAS AE Required for Safe UA Operations, which 
requires the applicant to provide information concerning the 
specifications of the AE. The FAA has moved the alert function 
requirement proposed in UAS.100(a) to new section D&R.105(a)(1)(i). As 
part of the clarification of the testing of the interaction between the 
UA and AE, the FAA has added a requirement to D&R.300(h) for D&R 
testing to use minimum specification AE. This addition requires the 
applicant to demonstrate that the limits proposed for those AE will 
allow the UA to operate as expected throughout its service life. 
Finally, the FAA has revised references throughout the airworthiness 
criteria from ``UAS'' to ``UA,'' as appropriate, to reflect the FAA 
determination that the regulations for type design approval, production 
approval, conformity, certificates of airworthiness, and maintenance 
apply to only the UA.

Software

    The FAA proposed criteria on verification, configuration 
management, and problem reporting to minimize the existence of errors 
associated with UAS software.
    Comment Summary: ALPA requested the FAA add language to the 
proposed criteria to ensure that some level of software engineering 
principles are used without being too prescriptive.
    FAA Response: By combining the software testing requirement of 
D&R.110(a) with successful completion of the requirements in the entire 
``Testing'' subpart, the acceptable level of software assurance will be 
identified and demonstrated. The configuration management system 
required by D&R.110(b) will ensure that the software is adequately 
documented and traceable both during and after the initial type 
certification activities.
    Comment Summary: EASA suggested the criteria require that the 
applicant establish and correctly implement system requirements or a 
structured software development process for critical software.
    FAA Response: Direct and specific evaluation of the software 
development process is more detailed than what the FAA intended with 
the proposed criteria, which use D&R testing to evaluate the UAS as a 
whole system, rather than evaluating individual components within the 
UA. Successful completion of the testing requirements provides 
confidence that the components that make up the UA provide an 
acceptable level of safety, commensurate to the low-risk nature of this 
aircraft. The FAA finds no change to the airworthiness criteria is 
needed.
    Comment Summary: Two individual commenters requested the FAA 
require the manned aircraft software certification methodology in RTCA 
DO-178C, Software Considerations in Airborne Systems and Equipment 
Certification, for critical UA software.
    FAA Response: Under these airworthiness criteria, only software 
that may affect the safe operation of the UA must be verified by test. 
To verify by test, the applicant will need to provide an assessment 
showing that other software is not subject to testing because it has no 
impact on the safe operation of the UA. For software that is subject to 
testing, the FAA may accept multiple options for software 
qualification, including DO-178C. Further, specifying that applicants 
must comply with DO-178 would be inconsistent with the FAA's intent to 
issue performance-based airworthiness criteria.
    Comment Summary: NAAA stated that an overreliance of software in 
aircraft has been and continues to be a source of accidents and 
requested the FAA include criteria to prevent a midair collision.
    FAA Response: The proper functioning of software is an important 
element of type certification, particularly with respect to flight 
controls and navigation. The airworthiness criteria in D&R.110 are 
meant to provide an acceptable level of safety commensurate with the 
risk posed by this UA. Additionally, the airworthiness criteria require 
contingency planning per D&R.120 and the demonstration of the UA's 
ability to detect and avoid other aircraft in D&R.310, if requested by 
the applicant. The risk of a midair collision will be minimized by the 
operating limitations that result from testing based on the operational 
parameters identified by the applicant in its CONOPS (such as 
geographic operating boundaries, airspace classes, and congestion of 
the proposed operating area), rather than by specific mitigations built 
into the aircraft design itself. These criteria are sufficient due to 
the low-risk nature of the Model M2.

Cybersecurity

    Because the UA requires a continuous wireless connection, the FAA 
proposed criteria to address the risks to the UAS from cybersecurity 
threats.
    Comment Summary: ALPA requested adding a requirement for 
cybersecurity protection for navigation and position reporting systems 
such as Global Navigation Satellite System (GNSS). ALPA further 
requested the FAA include criteria to address specific cybersecurity 
vulnerabilities, such as jamming (denial of signal) and spoofing (false 
position data is inserted). ALPA stated that, for navigation, UAS 
primarily use GNSS--an unencrypted, open-source, low power transmission 
that can be jammed, spoofed, or otherwise manipulated.
    FAA Response: The FAA will assess elements directly influencing the 
UA for cybersecurity under D&R.115 and will assess the AE as part of 
any operational approvals an operator may seek. D&R.115 (proposed as 
UAS.115) addresses intentional unauthorized electronic interactions, 
which includes, but is not limited to, hacking, jamming, and spoofing. 
These airworthiness criteria require the high-level outcome the UA must 
meet, rather than discretely identifying every aspect of cybersecurity 
the applicant will address.

Contingency Planning

    The FAA proposed criteria requiring that the UAS be designed to 
automatically execute a predetermined action in the event of a loss of 
communication between the pilot and the UA. The FAA further proposed 
that the predetermined action be identified in the Flight Manual and 
that the UA be precluded from taking off when the quality of service is 
inadequate.
    Comment Summary: ALPA requested the criteria encompass more than 
loss or degradation of the command and control (C2) link, as numerous 
types of critical part or systems failures can occur that include 
degraded capabilities, whether intermittent or sustained. ALPA 
requested the FAA add language to the proposed criteria to address 
specific failures such as loss of a primary navigation sensor, 
degradation or loss of navigation capability, and simultaneous impact 
of C2 and navigation links.
    FAA Response: The airworthiness criteria address the issues raised 
by the commenter. Specifically, D&R.120(a) addresses actions the UA 
will automatically and immediately take when the operator no longer has 
control of the UA. Should the specific failures identified by ALPA 
result in the operator's loss of control, then the criteria require the 
UA to execute a predetermined action. Degraded navigation performance 
does not raise

[[Page 10702]]

the same level of concern as a degraded or lost C2 link. For example, a 
UA may experience interference with a GPS signal on the ground, but 
then find acceptable signal strength when above a tree line or other 
obstruction. The airworthiness criteria require that neither 
degradation nor complete loss of GPS or C2, as either condition would 
be a failure of that system, result in unsafe loss of control or 
containment. The applicant must demonstrate this by test to meet the 
requirements of D&R.305(a)(3).
    Under the airworthiness criteria, the minimum performance 
requirements for the C2 link, defining when the link is degraded to an 
unacceptable level, may vary among different UAS designs. The level of 
degradation that triggers a loss is dependent upon the specific UA 
characteristics; this level will be defined by the applicant and 
demonstrated to be acceptable by testing as required by D&R.305(a)(2) 
and D&R.310(a)(1).
    Comment Summary: An individual commenter requested the FAA use 
distinct terminology for ``communication,'' used for communications 
with air traffic control, and ``C2 link,'' used for command and control 
between the remote pilot station and UA. The commenter questioned 
whether, in the proposed criteria, the FAA stated ``loss of 
communication between the pilot and the UA'' when it intended to state 
``loss of C2 link.''
    FAA Response: Communication extends beyond the C2 link and specific 
control inputs. This is why D&R.001 requires the applicant's CONOPS to 
include a description of the command, control, and communications 
functions. As long as the UA operates safely and predictably per its 
lost link contingency programming logic, a C2 interruption does not 
constitute a loss of control.

