Airworthiness Criteria: Special Class Airworthiness Criteria for the Wing Aviation LLC; Hummingbird Unmanned Aircraft, 2118-2125 [2024-00549]

Agencies

• Federal Aviation Administration
• DEPARTMENT OF TRANSPORTATION

[Federal Register Volume 89, Number 9 (Friday, January 12, 2024)]
[Rules and Regulations]
[Pages 2118-2125]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-00549]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 21

[Docket No. FAA-2022-1763]


Airworthiness Criteria: Special Class Airworthiness Criteria for 
the Wing Aviation LLC; Hummingbird Unmanned Aircraft

AGENCY: Federal Aviation Administration (FAA), Department of 
Transportation (DOT).

ACTION: Issuance of final airworthiness criteria.

-----------------------------------------------------------------------

SUMMARY: The FAA announces the special class airworthiness criteria for 
the Wing Aviation LLC (Wing) Hummingbird unmanned aircraft (UA). This 
document sets forth the airworthiness criteria that the FAA finds to be 
appropriate and applicable for the UA design.

DATES: These airworthiness criteria are effective February 12, 2024.

FOR FURTHER INFORMATION CONTACT: Mack A. Martinez, Product Policy 
Management--Emerging Aircraft Section, AIR-62B, Technical Policy 
Branch, Policy and Standards Division, Aircraft Certification Service, 
Federal Aviation Administration, 2300 East Devon Avenue, Room 335/339, 
Des Plaines, IL 60018, telephone (847) 294-7481.

SUPPLEMENTARY INFORMATION:

Background

    Wing Aviation LLC (Wing) applied to the FAA on September 19, 2018, 
for a special class type certificate (TC) under 14 CFR 21.17(b) for the 
Model Hummingbird UA.
    The Model Hummingbird consists of a fixed-wing airplane UA and its 
associated elements (AE) including communication links and components 
that control the UA. The Model Hummingbird UA has a maximum gross 
takeoff weight of approximately 15 pounds. It is approximately 3.4 feet 
in width, 4.2 feet in length, and 9.4 inches in height. The Model 
Hummingbird UA is battery powered using electric motors for vertical 
takeoff, landing, and forward flight. The unmanned aircraft system 
(UAS) operations would rely on high levels of automation and may 
include multiple UA operated by a single pilot, up to a ratio of 20 UA 
to 1 pilot. Wing intends for the Model Hummingbird to be used to 
deliver packages. The proposed concept of operations (CONOPS) for the 
Model Hummingbird includes a maximum operating altitude of 400 feet 
above ground level, a maximum cruise speed of 68 knots, operations 
beyond visual line of sight (BVLOS), and operations over people (OOP). 
Wing has not requested approval for flight into known icing for the 
Model Hummingbird UA.
    Under Sec.  21.17(c), an application for type certification is 
effective for 3 years. Section 21.17(d) provides that where a TC has 
not been issued within that 3-year time limit, the applicant may file 
for an extension and update the designated applicable regulations in 
the type certification basis. The effective date of the applicable 
airworthiness requirements for the updated type certification basis 
must not be earlier than 3 years before the date of issue of the TC. 
Since the project was not certificated within 3 years after the 
application date above, the FAA approved the applicant's request to 
extend the application for type certification. As a result, the date of 
the updated type certification basis is September 26, 2022.
    The FAA issued a notice of proposed airworthiness criteria for the 
Wing Model Hummingbird UA, which published in the Federal Register on 
February 8, 2023 (88 FR 8333).

Discussion of Comments

    The FAA received responses from 5 commenters. The comments came 
from industry organizations such as the Air Line Pilots Association 
(ALPA), the Association for Uncrewed Vehicle Systems International 
(AUVSI), the Small Unmanned Aerial Vehicles (UAV) Coalition, the 
Commercial Drone Alliance, and Wing Aviation LLC.

Specific Issues Raised Within the Scope of the Notice

    D&R.100 UA Signal Monitoring and Transmission: The FAA proposed 
criteria on the minimum types of information the FAA finds are 
necessary for the UA to transmit to the AE for continued safe flight 
and operation.
    Comment Summary: ALPA is concerned with the possibility of cyber 
security breaches that could allow unauthorized individuals to take 
control of a UA, potentially leading to safety issues. As such, it is 
important to address these concerns and establish an acceptable 
envelope of tolerance for UA operation that ensures the security of the 
signal monitoring and transmission systems.
    FAA Response: These comments are outside the scope for D&R.100. The 
comments by ALPA on cyber security, D&R.115, are addressed in the 
following paragraph.

[[Page 2119]]

