**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 1 /31 

# J **ustification of airworthiness and safety assessment** 

**Version Date**  **Description Author**  V 1.0 23.12 .2013 Technical documentation Sense Fly V2.0 04.04.2014 Correction SenseFly**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 2/31 

## Table of content **1 INTRODUCTION**  **................................ ................................**  **................................ ................................**  **........ 4**  **2 AIRCRAFT SEGMENT**  **................................ ................................**  **................................ ..............................**  **4** 2.1 AIRFRAME ................................ ................................ ................................ ................................ ................. 4 2.1.1 Structure................................ ................................ ................................ ................................ ............. 4 2.1.2 Composition ................................ ................................ ................................ ................................ ....... 5 2.1.3 Load analysis ................................ ................................ ................................ ................................ ..... 5 2.1.4 Technical information ................................ ................................ ................................ ........................ 5 2.1.5 Performance characteristics ................................ ................................ ................................ .............. 6 2.2 PROPULSION SYSTEM ................................ ................................ ................................ ................................ 6 2.3 ELECTRICAL SYSTEM ................................ ................................ ................................ ................................ 7 2.4 FLIGHT CONTROL SURFACES AND ACTUATORS ................................ ................................ .......................... 8 2.5 PAYLOADS ................................ ................................ ................................ ................................ ................. 9 **3 CONTROL AND COMMUNIC** **ATION SEGMENT ................................**  **................................ ...............**  **9** 3.1 AVIONICS ................................ ................................ ................................ ................................ .................. 9 3.2 NAVIGATION ................................ ................................ ................................ ................................ ........... 10 3.3 UA FLIGHT CONTROLS ................................ ................................ ................................ ............................ 10 3.4 AUTOPILOT ................................ ................................ ................................ ................................ .............. 11 3.5 COMMUNICATION AND CONTROL ................................ ................................ ................................ ............ 11 3.5.1 Architecture of the command and communication system ................................ ............................... 11 3.5.2 Lost Link and Flight Recovery ................................ ................................ ................................ ......... 13 3.5.3 Control Station ................................ ................................ ................................ ................................ . 13 3.5.4 Control frequencies ................................ ................................ ................................ .......................... 14 3.6 GROUND SUPPORT EQUIPMENT ................................ ................................ ................................ ............... 15 **4 PROCESSES AND PROCED** **URES ................................**  **................................ ................................**  **......... 15**  4.1 CONFIGURATION MANAGEMENT ................................ ................................ ................................ ............. 15 4.2 S OFTWARE MANAGEMENT ................................ ................................ ................................ ...................... 15 4.3 CONTINUING AIRWORTHINESS ................................ ................................ ................................ ................. 15 **5 OPERATIONS**  **................................ ................................**  **................................ ................................**  **............ 16**  5.1 NATIONAL AIRSPACE SYSTEM (NAS) INTEGRATION AND INTERACTION ................................ ................. 16 5.2 FLIGHT PHASES ................................ ................................ ................................ ................................ ....... 16 5.2.1 Pre-