Lightning

    The FAA proposed criteria to address the risks that would result 
from a lightning strike, accounting for the size and physical 
limitations of a UAS that could preclude traditional lightning 
protection features. The FAA further proposed that without lightning 
protection for the UA, the Flight Manual must include an operating 
limitation to prohibit flight into weather conditions with potential 
lightning.
    Comment Summary: An individual requested the FAA revise the 
criteria to include a similar design mitigation or operating limitation 
for High Intensity Radiated Fields (HIRF). The commenter noted that 
HIRF is included in proposed UAS.300(e) as part of the expected 
environmental conditions that must be replicated in testing.
    FAA Response: The airworthiness criteria, which are adopted as 
proposed, address the issue raised by the commenter. The applicant must 
identify tested HIRF exposure capabilities, if any, in the Flight 
Manual to comply with the criteria in D&R.200(a)(5). Information 
regarding HIRF capabilities is necessary for safe operation because 
proper communication and software execution may be impeded by HIRF-
generated interference, which could result in loss of control of the 
UA. It is not feasible to measure HIRF at every potential location 
where the UA will operate; thus, requiring operating limitations for 
HIRF as requested by the commenter would be impractical.

Adverse Weather Conditions

    The FAA proposed criteria either requiring that design 
characteristics protect the UAS from adverse weather conditions or 
prohibiting flight into known adverse weather conditions. The criteria 
proposed to define adverse weather conditions as rain, snow, and icing.
    Comment Summary: ALPA and two individual commenters requested the 
FAA expand the proposed definition of adverse weather conditions. These 
commenters noted that because of the size and physical limitations of 
the Model M2, adverse weather should also include wind, downdraft, low-
level wind shear (LLWS), microburst, and extreme mechanical turbulence.
    FAA Response: No additional language needs to be added to the 
airworthiness criteria to address wind effects. The wind conditions 
specified by the commenters are part of normal UA flight operations. 
The applicant must demonstrate by flight test that the UA can withstand 
wind without failure to meet the requirements of D&R.300(b)(9). The FAA 
developed the criteria in D&R.130 to address adverse weather conditions 
(rain, snow, and icing) that would require additional design 
characteristics for safe operation. Any operating limitations necessary 
for operation in adverse weather or wind conditions will be included in 
the Flight Manual as required by D&R.200.
    Comment Summary: One commenter questioned whether the criteria 
proposed in UAS.130(c)(2), requiring a means to detect adverse weather 
conditions for which the UAS is not certificated to operate, is a 
prescriptive requirement to install an onboard detection system. The 
commenter requested, if that was the case, that the FAA allow 
alternative procedures to avoid flying in adverse weather conditions.
    FAA Response: The language referred to by the commenter is not a 
prescriptive design requirement for an onboard detection system. The 
applicant may use any acceptable source to monitor weather in the area, 
whether onboard the UA or from an external source.

Critical Parts

    The FAA proposed criteria for critical parts that were 
substantively the same as those in the existing standards for normal 
category rotorcraft under Sec.  27.602, with changes to reflect UAS 
terminology and failure conditions. The criteria proposed to define a 
critical part as a part, the failure of which could result in a loss of 
flight or unrecoverable loss of control of the aircraft.
    Comment Summary: EASA requested the FAA avoid using the term 
``critical part,'' as it is a well-established term for complex manned 
aircraft categories and may create incorrect expectations on the 
oversight process for parts.
    FAA Response: For purposes of the airworthiness criteria 
established for the Matternet Model M2, the FAA has changed the term 
``critical part'' to ``flight essential part.''
    Comment Summary: An individual commenter requested the FAA revise 
the proposed criteria such that a failure of a flight essential part 
would only occur if there is risk to third parties.
    FAA Response: The definition of ``flight essential'' does not 
change regardless of whether on-board systems are capable of safely 
landing the UA when it is unable to continue its flight plan. Tying the 
definition of a flight essential part to the risk to third parties 
would result in different definitions for the part depending on where 
and how the UA is operated. These criteria for the Model M2 UA apply 
the same approach as for manned aircraft.

Flight Manual

    The FAA proposed criteria for the Flight Manual that were 
substantively the same as the existing standards for normal category 
airplanes, with minor changes to reflect UAS terminology.
    Comment Summary: ALPA requested the FAA revise the criteria to 
include normal, abnormal, and emergency operating procedures along with 
their respective checklist. ALPA further requested the checklist be 
contained in a quick reference handbook (QRH).
    FAA Response: The FAA did not intend for the airworthiness criteria 
to exclude abnormal procedures from the flight manual. In these final 
airworthiness criteria, the FAA has changed ``normal and emergency 
operating procedures'' to ``operating

[[Page 10703]]

procedures'' to encompass all operating conditions and align with 14 
CFR 23.2620, which includes the airplane flight manual requirements for 
normal category airplanes. The FAA has not made any changes to add 
language that would require the checklists to be included in a QRH. FAA 
regulations do not require manned aircraft to have a QRH for type 
certification. Therefore, it would be inconsistent for the FAA to 
require a QRH for the Matternet Model M2 UA.
    Comment Summary: ALPA requested the FAA revise the airworthiness 
criteria to require that the Flight Manual and QRH be readily available 
to the pilot at the control station.
    FAA Response: ALPA's request regarding the Flight manual addresses 
an operational requirement, similar to 14 CFR 91.9 and is therefore not 
appropriate for type certification airworthiness criteria. Also, as 
previously discussed, FAA regulations do not require a QRH. Therefore, 
it would be inappropriate to require it to be readily available to the 
pilot at the control station.
    Comment Summary: Droneport Texas LLC requested the FAA revise the 
airworthiness criteria to add required Flight Manual sections for 
routine maintenance and mission-specific equipment and procedures. The 
commenter stated that the remote pilot or personnel on the remote 
pilot-in-command's flight team accomplish most routine maintenance, and 
that the flight team usually does UA rigging with mission equipment.
    FAA Response: The requested change is appropriate for a maintenance 
document rather than a flight manual because it addresses maintenance 
procedures rather than the piloting functions. The FAA also notes that, 
similar to the criteria for certain manned aircraft, the airworthiness 
criteria require that the applicant prepare instructions for continued 
airworthiness (ICA) in accordance with Appendix A to Part 23. As the 
applicant must provide any maintenance instructions and mission-
specific information necessary for safe operation and continued 
operational safety of the UA, in accordance with D&R.205, no changes to 
the airworthiness criteria are necessary.
    Comment Summary: An individual commenter requested the FAA revise 
the criteria in proposed UAS.200(b) to require that ``other 
information'' referred to in proposed UAS.200(a)(5) be approved by the 
FAA. The commenter noted that, as proposed, only the information listed 
in UAS.200(a)(1) through (4) must be FAA approved.
    FAA Response: The change requested by the commenter would be 
inconsistent with the FAA's airworthiness standards for flight manuals 
for manned aircraft. Sections 23.2620(b), 25.1581(b), 27.1581(b), and 
29.1581(b) include requirements for flight manuals to include operating 
limitations, operating procedures, performance information, loading 
information, and other information that is necessary safe operation 
because of design, operating, or handling characteristics, but limit 
FAA approval to operating limitations, operating procedures, 
performance information, and loading information.
    Under Sec.  23.2620(b)(1), for low-speed level 1 and level 2 
airplanes, the FAA only approves the operating limitations. In applying 
a risk-based approach, the FAA has determined it would not be 
appropriate to hold the lowest risk UA to a higher standard than what 
is required for low speed level 1 and level 2 manned aircraft. 
Accordingly, the FAA has revised the airworthiness criteria to only 
require FAA approval of the operating limitations.
    Comment Summary: NUAIR requested the FAA recognize that Sec.  
23.2620 is only applicable to the aircraft and does not address off-
aircraft components such as the control station, control and non-
payload communications (CNPC) data link, and launch and recovery 
equipment. The commenter noted that this is also true of industry 
consensus-based standards designed to comply with Sec.  23.2620.
    FAA Response: As explained in more detail in the Control Station 
section of this document, the FAA has revised the airworthiness 
criteria for the AE. The FAA will approve AE or minimum specifications 
for the AE that could affect airworthiness as an operating limitation 
in the UA flight manual. The FAA will establish the approved AE or 
minimum specifications as operating limitations and include them in the 
UA type certificate data sheet and Flight Manual in accordance with 
D&R.105(c). The establishment of requirements for and the approval of 
AE will be in accordance with FAA Memorandum AIR600-21-AIR-600-PM01, 
dated July 13, 2021.