    D&R.115 Cyber Security: The FAA proposed a requirement to address 
the risks to the UA associated with intentional unauthorized electronic 
interactions that may result in an adverse effect on the security or 
airworthiness of the UA.
    Comment Summary: ALPA is concerned with the safety and security of 
the Command and Control (C2) link and potential unauthorized intrusions 
that could result in the loss of full control over the aircraft. ALPA 
recommends that every UA model requesting operations in the National 
Airspace System (NAS) undergo testing and validation during the 
aircraft certification process to ensure the security of the C2 link is 
impenetrable and cannot be hacked. ALPA states that reports have shown 
that the loss of the C2 link and the inability to regain it has led to 
an uncontained flyaway. ALPA focuses on the most critical aspects of 
safe UA operations and recommends specific requirements to ensure the 
safe discontinuation of a flight after a failure of a critical part or 
system and/or unauthorized intrusion of the C2 link. Other 
recommendations include the ability of the pilot to re-route the UA 
safely and dynamically, the ability for the UA control station to allow 
the pilot to intervene in the management of the flight, an established 
parameter requirement for geo-fencing specifications, and a requirement 
for the UA to possess the capability to detect and avoid other aircraft 
and hazards that are human made/manufactured and natural.
    FAA Response: The proposed recommendations are too specific for 
this general airworthiness criteria language; the language already 
covers the general issues that ALPA's specific recommendations seek to 
address. D&R.115 states that the UA equipment, systems, and networks 
must be assessed to identify and mitigate protections as necessary. The 
level of detail regarding the assessment of failures and the required 
protection level of equipment, systems, and networks will be addressed 
in the means of compliance (MOC) to these airworthiness criteria. The 
C2 link is addressed in the airworthiness criteria under D&R.120 
Contingency Planning for a C2 lost link or degradation of a C2 link, as 
well as performance requirements. The C2 link is considered part of the 
UA and will be assessed for cyber security under D&R.115 as part of 
equipment and systems.
    D&R.120 Contingency Planning: The FAA proposed a requirement to 
address the risks associated with loss of communication C2 link between 
the pilot and the UA. The proposed criteria requires that the UA be 
designed to automatically execute a predetermined action and include 
the predetermined action in the UA Flight Manual. The UA Flight Manual 
must also include the minimum performance requirements for the C2 data 
link defining when the C2 link is degraded to a level where active 
control is no longer ensured. Takeoff when the C2 link is degraded 
below minimum performance requirements must be prevented by design or 
by an operating limitation to be included in the UA Flight Manual.
    Comment Summary: ALPA expressed several areas of concern related to 
UA contingency planning that the FAA should consider during the 
aircraft certification process. These concerns include addressing the 
risks associated with loss of communication, defining detailed 
preprogrammed algorithmic deliverables and corrective actions for each 
situation, and ensuring that the UA can automatically execute a safe 
predetermined flight, loiter landing, or termination in the event of 
any critical parts or systems failures. ALPA has several 
recommendations including to have the applicant ``Develop a detailed 
narrative that outlines every possible action that the UA will execute 
when guidance/intrusion challenges arise after the first preterminal 
action is initiated with the flight of the aircraft until all 
maneuvering actions have been exhausted and no further options exist.'' 
ALPA also recommends a test and validation of the effectiveness of the 
pre-determined executable actions to ensure proper design and 
definition of UA as intended.
    FAA Response: The FAA shares ALPA's concerns and has determined 
that the current airworthiness criteria appropriately address these 
concerns. The airworthiness criteria within D&R.120(a) propose the 
automatic and immediate execution of a safe predetermined action, in 
the event of a loss of communications, be part of the UA design. 
Furthermore, D&R.120(b) proposes that established predetermined actions 
are included in the UA Flight Manual, thus ensuring the applicant 
outlines these predetermined maneuvering actions within their 
contingency planning. Test and validation methods, of the effectiveness 
of such pre-determined actions as part of mitigation planning by which 
the UA will meet these criteria are addressed by D&R.310(a) and will be 
outlined in the MOC.
    D&R.125 Lightning: The FAA proposed criteria to address the risks 
that would result from a lightning strike, accounting for the size and 
physical limitations of a UAS that could preclude traditional lightning 
protection features. The FAA further proposed that without lightning 
protection for the UA, the flight manual must include an operating 
limitation to prohibit flight into weather conditions with potential 
lightning.
    Comment Summary: ALPA commented that lightning can cause 
significant damage to aircraft and pose a safety risk to people and 
property on the ground if that aircraft were to lose control and crash. 
ALPA suggests 10 specific recommendations for the FAA such as 
developing lightning protection standards and procedures; establishing 
a certification process for UA lightning protection and requiring all 
UA to comply with those standards; requiring regular inspections to 
identify damage caused by lightning strikes; and developing training 
programs for UA operators and maintenance personnel on lightning 
safety.
    FAA Response: The proposed recommendations are too specific for 
this general airworthiness criteria language. The UA, if designed with 
lightning mitigation features per D&R.125(a), would need to demonstrate 
protection of the UA from loss of flight or control due to lightning 
within the MOC. Otherwise, the operational limitations per D&R.125(b) 
would prohibit flight into weather conditions conducive to lightning 
activity.
    D&R.130 Adverse Weather Conditions: The FAA proposed criteria 
either requiring that design characteristics protect the UAS from 
adverse weather conditions or prohibiting flight into known adverse 
weather conditions. The criteria proposed to define adverse weather 
conditions as rain, snow, and icing.
    Comment Summary: ALPA recommends that the FAA develop and implement 
a policy that covers scenarios beyond ``known conditions'' when UAs 
inadvertently experience adverse weather conditions. ALPA suggests 30 
specific recommendations including establishing training requirements 
for UA pilots and crew members on managing adverse weather conditions; 
requiring that UA operators have access to accurate and up-to-date 
weather information; requiring continuous monitoring of adverse weather 
conditions during flight operations; establishing strict icing 
requirements and tolerances to prevent the operation of the UA in icing 
conditions; establishing strict wind limitations and protocols; and 
that UA operators adapt air carrier icing standards or use them as a 
baseline to ensure safe operations.

[[Page 2120]]