flight / taxi operations ................................ ................................ ................................ ............... 16 5.2.2 Take
-off................................ ................................ ................................ ................................ ............ 17 5.2.3 Flight................................ ................................ ................................ ................................ ................ 17 5.2.4 Landing/recovery ................................ ................................ ................................ ............................. 18 5.2.5 Post flight ................................ ................................ ................................ ................................ ......... 18 5.3 EMERGENCIES AND PROCEDURES ................................ ................................ ................................ ............ 18 5.3.1 Complete loss of control link ................................ ................................ ................................ ........... 18 5.3.2 Engine Failure ................................ ................................ ................................ ................................ . 18 5.3.3 Propeller Loss ................................ ................................ ................................ ................................ .. 19**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 3/31 5.3.4 Loss of GPS................................ ................................ ................................ ................................ ...... 19 5.3.5 Loss of heading information ................................ ................................ ................................ ............ 19 5.3.6 Pitot system malfunction ................................ ................................ ................................ .................. 19 5.3.7 Servo malfunction or loss................................ ................................ ................................ ................. 19 5.3.8 Payload malfunction ................................ ................................ ................................ ........................ 20 5.3.9 Loss of Autopilot ................................ ................................ ................................ .............................. 20 5.4 MANUALS ................................ ................................ ................................ ................................ ................ 20 5.5 ORGANIZATIONAL CONSIDERATIONS ................................ ................................ ................................ ...... 20 5.5.1 Training................................ ................................ ................................ ................................ ............ 20 5.5.2 Maintenance ................................ ................................ ................................ ................................ ..... 20 **6 ANNEXES**  **................................ ................................**  **................................ ................................**  **................... 21**  6.1 A NNEX 1: 3 -VIEW DRAWINGS OFTHE EBEE ................................ ................................ ............................ 21 6.2 A NNEX 2: IN-FLIGHT SAFETY ACTIONS ................................ ................................ ................................ .... 21 6.2.1 In- flight manual safety actions................................ ................................ ................................ ......... 22 6.2.2 In- flight automatic safety actions................................ ................................ ................................ ..... 22 6.3 A NNEX 3: AREAS OF OPERATIONS ................................ ................................ ................................ ........... 23 6.4 A NNEX 4: SAFETY ANALYSIS ................................ ................................ ................................ ................... 25 6.4.1 Considerations about risk related to ground impacts................................ ................................ ...... 25 6.4.2 Considerations about the probability of mid
-air collisions ................................ ............................. 26 6.4.3 Pre-

flight tests ................................ ................................ ................................ ................................ .. 27 6.4.4 Take
- Off vetos ................................ ................................ ................................ ................................ .. 28 6.4.5 References ................................ ................................ ................................ ................................ ........ 29 6.5 A NNEX 5: COMMAND AND CONTROL ................................ ................................ ................................ ....... 30**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 4/31 

## 1 **Introduction** SenseFly is a Swiss company founded at the end of 2009. The company manufactures lightweight fixed -wing UAVs (500 -75 0 grams) for mapping applications and develops eMotion , a very powerful software package for flight simulation and flight monitoring . In June 2012, SenseFly joined the Parrot group, the manufacturer of the smartphone-driven AR Drone quadcopters for the hobby market. W ithin Parrot , senseFly i s now leading the development of drones for professional use. S enseFly masters all aspects of mini -drone development (from hardware to software) and is therefore capable of achieving very high level s of system integration. 

## 2 **Ai rcraft s**  **egment 2.1**  **Ai rframe**  **2.1.1 Struc** **ture** The eBee (see figure below) is a ready-to- launch UAV based on fixed -win g architecture. This simple and robust design provides aerodynamic effi ciency, manoeuvrability and an excellent gliding ratio .