Durability and Reliability

    The FAA proposed durability and reliability testing that would 
require the applicant to demonstrate safe flight of the UAS across the 
entire operational envelope and up to all operational limitations, for 
all phases of flight and all aircraft configurations described in the 
applicant's CONOPS, with no failures that result in a loss of flight, 
loss of control, loss of containment, or emergency landing outside the 
operator's recovery area. The FAA further proposed that the unmanned 
aircraft would only be certificated for operations within the 
limitations, and for flight over areas no greater than the maximum 
population density, as described in the applicant's CONOPS and 
demonstrated by test.
    Comment Summary: ALPA requested that the proposed certification 
criteria require all flights during testing be completed in both normal 
and non-normal or off-nominal scenarios with no failures that result in 
a loss of flight, loss of control, loss of containment, or emergency 
landing outside of the operator's recovery zone. Specifically, ALPA 
stated that testing must not require exceptional piloting skill or 
alertness and include, at a minimum: All phases of the flight envelope, 
including the highest UA to pilot ratios; the most adverse combinations 
of the conditions and configuration; the environmental conditions 
identified in the CONOPS; the different flight profiles and routes 
identified in the CONOPS; and exposure to EMI and HIRF.
    FAA Response: No change is necessary because the introductory text 
and paragraphs (b)(7), (b)(9), (b)(10), (b)(13), (c), (d), (e), and (f) 
of D&R.300, which are adopted as proposed, contain the specific testing 
requirements requested by ALPA.
    Comment Summary: Droneport Texas LLC requested the FAA revise the 
testing criteria to include, for operation at night, testing both with 
and without night vision aids. The commenter stated that because small 
UAS operation at night is waivable under 14 CFR part 107, manufacturers 
will likely make assumptions concerning a pilot's familiarity with 
night vision device-aided and unaided operations.
    FAA Response: Under D&R.300(b)(11), the applicant must demonstrate 
by flight test that the UA can operate at night without failure using 
whatever equipment is onboard the UA itself. The pilot's familiarity, 
or lack thereof, with night vision equipment does not impact whether 
the UA is reliable and durable to complete testing without any 
failures.
    Comment Summary: EASA requested the FAA clarify how testing 
durability and reliability commensurate to the maximum population 
density, as proposed, aligns with the Specific Operations Risk 
Assessment (SORA) approach that is open to operational mitigation, 
reducing the initial ground risk. An individual commenter requested the 
FAA provide more details about the correlation between the

[[Page 10704]]

number of flight hours tested and the CONOPS environment (e.g., 
population density). The commenter stated that this is one of the most 
fundamental requirements, and the FAA should ensure equal treatment to 
all current and future applicants.
    FAA Response: In developing these testing criteria, the FAA sought 
to align the risk of UAS operations with the appropriate level of 
protection for human beings on the ground. The FAA proposed 
establishing the maximum population density demonstrated by durability 
and reliability testing as an operating limitation on the type 
certificate. However, the FAA has re-evaluated its approach and 
determined it to be more appropriate to connect the durability and 
reliability demonstrated during certification testing with the 
operating environment defined in the CONOPS.
    Basing testing on maximum population density may result in 
limitations not commensurate with many actual operations. As population 
density broadly refers to the number of people living in a given area 
per square mile, it does not allow for evaluating variation in a local 
operating environment. For example, an operator may have a route in an 
urban environment with the actual flight path along a greenway; the 
number of human beings exposed to risk from the UA operating overhead 
would be significantly lower than the population density for the area. 
Conversely, an operator may have a route over an industrial area where 
few people live, but where, during business hours, there may be highly 
dense groups of people. Specific performance characteristics such as 
altitude and airspeed also factor into defining the boundaries for safe 
operation of the UA.
    Accordingly, the FAA has revised D&R.300 to require the UA design 
to be durable and reliable when operated under the limitations 
prescribed for its operating environment. The information in the 
applicant's CONOPS will determine the operating environment for 
testing. For example, the minimum hours of reliability testing will be 
less for a UA conducting agricultural operations in a rural environment 
than if the same aircraft will be conducting package deliveries in an 
urban environment. The FAA will include the limitations that result 
from testing as operating limitations on the type certificate data 
sheet and in the UA Flight Manual. The FAA intends for this process to 
be similar to the process for establishing limitations prescribed for 
special purpose operations for restricted category aircraft. This 
allows for added flexibility in determining appropriate operating 
limitations, which will more closely reflect the operating environment.
    Finally, a comparison of these criteria with EASA's SORA approach 
is beyond the scope of this document because the SORA is intended to 
result in an operational approval rather than a type certificate.
    Comment Summary: EASA requested the FAA clarify how reliability at 
the aircraft level to ensure high-level safety objectives would enable 
validation of products under applicable bilateral agreements.
    FAA Response: As the FAA and international aviation authorities are 
still developing general airworthiness standards for UA, it would be 
speculative for the FAA to comment on the validation process for any 
specific UA.
    Comment Summary: EASA requested the FAA revise the testing criteria 
to include a compliance demonstration related to adverse combinations 
of the conditions and configurations and with respect to weather 
conditions and average pilot qualification.
    FAA Response: No change is necessary because D&R.300(b)(7), (b)(9), 
(b)(10), (c), and (f), which are adopted as proposed, contain the 
specific testing requirements requested by EASA.
    Comment Summary: EASA noted that, under the proposed criteria, 
testing involving a large number of flight hours will limit changes to 
the configuration.
    FAA Response: Like manned aircraft, the requirements of 14 CFR part 
21, subpart D, apply to UA for changes to type certificates. The FAA is 
developing procedures for processing type design changes for UA type 
certificated using durability and reliability testing.
    Comment Summary: EASA requested the FAA clarify whether the 
proposed testing criteria would require the applicant to demonstrate 
aspects that do not occur during a successful flight, such as the 
deployment of emergency recovery systems and fire protection/post-crash 
fire. EASA asked if these aspects are addressed by other means and what 
would be the applicable airworthiness criteria.
    FAA Response: Equipment not required for normal operation of the UA 
do not require an evaluation for their specific functionality. D&R 
testing will show that the inclusion of any such equipment does not 
prevent normal operation. Therefore, the airworthiness criteria would 
not require functional testing of the systems described by EASA.
    Comment Summary: An individual commenter requested the FAA specify 
the acceptable percentage of failures in the testing that would result 
in a ``loss of flight.'' The Small UAV Coalition requested the FAA 
clarify what constitutes an emergency landing outside an operator's 
landing area, as some UAS designs could include an onboard health 
system that initiates a landing to lessen the potential of a loss of 
control event. The commenter suggested that, in those cases, a landing 
in a safe location should not invalidate the test.
    FAA Response: The airworthiness criteria require that all test 
points and flight hours occur with no failures result in a loss of 
flight, control, containment, or emergency landing outside the 
operator's recovery zone. The FAA has determined that there is no 
acceptable percentage of failures in testing. In addition, while the 
recovery zone may differ for each UAS design, an emergency or unplanned 
landing outside of a designated landing area would result in a test 
failure.
    Comment Summary: The Small UAV Coalition requested that a single 
failure during testing not automatically restart counting the number of 
flight test operations set for a particular population density; rather, 
the applicant should have the option to identify the failure through 
root-cause and fault-tree analysis and provide a validated mitigation 
to ensure it will not recur. An individual commenter requested the FAA 
to clarify whether the purpose of the tests is to show compliance with 
a quantitative safety objective. The commenter further requested the 
FAA allow the applicant to reduce the number of flight testing hours if 
the applicant can present a predicted safety and reliability analysis.
    FAA Response: The intent of the testing criteria is for the 
applicant to demonstrate the aircraft's durability and reliability 
through a successful accumulation of flight testing hours. The FAA does 
not intend to require analytical evaluation to be part of this process. 
However, the applicant will comply with these testing criteria using a 
means of compliance, accepted by the FAA, through the issue paper 
process. The means of compliance will be dependent on the CONOPS the 
applicant has proposed to meet.