    FAA Response: Scenarios beyond ``known conditions'' would be an 
anomalous situation that is beyond the scope of D&R.130. For adverse 
weather conditions for which the UA is not approved to operate, D&R.130 
already contains requirements to detect adverse weather and minimize 
the likelihood of operating in those conditions. Testing of operations 
in these conditions is beyond the level of rigor needed for these 
aircraft. In addition, the effect of wind is addressed in 
D&R.300(b)(9), even though it is not included in D&R.130. D&R testing 
MOCs and test plans will ensure the UA is tested for adverse wind 
conditions. Design requirements related to operation in icing as a 
result of adverse weather are addressed in the CONOPS as stated within 
D&R.130(b).
    D&R.135 Flight Essential Parts: The FAA proposed criteria for 
critical parts that were substantively similar to those in the existing 
standards for normal category rotorcraft under 14 CFR 27.602, with 
changes to reflect UAS terminology and failure conditions. The criteria 
proposed to define a critical part as a part, the failure of which 
could result in a loss of flight or unrecoverable loss of control of 
the aircraft.
    Comment Summary: ALPA proposed several recommendations related to 
design and testing of the UA to consider the failure rates of 
associated systems and parts. ALPA recommends that a failure-rate 
threshold should be determined for critical components that are flight 
essential. ALPA recommends that the FAA establish stringent standards 
and guidelines for UA certification to ensure public safety.
    FAA Response: The specific numerical reliability of any specific 
part is more specific than would appear in airworthiness D&R criteria. 
D&R.135(b) already requires the applicant to define maintenance 
instructions or life limits on any essential parts. Life limits are 
determined based on the number of failure-free hours flown on the 
highest time conformed aircraft and the life limits are listed in the 
instructions for continued airworthiness (ICA).
    D&R.300 Durability and Reliability: The FAA proposed durability and 
reliability testing that would require the applicant to demonstrate 
safe flight of the UAS across the entire operational envelope and up to 
all operational limitations, for all phases of flight and all aircraft 
configurations described in the applicant's CONOPS, with no failures 
that result in a loss of flight, loss of control, loss of containment, 
or emergency landing outside the operator's recovery area. The FAA 
further proposed that UA would only be certificated for operations 
within the limitations, and for flight over areas no greater than the 
maximum population density, as described in the applicant's CONOPS and 
demonstrated by test.
    Comment Summary: ALPA commented that it is crucial that UA 
operators understand the limitations and requirements for operating in 
visual line of sight (VLOS) and BVLOS environments, including recovery 
zone limitations. Additionally, proper maintenance and testing must be 
conducted to ensure the UA's airworthiness certificate is valid and 
reliable for operation. ALPA suggests 10 specific recommendations 
including requiring scheduled maintenance per 14 CFR part 43; specific 
minimum testing; and requiring regular system checks before each flight 
to ensure the aircraft is in proper working condition.
    FAA Response: The D&R airworthiness criteria contain requirements 
related to the airworthiness of the aircraft itself, relying heavily on 
both flight testing and on maintenance in accordance with defined 
maintenance procedures. The comments on the operational environments 
are separate requirements or limitations and not part of the criteria 
for the aircraft itself. ALPA's specific maintenance recommendations 
are already encompassed by the general language of D&R.300.
    Comment Summary: The Small UAV Coalition commented on the proposed 
D&R.300 requirement that no failures occur ``that result in loss of 
flight, loss of control, loss of containment, or emergency landing 
outside the operator's recovery area.'' The Coalition recommends that a 
single failure during testing should not automatically restart counting 
the number of flight test operations set for a particular population 
density. Rather, if the applicant can identify the failure through root 
cause and fault tree analysis and provide a validated mitigation to 
prevent its recurrence, the number of consecutive failure-free 
operations and overall flight test hours allocation should be adjusted 
to be proportionate to the particular risk of that failure.
    The Small UAV Coalition also states, ``some UAS design elements 
could include an onboard health system that initiates a landing to 
lessen the potential of a loss of control event. In those cases, if the 
landings could be demonstrated to occur in safer locations that should 
not count as a failure.'' The Coalition seeks confirmation that the 
text ``operator's recovery area'' includes that sort of landing. Absent 
correction or clarification from the FAA on this language in D&R.300, 
the Coalition believes these requirements would present unnecessary and 
overly burdensome compliance challenges for the applicant to address.
    FAA Response: The intent of the testing criteria is for the 
applicant to demonstrate the aircraft's durability and reliability 
through a successful accumulation of flight testing. The FAA does not 
expect analytical evaluation to be part of this process. It should be 
noted that D&R.300 is intended to demonstrate the reliability of the 
system and not the consequence of failure, which is addressed in 
D&R.305. Systems designed to allow for unscheduled landings at 
potentially safer sites which are not controlled by the operator may 
provide a safety benefit, but D&R.300 is evaluating the overall system 
reliability and any landing outside those sites predetermined and 
accepted by the FAA in the flight test plan will be considered a test 
point failure. Failures during flight testing may or may not require 
additional test hours, up to and including resetting of the accumulated 
flight hours to zero. This determination will be made by the FAA based 
on the extent of redesign necessary to minimize the likelihood the 
incident will recur. However, the applicant will comply with these 
testing criteria using an MOC, accepted by the FAA, through the issue 
paper process. The MOC will depend on the reliability level the 
applicant has proposed to meet.
    D&R.305 Probable Failures: The FAA proposed criteria to evaluate 
how the UAS functions after probable failures, including failures 
related to propulsion systems, C2 link, global positioning system 
(GPS), critical flight control components with a single point of 
failure, control station, and any other equipment identified by the 
applicant.
    Comment Summary: ALPA provided 10 recommendations to ensure that 
the testing criteria effectively address probable failures and that any 
additional critical failures are also considered. Some of the 
recommendations include the FAA specifying which ``certain failures'' 
that UAs will be expected to demonstrate to prove that they can remain 
under control and contained; the UA should be tested to ensure it can 
safely return to a predetermined location or land safely in the event 
of a loss of power or propulsion system failure; and the applicant 
should test the UA's ability to detect and avoid potential obstacles, 
such as other aircraft, buildings, or terrain, to ensure safe 
operations in all types of environments.
    FAA Response: ``Probable failures'' are addressed in D&R.305 and 
``capabilities'' are addressed within

[[Page 2121]]