**Figure 1** : Architecture of the eBee**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 5/31 T he four main characteristics of the eBee are : a. Very lightweight The eBee is so light that the operator can launch it by hand and let it land on almost any surface without requiring a parachute or landing net (belly land). Its low impact energy (38 J In case of a controlled emergency landing ) also significantly reduces the risk of third - party collision damage (see Annex 4 , safety analysis ) . The wing is made of flexible foam with no sha rp or hard edges and almost no internal strengthening structure. b. Electric Powered The eBee is electric powered . A brushless engine technology makes it silent and reliable. The propeller is attached with a rubber band to the body of the plane so that it can easily fl ex away in case of contact or crash with any object. c. Semi - Automatic flight The artificial intel ligence incorporated within the eBee autopilot system continuously analyzes data from the Inertial Measurement Unit and from the onboard GPS and takes care of all the aspects of the flight, even in the absence of radio connection with the laptop. Take-off and landing phases are also fully controlled by the autopilot. d. Manual control Additionally, the eBee provides an override capability that allows the operator to take manual actions during the flight (Go to Home, Go Land, Hold and Resume the mission) an d also suspend automated operations and take manual control of the aircraft should it become necessary to respond emergent circumstances, thanks to the remote controller provided with the system. **2.1.2 Composition**  W ings are composed of 25g/litre injected expanded polypropylene (EPP) and the fusel age is composed of 35g/litre injected EPP. The leading edge protection is thermo-formed polycarbonate. Additional parts are made of injected fibre- reinforced ABS plastic. The electronic components are installed ins ide the fuselage in dedicated cavities to ensure proper positioning . T he EPP parts and carbon spars are manually glued with EPP glue. **2.1.3 Load analy** **sis** In -flight testing of structural resistance has been conducted by experienced pilots. The airframe was subjected to the maximum possible aerodynamical load and airspeeds exceeding two times the regular flight envelope. Results showed that the structure is capable of withstanding all possible loads and no flutter arises throughout the flight envelope and beyond. **2.1.4 Technical information**   Wi ngspan: 96 cm  Fuselage length: 60 cm**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 6/31  Central body: 40 cm x 16 cm x 6 cm  MTOW (Maximum Take-Off We ight): 750 g (including battery, camera payload and all options )  Empty weight (without battery, camera payload and options): 410 g ± 2 0 g  7’ ’x 5’ ’ pusher propeller **2.1.5 Performance**  **characteristics**  Maximum altitude : tested up to 17 000 feet ASL  Nominal endurance with standard payload, no wind and 20°C : 50 min  Airspeed :

- Stall speed: 9 m/s

- C ruise speed : 11 to 25 m/s

- Never-exceed speed : 28 m/s  Maximum rate of climb: 4 m/s , and 8 m/s during take-off, emergency ground avoidance and emergency climb procedure.  Maximum rate of desce nt: 4 m/s , and 8 m/s during emergency descent procedure
 Maximum bank angle: 60

### °  Turn rate limits: 80 °/s
 Maximum Headwind. 12 m/s  Maximum Tailwind (launch/recovery) 12 m/s for launch, 12 m/s for recovery on grass, 5 m/s on hard surface  Maximum Crosswind. 12 m/s  Maximum Gusts. 15 m/s
 Datalink range: 3-5 km Weather l imitations: The eBee runs in light rain and light snow, with wind up to 12 m/s (27 mph) . No visibility/lighting restrictions apply beyond within - line-of-sight operation requirements. The eBee has been tested in the - 15° to 35°C OAT range (5 ° F to 95 ° F) . N o de- icing system is implemented so operations in icing conditions must be avoided. 

### 2.2 **Propulsion Sy stem**  The eBee propulsion system is based on a brushless DC motor with a dedicated electronic controller and a 2150 mAh 3S -cells Lithium - Polymer (LiPo) battery. The maximum input electric power for the motor is 160W. It provides a thrust-to-weight ratio of more than 0.9 (static thrust of about 630 g ram force ), which allows for steep, hi gh - performance take-off s . The electric current draw is 2 to 16A. The LiPo batte ry is the sole source of electric current .**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 7/31 The motor is attached to the body of the aircraft with screws. The main screen of the flight management software eMotion 2 displays :

- Raw voltage level

- Estimated percentage of battery remaining (based on battery mod el, current voltage, integrated power used, etc ... )

- Ratio of estimated remaining energy versus the estimated energy required to reach the Home point. 

### 2.3 **Electrical Sy** **stem** The LiPo battery provides between 9 and 12.6V to the system. A 3.3V bus, provided by the autopilot, powers the electronics and radio- modem. A 5V bus, provided by the motor controller, powers the RC receiver and the control surfaces servo.

**Figure 2** : Cabling schematics eBee**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 8/31 

### 2.4 **Flight control surfaces and a ctuators**  The eBee is equipped with two control surfaces . The p itch rate is controlled with both control surfaces in the same direction. Roll rate is controlled by orienting the control surfaces in opposite directions. The yaw is passively stabilized by the winglets a nd the wing leading edge drag (flying win g). The control surfaces are made of EPP and are connected to the wings. A thinner section of the EPP material acts as a hinge between the wings and the flight surfaces. Failure may occur:

- At a local level on the servos;

- At a local level on the link level between th e servo and the control surface;

- And at a global level – by breaking the control surface itself (e.g. EPP material tearing apart).