Probable Failures

    The FAA proposed criteria to evaluate how the UAS functions after 
probable failures, including failures related to propulsion systems, C2 
link, GPS, critical flight control components with a single point of 
failure, control station, and any other equipment identified by the 
applicant.

[[Page 10705]]

    Comment Summary: Droneport Texas LLC requested the FAA add a bird 
strike to the list of probable failures. The commenter stated that 
despite sense and avoid technologies, flocks of birds can overcome the 
maneuver capabilities of a UA and result in multiple, unintended 
failures.
    FAA Response: Unlike manned aircraft, where aircraft size, design, 
and construct are critical to safe control of the aircraft after 
encountering a bird strike, the FAA determined testing for bird strike 
capabilities is not necessary for the Model M2 UA. The FAA has 
determined that a bird strike requirement is not necessary because the 
smaller size and lower operational speed of the M2 reduce the 
likelihood of a bird strike, combined with the reduced consequences of 
failure due to no persons onboard. Instead, the FAA is using a risk-
based approach to tailor airworthiness requirements commensurate to the 
low-risk nature of the Model M2 UA.
    Comment Summary: ALPA requested the FAA require that all probable 
failure tests occur at the critical phase and mode of flight and at the 
highest aircraft-to-pilot ratio. ALPA stated the proposed criteria are 
critically important for systems that rely on a single source to 
perform multi-label functions, such as GNSS, because failure or 
interruption of GNSS will lead to loss of positioning, navigation, and 
timing (PNT) and functions solely dependent on PNT, such as geo-fencing 
and contingency planning.
    FAA Response: No change is necessary because D&R.300(c) requires 
that the testing occur at the critical phase and mode of flight and at 
the highest UA-to-pilot ratio.
    Comment Summary: Droneport Texas LLC requested the FAA add recovery 
from vortex ring state (VRS) to the list of probable failures. The 
commenter stated the UA uses multiple rotors for lift and is therefore 
susceptible to VRS. The commenter further stated that because recovery 
from settling with power is beyond a pilot's average skill for purposes 
of airworthiness testing, the aircraft must be able to sense and 
recover from this condition without pilot assistance.
    FAA Response: D&R.305 addresses probable failures related to 
specific components of the UAS. VRS is an aerodynamic condition a UA 
may encounter during flight testing; it is not a component subject to 
failure.
    Comment Summary: Droneport Texas LLC also requested the FAA add a 
response to the Air Traffic Control-Zero (ATC-Zero) command to the list 
of probable failures. The commenter stated, based on lessons learned 
after the attacks on September 11, 2001, aircraft that can fly BVLOS 
should be able to respond to an ATC-Zero condition.
    FAA Response: The commenter's request is more appropriate for the 
capabilities and functions testing criteria in D&R.310 than probable 
failures testing in D&R.305. D&R.310(a)(3) requires the applicant to 
demonstrate by test that the pilot has the ability to safely 
discontinue a flight. A pilot may discontinue a flight for a wide 
variety of reasons, including responding to an ATC-zero command.
    Comment Summary: EASA stated the proposed language seems to require 
an additional analysis and safety assessment, which would be 
appropriate for the objective requirement of ensuring a probable 
failure does not result in a loss of containment or control. EASA 
further stated that an applicant's basic understanding of the systems 
architecture and effects of failures is essential.
    FAA Response: The FAA agrees with the expectation that applicants 
understand the system architecture and effects of failures of a 
proposed design, which is why the criteria include a requirement for 
the applicant to test the specific equipment identified in D&R.305 and 
identify any other equipment that is not specifically identified in 
D&R.305 for testing. As the intent of the criteria is for the applicant 
to demonstrate compliance through testing, some analysis may be 
necessary to properly identify the appropriate equipment to be 
evaluated for probable failures.
    Comment Summary: An individual requested that probable failure 
testing apply not only to critical flight control components with a 
single point of failure, but also to any critical part with a single 
point of failure.
    FAA Response: The purpose of probable failure testing in D&R.305 is 
to demonstrate that if certain equipment fails, it will fail safely. 
Adding probable failure testing for critical (now flight essential) 
parts would not add value to testing. If a part is essential for 
flight, its failure by definition in D&R.135(a) could result in a loss 
of flight or unrecoverable loss of control. For example, on a 
traditional airplane design, failure of a wing spar in flight would 
lead to loss of the aircraft. Because there is no way to show that a 
wing spar can fail safely, the applicant must provide its mandatory 
replacement time if applicable, structural inspection interval, and 
related structural inspection procedure in the Airworthiness 
Limitations section of the ICA. Similarly, under these airworthiness 
criteria, parts whose failure would inherently result in loss of flight 
or unrecoverable loss of control are not subjected to probable failure 
testing. Instead, they must be identified as flight essential 
components and included in the ICA.
    To avoid confusion pertaining to probable failure testing, the FAA 
has removed the word ``critical'' from D&R.305(a)(5). In the final 
airworthiness criteria, probable failure testing required by 
D&R.305(a)(5) applies to ``Flight control components with a single 
point of failure.''