D&R.310. The intent of the testing criteria is for the applicant to 
demonstrate the aircraft's durability and reliability through a 
successful accumulation of flight testing. The FAA does not expect 
analytical evaluation to be part of this process. However, the 
applicant will comply with these testing criteria using test plans 
developed to an MOC, accepted by the FAA through the issue paper 
process. The MOC will address each element of these airworthiness 
criteria and will be dependent on the reliability level the applicant 
has proposed to meet.
    D&R.310 Capabilities and Functions: The FAA proposed criteria to 
require the applicant to demonstrate, by test, the minimum capabilities 
and functions necessary for the design. UAS.310(a) proposed to require 
the applicant to demonstrate, by test, the capability of the UAS to 
regain command and control of the UA after a C2 link is lost, the 
sufficiency of the electrical system to carry all anticipated loads, 
and the ability of the pilot to override any pre-programming in order 
to resolve a potential unsafe operating condition in any phase of 
flight. UAS.310(b) proposed to require the applicant to demonstrate, by 
test, certain features if the applicant requests approval of those 
features (geo-fencing, external cargo, detect and avoid, etc.). 
UAS.310(c) proposed to require the design of the UAS to safeguard 
against an unintended discontinuation of flight or release of cargo, 
whether by human action or malfunction.
    Comment Summary: ALPA comments on assuring the security of the C2 
link through testing and validation during the aircraft certification 
process for every UA model requesting operations in the NAS. An 
acceptable percentage for cyber intrusions and the ability to regain 
command and control of the UA after the C2 link is lost must be 
defined. ALPA also provided several recommendations on capabilities and 
functions required by D&R.310(a) or optional D&R.310(b), if requested 
for approval.
    FAA Response: D&R.120(a) requires contingency planning for C2 lost 
link and D&R.115 requires protections from cyber intrusions. Specific 
contingency plans and protections will be addressed in the MOC for 
those airworthiness criteria. D&R.310's general airworthiness criteria 
language already covers the other issues ALPA's specific 
recommendations seek to address.
    Comment Summary: The proposed airworthiness criteria discussion of 
D&R.310 ``Capabilities and Functions'' includes the sentence, ``[i]n 
order to show that the UA does not create a hazard when landing, the UA 
must show by test that it has the ability to detect and avoid any 
potential hazards on the ground by demonstrating any such landing 
always stays well clear of all people and other obstacles.''
    Wing, AUVSI, The Commercial Drone Alliance and The Small UAV 
Coalition object to the FAA's use of absolute terms such as ``any'' and 
``always'' against undefined and/or ambiguous terms (such as ``well 
clear'' in the context of ground obstacles) outlined in the preamble 
discussion of the proposed airworthiness criteria. Absent correction or 
clarification by the FAA, the commenters state that this language sets 
an impossibly high standard beyond the capabilities of either human or 
machine. Such absolute and prescriptive MOC is inappropriate in the 
context of airworthiness criteria. Wing is concerned that this standard 
precludes the ability of Wing or other manufacturers to demonstrate 
compliance at any practical level of test or validation. The commenters 
note that this standard is not called for in the actual proposed text 
of D&R.310 itself. In finalizing the airworthiness criteria, the FAA 
should correct or clarify its preamble language to avoid any possible 
confusion.
    Wing is concerned that the absolute terms ``any'' and ``always'' 
create a bar that demonstration by test or other means cannot meet. In 
addition, the use of terms such as ``potential'' and ``well clear'' 
similarly creates substantial challenges to compliance demonstration by 
test or other means. Wing states that it would be exceptionally 
challenging to meet this standard and that it exceeds the expectations 
for crewed aircraft as written. Wing requests that the FAA allow for 
alternative means of demonstrating that the UA does ``not create a 
hazard when landing'' in accordance with D&R.310(a)(6) by prefacing 
this paragraph with the phrase ``for example;'' remove the absolute 
terms ``any,'' ``all,'' and ``always'' to allow for the use of 
reasonable and achievable test methods; and remove the undefined and 
ambiguous terms ``well clear,'' ``other obstacles,'' and ``potential'' 
when outlining test or demonstration criteria.
    FAA Response: The FAA's use of absolute terms referenced in the 
comment summary above are of concern to Wing and others as in their 
view, ``the language sets an impossibly high standard beyond the 
capabilities of either human or machine.'' The subject language is 
based on the increased level of automation of Wing's system, which 
relies on onboard automated decision-making rather than pilot action. 
To accept such a system, the UAS must exhibit highly automated features 
and functions to enhance the safety of UAS operations by replacing 
direct manual control of the UA with automation. The UAS's automated 
flight envelope and path protection systems must be designed for 
controllability and maneuverability needed to detect and to maintain 
safe separation from hazards or obstacles on or near the ground while 
in normal, abnormal, and emergency operations. Some examples of 
abnormal or emergency scenarios include collision avoidance, aborted 
missions, power system failures, and forced landings. The UAS must also 
be equipped with capabilities and necessary features that will 
automatically contain or control the aircraft in the case of a loss of 
external services used in communicating, controlling, or providing 
system inputs to the UA. All foreseeable loss, degradation or non-
availability of external services, systems, or signals must not put the 
UA in an uncontrolled, uncontained, or unsafe condition.
    D&R.310 is a testing requirement and sets the criteria which must 
be demonstrated by flight test as part of the type certification 
program. The language referenced by the commenters as preamble language 
does not appear in the final rule but is given in the discussion 
section of the NPRM as a tool for understanding why the requirement was 
drafted as it was and provides additional insight into the means by 
which the applicant will be able to show compliance with the testing 
requirements in D&R.310. The intent of the use of this language within 
the NPRM discussion is for the applicant to show compliance by 
demonstrating landings that do not adversely impact people or 
obstacles. Therefore, the FAA finds that an acceptable flight test 
outcome is one that would not result in an unsafe condition. Within the 
context of the certification testing performed under D&R.310, the FAA's 
use of absolute terms such as ``any'' and ``always'' only serve to 
emphasize acceptable examples of test boundaries which will be 
addressed in more detail in the MOC and test plans. Likewise, terms 
like ``well clear'' will be defined based on the appropriate near mid-
air collision (NMAC) volume determined to be acceptable to the FAA for 
the D&R flight test campaign.
    D&R.320 Verification of Limits: The FAA proposed to require a 
demonstration of the UA's performance, maneuverability, stability, and 
control with a factor of safety (5% over maximum gross weight with no 
loss of control or loss of flight).