**Figure 3** : Flight surfaces of the eBee (in yellow) In case of servo failure, the autopilot tries to keep the roll angle with the other servo. If the servo fails in 'down' position, it is likely that the eBee will dive and accelerate. If the aircraft achieves airspeed of 30 m/s , over-speed condition is detected and the motor is put in a reverse mode to slow down the aircraft. The reverse mode also makes a high noise that can alert any potential people on the ground. If the servo fails in 'level' or 'up' position, the aircraft may be able to continue to fly but with a degraded behaviour, likely loosing altitude in curves or having troubles to turn. If the aircraft cannot turn enough and leaves the working area, the motor is turned off to minimize the impact energy and the aircraft glides toward the ground.**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 9/31 A critical "Servo failure" message is sh own in eMotion and a ringing alarm is raised when a servo is stuck or malfunctioning . Other warnings may appear such as "Cannot maintain altitude", "Roll instabilities" or "Pitch instabilities". 

### 2.5 **Pay load** **s** (1) Internal. 150 - 170 grams camera protected by the EPP body of the aircraft. (2) External: n one 

## 3 **Cont rol and c** **ommunication s** **egment 3.1**  **Avionic s**  The eBee avionics is composed of the following components:
 1 autopilot integrated in the body of the aircraft , which includes the central processing unit, a GPS receiver (with integrated antenna), and the telemetry modem (with an external antenna visible on the figure 1 ). The central processing unit PCB is fitted with an inertial measurement unit (accelerometer, gyrometers , and magnetometer), a barometer and a differential pressure sensor.

**Figure 4** : Autopilot schematics**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 10/31  1 P itot probe (visible in the figure 1 ) connected with tubes to the differential pressure sensor.  1 RC receiver with a wire antenna integrated in to the fuselage.  1 optical flow sensor pointing downwards for ground proximity detection. 

### 3.2 **Navigation** The l ocation is given by the GPS (x,y,z) and the barometer (z). The operator can modify the flight pl an of the eBee at any time , using the flight management software interface or the remote controller. Additionally, the operator can instruct the eBee to hold (loiter) at its current position, return to the Home waypoint, initiate the planned land ing procedure and immedi ately land in a spiral approach at the current location (see the User Manual for further details). The autopilot controls the altitude and trajectory of the eBee . If a loss of altitude due to loss of thrust (broken propeller, motor failure, etc.) is detected, the eBee will initiate an emergency glide landing towards the Home waypoint (see the User Manual for further details). There is no redundant navigation system implemented in the eBee other than the capability to switch to the manual mode . Should the autopilot malfunction, the operator can switch to this manual mode and gain direct access to the control surface through the remote control. Loss of heading: - When the wind is too strong and the ground speed cannot be held, the heading information might be temporarily lost and the aircraft will go backwind to regain the heading information. - Wh en the GPS fails, the aircraft will start the emergency GPS - lost procedure and will hold a constant bank angle while gliding to the ground (motor off). If the GP S position is no longer available, which makes it impossible for the eBee to know where it is and thus to navigate, an emergency action is taken automatically: the eBee turns off its motor, sets a bank angle and glides in a large circle towards the ground, using the altitude data from the barometer. I f there is a strong wind, the eBee may be pushed far from its current position. If a GPS position is re-acquired the eBee will abort the landing procedure and go to the Home waypoint. There is an automatic pre-flight test to check the GPS signal and the barometer values . If there is an error with the GPS, the barometer or inconsistent values, the aircraft is prevented from taking -off. If the error happens while in flight , the aircraft will use GPS altitude onl y and will go to the Home waypoint. If both the GPS and the barometer are malfunctioning, the eBee will start a controlled emergency landing procedure. 