Capabilities and Functions

    The FAA proposed criteria to require the applicant to demonstrate 
by test the minimum capabilities and functions necessary for the 
design. UAS.310(a) proposed to require the applicant to demonstrate, by 
test, the capability of the UAS to regain command and control of the UA 
after a C2 link loss, the sufficiency of the electrical system to carry 
all anticipated loads, and the ability of the pilot to override any 
pre-programming in order to resolve a potential unsafe operating 
condition in any phase of flight. UAS.310(b) proposed to require the 
applicant to demonstrate by test certain features if the applicant 
requests approval of those features (geo-fencing, external cargo, 
etc.). UAS.310(c) proposed to require the design of the UAS to 
safeguard against an unintended discontinuation of flight or release of 
cargo, whether by human action or malfunction.
    Comment Summary: ALPA stated the pilot-in-command must always have 
the capability to input control changes to the UA and override any pre-
programming without delay as needed for the safe management of the 
flight. The commenter requested that the FAA retain the proposed 
criteria that would allow the pilot to command to: Regain command and 
control of the UA after loss of the C2 link; safely discontinue the 
flight; and dynamically re-route the UA. In support, ALPA stated the 
ability of the pilot to continually command (re-route) the UA, 
including termination of the flight if necessary, is critical for safe 
operations and should always be available to the pilot.
    Honeywell requested the FAA revise paragraphs (a)(3) and (a)(4) of 
the criteria (UAS.310) to allow for either the pilot or an augmenting 
system to safely discontinue the flight and re-route the UA. The 
commenter stated that a system comprised of detect and avoid, onboard 
autonomy, and ground system can be used for these functions. Therefore, 
the

[[Page 10706]]

criteria should not require that only the pilot can do them.
    An individual commenter requested the FAA remove UAS.310(a)(4) of 
the proposed criteria because requiring the ability for the pilot to 
dynamically re-route the UA is too prescriptive and redundant with the 
proposed requirement in UAS.310(a)(3), the ability of the pilot to 
discontinue the flight safely.
    FAA Response: Because the pilot in command is directly responsible 
for the operation of the UA, the pilot must have the capability to 
command actions necessary for continued safety. This includes 
commanding a change to the flight path or, when appropriate, safely 
terminating a flight. The FAA notes that the ability for the pilot to 
safely discontinue a flight means the pilot has the means to terminate 
the flight and immediately and safely return the UA to the ground. This 
is different from the pilot having the means to dynamically re-route 
the UA, without terminating the flight, to avoid a conflict.
    Therefore, the final airworthiness criteria include D&R.310(a) as 
proposed (UAS.310(a)).
    Comment Summary: ALPA requested the FAA revise the criteria to 
require that all equipment, systems, and installations conform, at a 
minimum, to the standards of Sec.  25.1309.
    FAA Response: The FAA determined that traditional methodologies for 
manned aircraft, including the system safety analysis required by 
Sec. Sec.  23.2510, 25.1309, 27.1309, or 29.1309, would be 
inappropriate to require for the Matternet Model M2 due to its smaller 
size and reduced level of complexity. Instead, the FAA finds that 
system reliability through testing will ensure the safety of this 
design.
    Comment Summary: ALPA requested the FAA revise the criteria to add 
a requirement to demonstrate the ability of the UA and pilot to perform 
all of the contingency plans identified in proposed UAS.120.
    FAA Response: No change is necessary because D&R.120 and 
D&R.305(a)(2), together, require what ALPA requests in its comment. 
Under D&R.120, the applicant must design the UA to execute a 
predetermined action in the event of a loss of the C2 link. 
D&R.305(a)(2) requires the applicant to demonstrate by test that a lost 
C2 link will not result in a loss of containment or control of the UA. 
Thus, if the applicant does not demonstrate the predetermined 
contingency plan resulting from a loss of the C2 link when conducting 
D&R.305 testing, the test would be a failure due to loss of 
containment.
    Comment Summary: ALPA and an individual commenter requested the FAA 
revise the criteria so that geo-fencing is a required feature and not 
optional due to the safety concerns that could result from a UA exiting 
its operating area.
    FAA Response: To ensure safe flight, the applicant must test the 
proposed safety functions, such as geo-fencing, that are part of the 
type design of the Model M2 UA. The FAA determined that geo-fencing is 
an optional feature because it is one way, but not the only way, to 
ensure a safely contained operation.
    Comment Summary: ALPA requested the FAA revise the criteria so that 
capability to detect and avoid other aircraft and obstacles is a 
required feature and not optional.
    FAA Response: D&R.310(a)(4) requires the applicant demonstrate the 
ability for the pilot to safely re-route the UA in flight to avoid a 
dynamic hazard. The FAA did not prescribe specific design features such 
as a collision avoidance system to meet D&R.310(a)(4) because there are 
multiple means to minimize the risk of collision.
    Comment Summary: McMahon Helicopter Services requested that the 
airworthiness criteria require a demonstration of sense-and-avoid 
technology that will automatically steer the UA away from manned 
aircraft, regardless of whether the manned aircraft has a transponder. 
NAAA and an individual commenter requested that the FAA require ADS-B 
in/out and traffic avoidance software on all UAS. The Small UAV 
Coalition requested the FAA establish standards for collision avoidance 
technology, as the proposed criteria are not sufficient for compliance 
with the operational requirement to see and avoid other aircraft (Sec.  
91.113). The commenters stated that these technologies are necessary to 
avoid a mid-air collision between UA and manned aircraft.
    FAA Response: D&R.310(a)(4) requires the applicant demonstrate the 
ability for the UA to be safely re-routed in flight to avoid a dynamic 
hazard. The FAA did not prescribe specific design features, such as the 
technologies suggested by the commenters, to meet D&R.310(a)(4) because 
they are not the only means for complying with the operational 
requirement to see and avoid other aircraft. If an applicant chooses to 
equip their UA with onboard collision avoidance technology, those 
capabilities and functions must be demonstrated by test per 
D&R.310(b)(5).

Verification of Limits

    The FAA proposed to require an evaluation of the UA's performance, 
maneuverability, stability, and control with a factor of safety.
    Comment Summary: EASA requested that the FAA revise its approach to 
require a similar compliance demonstration as EASA's for ``light UAS.'' 
EASA stated the FAA's proposed criteria for verification of limits, 
combined with the proposed Flight Manual requirements, seem to replace 
a traditional Subpart Flight.\3\ EASA further stated the FAA's approach 
in the proposed airworthiness criteria might necessitate more guidance 
and means of compliance than the traditional structure.
---------------------------------------------------------------------------

    \3\ In the FAA's aircraft airworthiness standards (parts 23, 25, 
27 and 29), subpart B of each is titled Flight.
---------------------------------------------------------------------------

    FAA Response: The FAA's airworthiness criteria will vary from 
EASA's light UAS certification requirements, resulting in associated 
differences in compliance demonstrations. At this time, comment on 
means of compliance and related guidance material, which are still 
under development with the FAA and with EASA, would be speculative.

Propulsion

    Comment Summary: ALPA requested the FAA conduct an analysis to 
determine battery reliability and safety, taking into account wind and 
weather conditions and their effect on battery life. ALPA expressed 
concern with batteries as the only source of power for an aircraft in 
the NAS. ALPA further requested the FAA not grant exemptions for 
battery reserve requirements.
    FAA Response: Because batteries are a flight essential part, the 
applicant must establish mandatory instructions or life limits for 
batteries under the requirements of D&R.135. In addition, when the 
applicant conducts its D&R testing, D&R.300(i) prevents the applicant 
from exceeding the maintenance intervals or life limits for those 
batteries. To the extent the commenter's request addresses fuel 
reserves, that is an operational requirement, not a certification 
requirement, and therefore beyond the scope of this document.