[[Page 2122]]

    Comment Summary: ALPA is concerned that the safety factor of 5% is 
too low. The Model Hummingbird UA weighs approximately 15 lbs., which 
means that 5% is approximately 0.75 lbs. ALPA recommends increasing 
this number to a minimum of a double-digit percentage for current and 
future aircraft certification standards.
    FAA Response: The FAA determined that based on historical data, 5% 
is a minimum acceptable margin.

Additional Airworthiness Criteria Identified by Commenters

    UA to Pilot Ratio: The Wing Model Hummingbird UAS operations would 
rely on high levels of automation and may include multiple UA operated 
by a single pilot, up to a ratio of 20 UA to 1 pilot.
    Comment Summary: ALPA is concerned with the safe operation of 
multiple UAs operated by a single pilot as described within the 
proposed airworthiness criteria notice. ALPA recommends that the FAA 
research and better assess multiple UA operations by a single pilot to 
establish a baseline understanding of the feasibility of a single UA 
pilot flying multiple UAs before developing airworthiness certification 
criteria. The proposed 20 to 1 UA to pilot ratio presents significant 
challenges to ensuring the safe operation of UAs and other NAS users, 
and the FAA should implement additional certification requirements for 
pilots operating multiple UAs, including specialized training and 
qualification standards. Additionally, the FAA should establish 
guidelines for the maximum number of UAs that a single pilot can 
operate to ensure safe and effective operations in the NAS. 
Furthermore, there should always be a backup failsafe and tertiary 
means of control for built-in redundancy where another human operator 
can intervene out of necessity for safety. The FAA should base its 
decision on facts and data and should clarify what qualitative and 
quantitative scientific instruments were utilized to assess the 
potential risks of the aircraft.
    FAA Response: These airworthiness criteria require the applicant to 
demonstrate the durability and reliability of the UA design by flight 
test, at the highest aircraft-to-pilot ratio, without exceptional 
piloting skill or alertness. In addition, D&R.305(c) requires the 
applicant to demonstrate probable failures by test at the highest 
aircraft-to-pilot ratio. The durability and reliability-based type 
certification process was developed for UAS that meet certain design 
criteria to include a maximum operating limitation of 20:1 aircraft to 
pilot ratio. Any deviation from this limitation will require additional 
coordination and will add to the project timeline.
    Level of Automation: The Wing Model Hummingbird UA operations would 
rely on high levels of automation.
    Comment Summary: ALPA is concerned about the specificity of the 
Model Hummingbird UA's automation level. ALPA states that the FAA 
should clarify the degree and level of automation in which the UA will 
operate. This includes defining whether the operation of the Model 
Hummingbird UA will be fully automated autonomous, partially automated 
autonomous, preprogrammed, or a combination of any of these options. 
Additionally, the FAA should determine the required minimal involvement 
or participation from the remote pilot(s) to assure flight safety. ALPA 
suggests that the FAA establish guidelines for aircraft onboard 
(organic) and/or offboard (inorganic) intelligence system(s) to 
deconflict other known and unknown (birds, floating objects/flying 
debris) air traffic and associated hazards. The FAA should ensure that 
these systems are tested, designed, and manufactured to a certain 
failure rate, such as a 10-9 failure rate per flight hours 
or something less.
    FAA Response: D&R.100 requires UA specifications within the CONOPS. 
Data within the CONOPS are proprietary to the applicant. The D&R 
methodology is used as a framework to allow for an adequate balance of 
certification rigor with safety related outcomes. The FAA considered 
the size of aircraft, its maximum airspeed and altitude, and 
operational limitations to address the number of UA per operator 
(maximum of 20:1 aircraft to pilot ratio) and to address operations in 
which the aircraft would operate BVLOS of the pilot to assess the 
potential risk the aircraft could pose to other aircraft and to human 
beings on the ground. Using these parameters, the FAA developed 
proposed airworthiness criteria to address those potential risks to 
ensure the aircraft remains reliable, controllable, safe, and airworthy 
without the need for requiring a prescriptive failure rate.

Hazardous Cargo Carriage Over Populated Areas

    Comment Summary: ALPA is concerned that the carriage of HAZMAT by 
UAs over populated areas poses a significant safety concern requiring 
the FAA's action. The guidelines and regulations for the carriage of 
HAZMAT by UAs should consider the associated risks to public safety. UA 
operators should be required to provide information about the HAZMAT 
they are carrying. The FAA should also establish a system for 
monitoring and enforcing compliance, ensure that emergency responders 
are informed, properly trained, and equipped to handle nonconventional 
operational factors involving UA HAZMAT incidents, and require UA 
manufacturers to incorporate safeguards and emergency response 
mechanisms. By taking these and other recommended steps, the FAA can 
help ensure the safe operation of UAs in the NAS.
    FAA Response: The FAA acknowledges the concern by ALPA. However, 
the comment is not within the scope of the aircraft type certification 
for which this airworthiness criteria was developed. The carriage of 
HAZMAT is an operational function and if applicable to Wing's operation 
for this aircraft, would be provided in the CONOPS. The CONOPS, if 
approved for HAZMAT, will contain operational limitations in the 
operating approval, as necessary. The CONOPS are proprietary to the 
applicant.