Additional Airworthiness Criteria Identified by Commenters

    Comment Summary: McMahon Helicopter Services requested that the 
criteria require anti-collision and navigation lighting certified to 
existing FAA standards for brightness and size. The commenter stated 
that these

[[Page 10707]]

standards were based on human factors for nighttime and daytime 
recognition and are not simply a lighting requirement. An individual 
commenter requested that the criteria include a requirement for 
position lighting and anti-collision beacons meeting TSO-30c Level III. 
NAAA requested the criteria require a strobe light and high visibility 
paint scheme to aid in visual detection of the UA by other aircraft.
    FAA Response: The FAA determined it is unnecessary for these 
airworthiness criteria to prescribe specific design features for anti-
collision or navigation lighting. The FAA will address anti-collision 
lighting as part of any operational approval, similar to the rules in 
14 CFR 107.29(a)(2) and (b) for small UAS.
    Comment Summary: ALPA requested the FAA add a new section with 
minimum standards for Global Navigation Satellite System (GNSS), as the 
UAS will likely rely heavily upon GNSS for navigation and to ensure 
that the UA does not stray outside of its approved airspace. ALPA 
stated that technological advances have made such devices available at 
an appropriate size, weight, and power for UAs.
    FAA Response: The airworthiness criteria in D&R.100 (UA Signal 
Monitoring and Transmission), D&R.110 (Software), D&R.115 
(Cybersecurity), and D&R.305(a)(3) (probable failures related to GPS) 
sufficiently address design requirements and testing of navigation 
systems. Even if the applicant uses a TSO-approved GNSS, these 
airworthiness criteria require a demonstration that the UA operates 
successfully without loss of containment. Successful completion of 
these tests demonstrates that the navigation subsystems are acceptable.
    Comment Summary: ALPA requested the FAA revise the criteria to add 
a new section requiring equipage to comply with the FAA's new rules on 
Remote Identification of Unmanned Aircraft (86 FR 4390, Jan. 15, 2021). 
An individual commenter questioned the need for public tracking and 
identification of drones in the event of a crash or violation of FAA 
flight rules.
    FAA Response: The FAA issued the final rule, Remote Identification 
of Unmanned Aircraft, after providing an opportunity for public notice 
and comment. The final rule is codified at 14 CFR part 89. Part 89 
contains the remote identification requirements for unmanned aircraft 
certificated and produced under part 21 after September 16, 2022.

Pilot Ratio

    Comment Summary: ALPA and one individual questioned the safety of 
multiple Model M2 UA operated by a single pilot, up to a ratio of 20 UA 
to 1 pilot. ALPA stated that even with high levels of automation, the 
pilot must still manage the safe operation and maintain situational 
awareness of multiple aircraft in their flight path, aircraft systems, 
integration with traffic, obstacles, and other hazards during normal, 
abnormal, and emergency conditions. As a result, ALPA recommended the 
FAA conduct additional studies to better understand the feasibility of 
a single pilot operating multiple UA before developing airworthiness 
criteria. The Small UAV Coalition requested the FAA provide criteria 
for an aircraft-to-pilot ratio higher than 20:1.
    FAA Response: These airworthiness criteria are specific to the 
Model M2 UA and, as discussed previously in this preamble, operations 
of the Model M2 UA may include multiple UA operated by a single pilot, 
up to a ratio of 20 UA to 1 pilot. Additionally, these airworthiness 
criteria require the applicant to demonstrate the durability and 
reliability of the UA design by flight test, at the highest aircraft-
to-pilot ratio, without exceptional piloting skill or alertness. In 
addition, D&R.305(c) requires the applicant to demonstrate probable 
failures by test at the highest aircraft-to-pilot ratio. Should the 
pilot ratio cause a loss of containment or control of the UA, then the 
applicant will fail this testing.
    Comment Summary: ALPA stated that to allow a UAS-pilot ratio of up 
to 20:1 safely, the possibility that the pilot will need to intervene 
with multiple UA simultaneously must be ``extremely remote.'' ALPA 
questioned whether this is feasible given the threat of GNSS 
interference or unanticipated wind gusts exceeding operational limits.
    FAA Response: The FAA's guidance in AC 23.1309-1E, System Safety 
Analysis and Assessment for Part 23 Airplanes defines ``extremely 
remote failure conditions'' as failure conditions not anticipated to 
occur during the total life of an airplane, but which may occur a few 
times when considering the total operational life of all airplanes of 
the same type. When assessing the likelihood of a pilot needing to 
intervene with multiple UA simultaneously, the minimum reliability 
requirements will be determined based on the applicant's proposed 
CONOPS.

Noise

    Comment Summary: An individual commenter expressed concern about 
noise pollution.
    FAA Response: The Model M2 will need to comply with FAA noise 
certification standards. If the FAA determines that 14 CFR part 36 does 
not contain adequate standards for this design, the agency will propose 
and seek public comment on a rule of particular applicability for noise 
requirements under a separate rulemaking docket.

Operating Altitude

    Comment Summary: ALPA, McMahon Helicopter Services, and NAAA 
commented on the operation of UAS at or below 400 feet AGL. ALPA, 
McMahon Helicopter Services, and NAAA requested the airworthiness 
criteria contain measures for safe operation at low altitudes so that 
UAS are not a hazard to manned aircraft, especially operations 
involving helicopters; air tours; agricultural applications; emergency 
medical services; air tanker firefighting; power line and pipeline 
patrol and maintenance; fish and wildlife service; animal control; 
military and law enforcement; seismic operations; ranching and 
livestock relocation; and mapping.
    FAA Response: The type certificate only establishes the approved 
design of the UA. These airworthiness criteria require the applicant 
show compliance for the UA altitude sought for type certification. 
While this may result in operating limitations in the flight manual, 
the type certificate is not an approval for operations. Operations and 
operational requirements are beyond the scope of this document.

Guidance Material

    Comment Summary: NUAIR requested the FAA complete and publish its 
draft AC 21.17-XX, Type Certification Basis for Unmanned Aircraft 
Systems (UAS), to provide additional guidance, including templates, to 
those who seek a type design approval for UAS. NUAIR also requested the 
FAA recognize the industry consensus-based standards applicable to UAS, 
as Transport Canada has by publishing its AC 922-001, Remotely Piloted 
Aircraft Systems Safety Assurance.
    FAA Response: The FAA will continue to develop policy and guidance 
for UA type certification and will publish guidance as soon as 
practicable. The FAA encourages consensus standards bodies to develop

[[Page 10708]]

means of compliance and submit them to the FAA for acceptance. 
Regarding Transport Canada AC 922-001, that AC addresses operational 
approval rather than type certification.

Safety Management

    Comment Summary: ALPA requested the FAA ensure that operations, 
including UA integrity, fall under the safety management system. ALPA 
further requested the FAA convene a Safety Risk Management Panel before 
allowing operators to commence operations and that the FAA require 
operators to have an active safety management system, including a non-
punitive safety culture, where incident and continuing airworthiness 
issues can be reported.
    FAA Response: The type certificate only establishes the approved 
design of the UA, including the Flight Manual and ICA. Operations and 
operational requirements, including safety management and oversight of 
operations and maintenance, are beyond the scope of this document.

Process

    Comment Summary: ALPA supported the FAA's type certification of UAS 
as a ``special class'' of aircraft under Sec.  21.17(b) but requested 
that it be temporary.
    FAA Response: As the FAA stated in its notice of policy issued 
August 11, 2020 (85 FR 58251, September 18, 2020), the FAA will use the 
type certification process under Sec.  21.17(b) for some unmanned 
aircraft with no occupants onboard. The FAA further stated in its 
policy that it may also issue type certificates under Sec.  21.17(a) 
for airplane and rotorcraft UAS designs where the airworthiness 
standards in part 23, 25, 27, or 29, respectively, are appropriate. The 
FAA, in the future, may consider establishing appropriate generally 
applicable airworthiness standards for UA that are not certificated 
under the existing standards in parts 23, 25, 27, or 29.

Out of Scope Comments

    The FAA received and reviewed several comments that were general, 
stated the commenter's viewpoint or opposition without a suggestion 
specific to the proposed criteria, or did not make a request the FAA 
can act on. These comments are beyond the scope of this document.

Applicability

    These airworthiness criteria, established under the provisions of 
Sec.  21.17(b), are applicable to the Matternet Model M2 UA. Should 
Matternet wish to apply these airworthiness criteria to other UA 
models, it must submit a new type certification application.

Conclusion

    This action affects only certain airworthiness criteria for the 
Matternet Model M2 UA. It is not a standard of general applicability.

Authority Citation

    The authority citation for these airworthiness criteria is as 
follows:

    Authority: 49 U.S.C. 106(g), 40113, and 44701-44702, 44704.

Airworthiness Criteria

    Pursuant to the authority delegated to me by the Administrator, the 
following airworthiness criteria are issued as part of the type 
certification basis for the Matternet Model M2 unmanned aircraft. The 
FAA finds that compliance with these criteria appropriately mitigates 
the risks associated with the design and concept of operations and 
provides an equivalent level of safety to existing rules.

General

D&R.001 Concept of Operations

    The applicant must define and submit to the FAA a concept of 
operations (CONOPS) proposal describing the unmanned aircraft system 
(UAS) operation in the national airspace system for which unmanned 
aircraft (UA) type certification is requested. The CONOPS proposal must 
include, at a minimum, a description of the following information in 
sufficient detail to determine the parameters and extent of testing and 
operating limitations:
    (a) The intended type of operations;
    (b) UA specifications;
    (c) Meteorological conditions;
    (d) Operators, pilots, and personnel responsibilities;
    (e) Control station, support equipment, and other associated 
elements (AE) necessary to meet the airworthiness criteria;
    (f) Command, control, and communication functions;
    (g) Operational parameters (such as population density, geographic 
operating boundaries, airspace classes, launch and recovery area, 
congestion of proposed operating area, communications with air traffic 
control, line of sight, and aircraft separation); and
    (h) Collision avoidance equipment, whether onboard the UA or part 
of the AE, if requested.

D&R.005 Definitions

    For purposes of these airworthiness criteria, the following 
definitions apply.
    (a) Loss of Control: Loss of control means an unintended departure 
of an aircraft from controlled flight. It includes control reversal or 
an undue loss of longitudinal, lateral, and directional stability and 
control. It also includes an upset or entry into an unscheduled or 
uncommanded attitude with high potential for uncontrolled impact with 
terrain. A loss of control means a spin, loss of control authority, 
loss of aerodynamic stability, divergent flight characteristics, or 
similar occurrence, which could generally lead to crash.
    (b) Loss of Flight: Loss of flight means a UA's inability to 
complete its flight as planned, up to and through its originally 
planned landing. It includes scenarios where the UA experiences 
controlled flight into terrain, obstacles, or any other collision, or a 
loss of altitude that is severe or non-reversible. Loss of flight also 
includes deploying a parachute or ballistic recovery system that leads 
to an unplanned landing outside the operator's designated recovery 
zone.

Design and Construction

D&R.100 UA Signal Monitoring and Transmission

    The UA must be designed to monitor and transmit to the AE all 
information required for continued safe flight and operation. This 
information includes, at a minimum, the following:
    (a) Status of all critical parameters for all energy storage 
systems;
    (b) Status of all critical parameters for all propulsion systems;
    (c) Flight and navigation information as appropriate, such as 
airspeed, heading, altitude, and location; and
    (d) Communication and navigation signal strength and quality, 
including contingency information or status.

D&R.105 UAS AE Required for Safe UA Operations

    (a) The applicant must identify and submit to the FAA all AE and 
interface conditions of the UAS that affect the airworthiness of the UA 
or are otherwise necessary for the UA to meet these airworthiness 
criteria. As part of this requirement--
    (1) The applicant may identify either specific AE or minimum 
specifications for the AE.
    (i) If minimum specifications are identified, they must include the 
critical requirements of the AE, including performance, compatibility, 
function,

[[Page 10709]]

reliability, interface, pilot alerting, and environmental requirements.
    (ii) Critical requirements are those that if not met would impact 
the ability to operate the UA safely and efficiently.
    (2) The applicant may use an interface control drawing, a 
requirements document, or other reference, titled so that it is clearly 
designated as AE interfaces to the UA.
    (b) The applicant must show the FAA the AE or minimum 
specifications identified in paragraph (a) of this section meet the 
following:
    (1) The AE provide the functionality, performance, reliability, and 
information to assure UA airworthiness in conjunction with the rest of 
the design;
    (2) The AE are compatible with the UA capabilities and interfaces;
    (3) The AE must monitor and transmit to the pilot all information 
required for safe flight and operation, including but not limited to 
those identified in D&R.100; and
    (4) The minimum specifications, if identified, are correct, 
complete, consistent, and verifiable to assure UA airworthiness.
    (c) The FAA will establish the approved AE or minimum 
specifications as operating limitations and include them in the UA type 
certificate data sheet and Flight Manual.
    (d) The applicant must develop any maintenance instructions 
necessary to address implications from the AE on the airworthiness of 
the UA. Those instructions will be included in the instructions for 
continued airworthiness (ICA) required by D&R.205.

D&R.110 Software

    To minimize the existence of software errors, the applicant must:
    (a) Verify by test all software that may impact the safe operation 
of the UA;
    (b) Utilize a configuration management system that tracks, 
controls, and preserves changes made to software throughout the entire 
life cycle; and
    (c) Implement a problem reporting system that captures and records 
defects and modifications to the software.

D&R.115 Cybersecurity

    (a) UA equipment, systems, and networks, addressed separately and 
in relation to other systems, must be protected from intentional 
unauthorized electronic interactions that may result in an adverse 
effect on the security or airworthiness of the UA. Protection must be 
ensured by showing that the security risks have been identified, 
assessed, and mitigated as necessary.
    (b) When required by paragraph (a) of this section, procedures and 
instructions to ensure security protections are maintained must be 
included in the ICA.

D&R.120 Contingency Planning

    (a) The UA must be designed so that, in the event of a loss of the 
command and control (C2) link, the UA will automatically and 
immediately execute a safe predetermined flight, loiter, landing, or 
termination.
    (b) The applicant must establish the predetermined action in the 
event of a loss of the C2 link and include it in the UA Flight Manual.
    (c) The UA Flight Manual must include the minimum performance 
requirements for the C2 data link defining when the C2 link is degraded 
to a level where remote active control of the UA is no longer ensured. 
Takeoff when the C2 link is degraded below the minimum link performance 
requirements must be prevented by design or prohibited by an operating 
limitation in the UA Flight Manual.