BVLOS and OOP

    Comment Summary: ALPA is concerned that as the use of UAs for BVLOS 
operations and over people become increasingly common, it raises 
significant safety concerns that must be addressed in the certification 
process. ALPA is concerned about the potential risks associated with 
this type of operation involving the Model Hummingbird UA or any 
similar operator. In order to ensure safety, ALPA recommends that 
operators explain how they plan to mitigate their aerial footprint 
around and away from people and property, with detailed evasion and 
emergency set-down plans, processes, and parameters. Additionally, ALPA 
urges the FAA to consider the possibility of an aircraft performing 
BVLOS losing propulsion and being unable to maintain flight, requiring 
a recovery or crash mitigation strategy and emergency vertical 
arrestment system to prevent harm to persons or property.
    ALPA states that many manufacturers within the UA/drone and urban 
air mobility (UAM) and advanced air mobility (AAM) industry do not 
include an emergency vertical arrestment system to prevent loss of life 
and property in the event of an aircraft losing its engine or engines 
then becoming a falling object which is increasingly alarming if that 
aircraft has minimal to a zero-glide aspect ratio. ALPA recommends 
continuous collaboration between industry experts and the regulator to

[[Page 2123]]

develop safer aircraft design and certification standards for the best 
interests of the end-users, the flying public, and those affected by 
flight operations of UA/drone or UAM/AAM aircraft. When these types of 
aircraft operate in the same airspace as commercial aircraft, ALPA 
recommends that pilots have the ability to see them on the flightdeck 
or pilot display and air traffic controllers can view them on their 
displays to separate air traffic safely. These aircraft must also have 
active collision-avoidance technology, and ALPA opposes any integration 
that does not include aircraft collision-avoidance systems (ACAS) that 
are interoperable with commercial collision-avoidance systems. ALPA 
further opposes any proposed changes to 14 CFR 91.113 to enable BVLOS 
operational safety case(s) to transfer the responsibility of ``see and 
avoid'' to crewed aircraft under certain conditions. The responsibility 
of ``see and avoid'' must remain with the remote pilot, and any changes 
to this would be detrimental to the safe integration of UAs into the 
NAS.
    FAA Response: Discussion on proposed changes to general operating 
flight rule Sec.  91.113 is not within the scope of this airworthiness 
criteria as it does not pertain to the type certification of the 
aircraft itself. Operational approval will be granted based on the 
maximum cumulative risk posed by the proposed operations, taking into 
account mitigating features, e.g., vertical arresting systems such as 
parachutes, if they are proposed as part of the design. However, the 
airworthiness criteria are developed to be high level and performance 
based, rather than relying on specific designs which may limit 
introduction of other novel safety enhancing features.

Battery Standards

    Comment Summary: ALPA states that the use of batteries as an energy 
source for aircraft propulsion in the NAS is a substantial shift from 
traditional propulsion methods on which current safety margins are 
based and requires more regulator exploration to determine best safety 
practices. ALPA states that the FAA will need to analyze, qualify, and 
quantify the aircraft performance and operational environments to 
determine whether the safety baseline of this technological 
functionality can be performed reliably and repeatedly to an equivalent 
level of safety. ALPA recommends that the FAA and industry mutually 
agree upon the scientific data to confer consensus regarding acceptable 
safety margins.
    ALPA provided 20 specific recommendations regarding battery safety. 
Some of the recommendations are to develop standards; establish 
certification procedures for aircraft batteries; develop regulations 
for transporting lithium-ion batteries; define policies and procedures 
for flightcrews to promptly act with an abnormal battery anomaly; and 
several more recommendations on best-practices for battery safety.
    FAA Response: The recommendations on battery standards by the 
commenter are noted as either being too specific or out of scope for 
this D&R airworthiness criteria. The overly specific recommendations 
address issues already encompassed by the general airworthiness 
criteria. D&R testing per D&R.300 should demonstrate reliability of the 
UAS as a whole and thus each system or component within the UAS has met 
a minimum acceptable reliability standard. Demonstration of the safe 
carriage of batteries and mitigations for known risks are addressed via 
flight test within D&R.305(a)(1) ``Propulsion systems.''

Out of Scope Comments

    The FAA received and reviewed several comments that were general, 
stated the commenter's viewpoint or opposition without a suggestion 
specific to the proposed criteria, or did not make a request the FAA 
can act on. These comments are noted as beyond the scope of this 
document.

Applicability

    These airworthiness criteria, established under the provisions of 
Sec.  21.17(b), are applicable to the Model Hummingbird UA. Should Wing 
Aviation LLC apply at a later date for a change to the TC to include 
another model, these airworthiness criteria would apply to that model 
as well, provided the FAA finds them appropriate in accordance with the 
requirements of subpart D to part 21.

Conclusion

    This action affects only the airworthiness criteria for one model 
UA. It is not a standard of general applicability.

Authority Citation

    The authority citation for these airworthiness criteria is as 
follows:

    Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.

Airworthiness Criteria

    Pursuant to the authority delegated to me by the Administrator, the 
following airworthiness criteria are issued as part of the type 
certification basis for the Wing Aviation LLC Model Hummingbird UA. The 
FAA finds that compliance with the following would mitigate the risks 
associated with the proposed design and CONOPS appropriately and would 
provide an equivalent level of safety to existing rules.

General

D&R.001 Concept of Operations

    The applicant must define and submit to the FAA a concept of 
operations (CONOPS) proposal describing the UAS operation in the 
National Airspace System for which UA type certification is requested. 
The CONOPS proposal must include, at a minimum, a description of the 
following information in sufficient detail to determine the parameters 
and extent of testing and operating limitations:
    (a) The intended type of operations;
    (b) UA specifications;
    (c) Meteorological conditions;
    (d) Operators, pilots, and personnel responsibilities;
    (e) Control station, support equipment, and other associated 
elements (AE) necessary to meet the airworthiness criteria;
    (f) Command, control, and communication functions;
    (g) Operational parameters (such as population density, geographic 
operating boundaries, airspace classes, launch and recovery area, 
congestion of proposed operating area, communications with air traffic 
control, line of sight, and aircraft separation); and
    (h) Collision avoidance equipment, whether onboard the UA or part 
of the AE, if requested.