D&R.125 Lightning

    (a) Except as provided in paragraph (b) of this section, the UA 
must have design characteristics that will protect the UA from loss of 
flight or loss of control due to lightning.
    (b) If the UA has not been shown to protect against lightning, the 
UA Flight Manual must include an operating limitation to prohibit 
flight into weather conditions conducive to lightning activity.

D&R.130 Adverse Weather Conditions

    (a) For purposes of this section, ``adverse weather conditions'' 
means rain, snow, and icing.
    (b) Except as provided in paragraph (c) of this section, the UA 
must have design characteristics that will allow the UA to operate 
within the adverse weather conditions specified in the CONOPS without 
loss of flight or loss of control.
    (c) For adverse weather conditions for which the UA is not approved 
to operate, the applicant must develop operating limitations to 
prohibit flight into known adverse weather conditions and either:
    (1) Develop operating limitations to prevent inadvertent flight 
into adverse weather conditions; or
    (2) Provide a means to detect any adverse weather conditions for 
which the UA is not certificated to operate and show the UA's ability 
to avoid or exit those conditions.

D&R.135 Flight Essential Parts

    (a) A flight essential part is a part, the failure of which could 
result in a loss of flight or unrecoverable loss of UA control.
    (b) If the type design includes flight essential parts, the 
applicant must establish a flight essential parts list. The applicant 
must develop and define mandatory maintenance instructions or life 
limits, or a combination of both, to prevent failures of flight 
essential parts. Each of these mandatory actions must be included in 
the Airworthiness Limitations Section of the ICA.

Operating Limitations and Information

D&R.200 Flight Manual

    The applicant must provide a Flight Manual with each UA.
    (a) The UA Flight Manual must contain the following information:
    (1) UA operating limitations;
    (2) UA operating procedures;
    (3) Performance information;
    (4) Loading information; and
    (5) Other information that is necessary for safe operation because 
of design, operating, or handling characteristics.
    (b) Those portions of the UA Flight Manual containing the 
information specified in paragraph (a)(1) of this section must be 
approved by the FAA.

D&R.205 Instructions for Continued Airworthiness

    The applicant must prepare ICA for the UA in accordance with 
Appendix A to Part 23, as appropriate, that are acceptable to the FAA. 
The ICA may be incomplete at type certification if a program exists to 
ensure their completion prior to delivery of the first UA or issuance 
of a standard airworthiness certificate, whichever occurs later.

Testing

D&R.300 Durability and Reliability

    The UA must be designed to be durable and reliable when operated 
under the limitations prescribed for its operating environment, as 
documented in its CONOPS and included as operating limitations on the 
type certificate data sheet and in the UA Flight Manual. The durability 
and reliability must be demonstrated by flight test in accordance with 
the requirements of this section and completed with no failures that 
result in a loss of flight, loss of control, loss of containment, or 
emergency landing outside the operator's recovery area.
    (a) Once a UA has begun testing to show compliance with this 
section, all flights for that UA must be included in the flight test 
report.
    (b) Tests must include an evaluation of the entire flight envelope 
across all phases of operation and must address, at a minimum, the 
following:

[[Page 10710]]

    (1) Flight distances;
    (2) Flight durations;
    (3) Route complexity;
    (4) Weight;
    (5) Center of gravity;
    (6) Density altitude;
    (7) Outside air temperature;
    (8) Airspeed;
    (9) Wind;
    (10) Weather;
    (11) Operation at night, if requested;
    (12) Energy storage system capacity; and
    (13) Aircraft to pilot ratio.
    (c) Tests must include the most adverse combinations of the 
conditions and configurations in paragraph (b) of this section.
    (d) Tests must show a distribution of the different flight profiles 
and routes representative of the type of operations identified in the 
CONOPS.
    (e) Tests must be conducted in conditions consistent with the 
expected environmental conditions identified in the CONOPS, including 
electromagnetic interference (EMI) and high intensity radiated fields 
(HIRF).
    (f) Tests must not require exceptional piloting skill or alertness.
    (g) Any UAS used for testing must be subject to the same worst-case 
ground handling, shipping, and transportation loads as those allowed in 
service.
    (h) Any UA used for testing must use AE that meet, but do not 
exceed, the minimum specifications identified under D&R.105. If 
multiple AE are identified, the applicant must demonstrate each 
configuration.
    (i) Any UAS used for testing must be maintained and operated in 
accordance with the ICA and UA Flight Manual. No maintenance beyond the 
intervals established in the ICA will be allowed to show compliance 
with this section.
    (j) If cargo operations or external-load operations are requested, 
tests must show, throughout the flight envelope and with the cargo or 
external-load at the most critical combinations of weight and center of 
gravity, that--
    (1) The UA is safely controllable and maneuverable; and
    (2) The cargo or external-load are retainable and transportable.

D&R.305 Probable Failures

    The UA must be designed such that a probable failure will not 
result in a loss of containment or control of the UA. This must be 
demonstrated by test.
    (a) Probable failures related to the following equipment, at a 
minimum, must be addressed:
    (1) Propulsion systems;
    (2) C2 link;
    (3) Global Positioning System (GPS);
    (4) Flight control components with a single point of failure;
    (5) Control station; and
    (6) Any other AE identified by the applicant.
    (b) Any UA used for testing must be operated in accordance with the 
UA Flight Manual.
    (c) Each test must occur at the critical phase and mode of flight, 
and at the highest aircraft-to-pilot ratio.

D&R.310 Capabilities and Functions

    (a) All of the following required UAS capabilities and functions 
must be demonstrated by test:
    (1) Capability to regain command and control of the UA after the C2 
link has been lost.
    (2) Capability of the electrical system to power all UA systems and 
payloads.
    (3) Ability for the pilot to safely discontinue the flight.
    (4) Ability for the pilot to dynamically re-route the UA.
    (5) Ability to safely abort a takeoff.
    (6) Ability to safely abort a landing and initiate a go-around.
    (b) The following UAS capabilities and functions, if requested for 
approval, must be demonstrated by test:
    (1) Continued flight after degradation of the propulsion system.
    (2) Geo-fencing that contains the UA within a designated area, in 
all operating conditions.
    (3) Positive transfer of the UA between control stations that 
ensures only one control station can control the UA at a time.
    (4) Capability to release an external cargo load to prevent loss of 
control of the UA.
    (5) Capability to detect and avoid other aircraft and obstacles.
    (c) The UA must be designed to safeguard against inadvertent 
discontinuation of the flight and inadvertent release of cargo or 
external load.

D&R.315 Fatigue

    The structure of the UA must be shown to withstand the repeated 
loads expected during its service life without failure. A life limit 
for the airframe must be established, demonstrated by test, and 
included in the ICA.

D&R.320 Verification of Limits

    The performance, maneuverability, stability, and control of the UA 
within the flight envelope described in the UA Flight Manual must be 
demonstrated at a minimum of 5% over maximum gross weight with no loss 
of control or loss of flight.

    Issued in Washington, DC, on February 16, 2022.
Ian Lucas
Manager, Policy Implementation Section, Policy and Innovation Division, 
Aircraft Certification Service.
[FR Doc. 2022-03867 Filed 2-24-22; 8:45 am]
BILLING CODE 4910-13-P

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.