D&R.005 Definitions

    For purposes of these airworthiness criteria, the following 
definitions apply.
    (a) Loss of control: Loss of control means an unintended departure 
of an aircraft from controlled flight. It includes control reversal or 
an undue loss of longitudinal, lateral, and directional stability and 
control. It also includes an upset or entry into an unscheduled or 
uncommanded attitude with high potential for uncontrolled impact with 
terrain. A loss of control means a spin, loss of control authority, 
loss of aerodynamic stability, divergent flight characteristics, or 
similar occurrence, which could generally lead to a crash.
    (b) Loss of flight: Loss of flight means a UA's inability to 
complete its flight as planned, up to and through its originally 
planned landing. It includes

[[Page 2124]]

scenarios where the UA experiences controlled flight into terrain, 
obstacles, or any other collision, or a loss of altitude that is severe 
or non-reversible. Loss of flight also includes deploying a parachute 
or ballistic recovery system that leads to an unplanned landing outside 
the operator's designated recovery zone.

Design and Construction

D&R.100 UA Signal Monitoring and Transmission

    The UA must be designed to monitor and transmit to the AE all 
information required for continued safe flight and operation. This 
information includes, at a minimum, the following:
    (a) Status of all critical parameters for all energy storage 
systems;
    (b) Status of all critical parameters for all propulsion systems;
    (c) Flight and navigation information as appropriate, such as 
airspeed, heading, altitude, and location; and
    (d) Communication and navigation signal strength and quality, 
including contingency information or status.

D&R.105 UAS AE Required for Safe UA Operations

    (a) The applicant must identify and submit to the FAA all AE and 
interface conditions of the UAS that affect the airworthiness of the UA 
or are otherwise necessary for the UA to meet these airworthiness 
criteria. As part of this requirement--
    (1) The applicant may identify either specific AE or minimum 
specifications for the AE.
    (i) If minimum specifications are identified, they must include the 
critical requirements of the AE, including performance, compatibility, 
function, reliability, interface, operator alerting, cyber security, 
and environmental requirements.
    (ii) Critical requirements are those that if not met would impact 
the ability to operate the UA safely and efficiently.
    (2) The applicant may use an interface control drawing, a 
requirements document, or other reference, titled so that it is clearly 
designated as AE interfaces to the UA.
    (b) The applicant must show the FAA that the AE or minimum 
specifications identified in paragraph (a) of this section meet the 
following:
    (1) The AE provide the functionality, performance, reliability, and 
information to assure UA airworthiness in conjunction with the rest of 
the design;
    (2) The AE are compatible with the UA capabilities and interfaces;
    (3) The AE must monitor and transmit to the operator all 
information required for safe flight and operation, including but not 
limited to those identified in D&R.100; and
    (4) The minimum specifications, if identified, are correct, 
complete, consistent, and verifiable to assure UA airworthiness.
    (c) The FAA will establish the approved AE or minimum 
specifications as operating limitations and include them in the UA type 
certificate data sheet and UA Flight Manual.
    (d) The applicant must develop any maintenance instructions 
necessary to address implications from the AE on the airworthiness of 
the UA. Those instructions will be included in the instructions for 
continued airworthiness (ICA) required by D&R.205.

D&R.110 Software

    To minimize the existence of software errors, the applicant must:
    (a) Verify by test all software that may impact the safe operation 
of the UA;
    (b) Utilize a configuration management system that tracks, 
controls, and preserves changes made to software throughout the entire 
life cycle; and
    (c) Implement a problem reporting system that captures and records 
defects and modifications to the software.

D&R.115 Cyber Security

    (a) UA equipment, systems, and networks, addressed separately and 
in relation to other systems, must be protected from intentional 
unauthorized electronic interactions that may result in an adverse 
effect on the security or airworthiness of the UA. Protection must be 
ensured by showing that the security risks have been identified, 
assessed, and mitigated as necessary.
    (b) When required by paragraph (a) of this section, procedures and 
instructions to ensure security protections are maintained must be 
included in the ICA.

D&R.120 Contingency Planning

    (a) The UA must be designed so that, in the event of a loss of the 
command and control (C2) link, the UA will automatically and 
immediately execute a safe predetermined flight, loiter, landing, or 
termination.
    (b) The applicant must establish the predetermined action in the 
event of a loss of the C2 link and include it in the UA Flight Manual.
    (c) The UA Flight Manual must include the minimum performance 
requirements for the C2 data link, defining when the C2 link is 
degraded to a level where remote active control of the UA is no longer 
ensured. Takeoff when the C2 link is degraded below the minimum link 
performance requirements must be prevented by design or prohibited by 
an operating limitation in the UA Flight Manual.

D&R.125 Lightning

    (a) Except as provided in paragraph (b) of this section, the UA 
must have design characteristics that will protect the UA from loss of 
flight or loss of control due to lightning.
    (b) If the UA has not been shown to protect against lightning, the 
UA Flight Manual must include an operating limitation to prohibit 
flight into weather conditions conducive to lightning activity.

D&R.130 Adverse Weather Conditions

    (a) For purposes of this section, ``adverse weather conditions'' 
means rain, snow, and icing.
    (b) Except as provided in paragraph (c) of this section, the UA 
must have design characteristics that will allow the UA to operate 
within the adverse weather conditions specified in the CONOPS without 
loss of flight or loss of control.
    (c) For adverse weather conditions for which the UA is not approved 
to operate, the applicant must develop operating limitations to 
prohibit flight into known adverse weather conditions and either:
    (1) Develop operating limitations to prevent inadvertent flight 
into adverse weather conditions; or
    (2) Provide a means to detect any adverse weather conditions for 
which the UA is not certificated to operate and show the UA's ability 
to avoid or exit those conditions.

D&R.135 Flight Essential Parts

    (a) A flight essential part is a part, the failure of which could 
result in a loss of flight or unrecoverable loss of UA control.
    (b) If the type design includes flight essential parts, the 
applicant must establish a flight essential parts list. The applicant 
must develop and define mandatory maintenance instructions or life 
limits, or a combination of both, to prevent failures of flight 
essential parts. Each of these mandatory actions must be included in 
the airworthiness limitations section of the ICA.

Operating Limitations and Information

D&R.200 UA Flight Manual

    The applicant must provide a UA Flight Manual with each UA.
    (a) The UA Flight Manual must contain the following information:
    (1) UA operating limitations;
    (2) UA operating procedures;
    (3) Performance information;

[[Page 2125]]

    (4) Loading information; and
    (5) Other information that is necessary for safe operation because 
of design, operating, or handling characteristics.
    (b) Those portions of the UA Flight Manual containing the 
information specified in paragraph (a)(1) of this section must be 
approved by the FAA.

D&R.205 ICA

    The applicant must prepare the ICA for the UA in accordance with 
appendix A to 14 CFR part 23, as appropriate, that are acceptable to 
the FAA. The ICA may be incomplete at type certification if a program 
exists to ensure their completion prior to delivery of the first UA or 
issuance of a standard airworthiness certificate, whichever occurs 
later.

Testing

D&R.300 Durability and Reliability

    The UA must be designed to be durable and reliable when operated 
under the limitations prescribed for its operating environment, as 
documented in its CONOPS, and included as operating limitations on the 
type certificate data sheet and in the UA Flight Manual. The durability 
and reliability must be demonstrated by flight test in accordance with 
the requirements of this section and completed with no failures that 
result in a loss of flight, loss of control, loss of containment, or 
emergency landing outside the operator's recovery area.
    (a) Once a UA has begun testing to show compliance with this 
section, all flights for that UA must be included in the flight test 
report.
    (b) Tests must include an evaluation of the entire flight envelope 
across all phases of operation and must address, at a minimum, the 
following:
    (1) Flight distances;
    (2) Flight durations;
    (3) Route complexity;
    (4) Weight;
    (5) Center of gravity;
    (6) Density altitude;
    (7) Outside air temperature;
    (8) Airspeed;
    (9) Wind;
    (10) Weather;
    (11) Operation at night, if requested;
    (12) Energy storage system capacity; and
    (13) Aircraft to pilot ratio.
    (c) Tests must include the most adverse combinations of the 
conditions and configurations in paragraph (b) of this section.
    (d) Tests must show a distribution of the different flight profiles 
and routes representative of the type of operations identified in the 
CONOPS.
    (e) Tests must be conducted in conditions consistent with the 
expected environmental conditions identified in the CONOPS, including 
electromagnetic interference (EMI) and high intensity radiated fields 
(HIRF).
    (f) Tests must not require exceptional piloting skill or alertness.
    (g) Any UAS used for testing must be subject to the same worst-case 
ground handling, shipping, and transportation loads as those allowed in 
service.
    (h) Any UA used for testing must use AE that meet, but do not 
exceed, the minimum specifications identified under D&R.105. If 
multiple AE are identified, the applicant must demonstrate each 
configuration.
    (i) Any UAS used for testing must be maintained and operated in 
accordance with the ICA and UA Flight Manual. No maintenance beyond the 
intervals established in the ICA will be allowed to show compliance 
with this section.
    (j) If cargo operations or external-load operations are requested, 
tests must show, throughout the flight envelope and with the cargo or 
the external load at the most critical combinations of weight and 
center of gravity, that--
    (1) The UA is safely controllable and maneuverable; and
    (2) The cargo or the external load is retainable and transportable.

D&R.305 Probable Failures

    The UA must be designed such that a probable failure will not 
result in a loss of containment or control of the UA. This must be 
demonstrated by test.
    (a) Probable failures related to the following equipment, at a 
minimum, must be addressed:
    (1) Propulsion systems;
    (2) C2 link;
    (3) Global positioning system (GPS);
    (4) Flight control components with a single point of failure;
    (5) Control station; and
    (6) Any other AE identified by the applicant.
    (b) Any UA used for testing must be operated in accordance with the 
UA Flight Manual.
    (c) Each test must occur at the critical phase and mode of flight, 
and at the highest aircraft-to-pilot ratio.

D&R.310 Capabilities and Functions

    (a) All of the following required UAS capabilities and functions 
must be demonstrated by test:
    (1) Capability to regain command and control of the UA after the C2 
link has been lost.
    (2) Capability of the electrical system to power all UA systems and 
payloads.
    (3) Ability for the pilot to safely discontinue the flight.
    (4) Capability of the UA to maintain its preplanned flight path 
within acceptable navigation accuracy.
    (5) Ability to safely abort a takeoff.
    (6) Ability to safely abort a landing and initiate a go-around 
unless the UA is shown not to create a hazard when landing.
    (b) The following UAS capabilities and functions, if requested for 
approval, must be demonstrated by test:
    (1) Continued flight after degradation of the propulsion system.
    (2) Geo-fencing that contains the UA within a designated area, in 
all operating conditions.
    (3) Positive transfer of the UA between control stations that 
ensures only one control station can control the UA at a time.
    (4) Capability to release an external cargo load to prevent loss of 
control of the UA.
    (5) Capability to detect and avoid other aircraft and obstacles.
    (c) The UA must be designed to safeguard against inadvertent 
discontinuation of the flight and inadvertent release of cargo or 
external load.

D&R.315 Fatigue

    The structure of the UA must be shown to withstand the repeated 
loads expected during its service life without failure. A life limit 
for the airframe must be established, demonstrated by test, and 
included in the ICA.

D&R.320 Verification of Limits

    The performance, maneuverability, stability, and control of the UA 
within the flight envelope described in the UA Flight Manual must be 
demonstrated at a minimum of 5% over maximum gross weight with no loss 
of control or loss of flight.

    Issued in Washington, DC, on January 8, 2024.
Ian Lucas,
Manager, Certification Coordination Section, Policy and Standards 
Division, Aircraft Certification Service.
[FR Doc. 2024-00549 Filed 1-11-24; 8:45 am]
BILLING CODE 4910-13-P