### 3.3 **UA Flight Controls**  The control surfaces are each actuated by a servo. The two servos are both activated by the autopilot through a regular RC interface with variable length pulse from 1 to 2ms, every 20ms . The operator can provide live input through the drag -and -drop interface of the eMotion software Possible in -flight adjustments include the addition and removal of waypoints, as well as the**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 11 /31 modification of waypoints position . Alternatively, manual take-over is possible through a regular RC remote control. 

### 3.4 **Aut opilot**  The autopil ot is designed by senseFly and is not a COTS product . Wh en assembled, the autopi lot is manually installed in to the dedicated slot of the EPP fuselage. Its alignment with the airframe is calibrated d uring the manufacturing process. In the “automatic” mode, the autopilot has full, high - level control of the eBee. The only input is the flight plan. This flight plan is always stored on the autopilot . Thus, all commands issued keep the aircraft within structural limits. All autopilot commands (airspeed, pitch angle and roll angle) are bounded.
 Airspeed: 10.5 - 25 m/s.  Roll: -60 - +60 degrees.  Pitch: - 15 - +30 degrees. In the full manual mode, the pilot has full authority on the control surfaces and no input limitation is done by the autopilot. I n order to test the autopilot, sof tware in the l oop simulations are performed. Indeed, the software simulator uses the same code for the high - level logi cs than the real aircraft. This allows us to test all the logics in simulation before flying . Moreover, real flig ht tests on dedicated platforms are conducted at our test center in Switzerland. 

### 3.5 **Communication and control**  **3.5.1 Ar** **chitecture of the command**  **and communication sy stem**  The fol l owing diagram illustrates the communication between the various subsystems.**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 12/31 **Figure 5** : Architecture of the command and communication system The spectrum used for the communication between the ground control station and the aircraft is the ISM 2.4 GHz band. A unique, random ID is used to pair the ground modem and the air modem. No encryption is used. All ISM - based equipment (Wi - Fi, etc.) may interfere with the radio link. Thanks to the spread -spectrum technology, these interferences have only a limited effect (one packet) . Nothing in particular is made to mitigate these interferences. The modem estimates link strength based on RSSI and displays it on the ground datalink modem with 3 LEDs (all LEDs switched on for the maximum signal strength) . The ground station software displays a link strength percentage based on the rate of successfully transmitted packets . The only redundant link is the manual override RC link.**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 13/31 A working area radius and flight ceiling are defined. The eBee flight will be bounded by these parameters and the aircraft will return to the Home waypoint if the flight plan leads it beyond the working zone. It prevents the eBee from going beyo nd the communication range. The eBee will then not even start its mission (go to the first waypoint) if one of the pre- programmed waypoints is outside of the working area. However the eBee doesn’t rely on the ground station to operate. If the operator chooses so (this is enabled by default), the eBee will fly to the Home waypoint after 30s of not receiving any packet from the ground, in order to re-establish the communication link. Antenna masking during turns and pitch angles has not been detected. Communications are also unaffected by atmospheric attenuation including precipitations. **3.5.2 Lost Link and**  **Flight Recovery** In order to determine if the aircraft is experiencing a lost link situation, the autopilot checks that n o packets have been received during a certain period of time . The ground control station displays then a red warning indicating that the communication link is lost. In case of a lost link situation, the flight continues as planned. But the operator can also program the eBee (in eMotion 2) to automatically return to the Home Point if that scenario happens. The Home waypoint is defined by the user during flight planning using eMotion . Wh en the eBee reaches this point, it will loiter at this location until the battery is low – at which point it will land according to the planned procedure. No flight recovery mechanism is implemented beyond adequate flight/navigation behaviour in response of detected problem . **3.5.3 Control Station**  The control station consists of a laptop or tablet and the datalink USB modem. The laptop/tablet is used to run eMotion 2, the flight management software developed by SenseFly. On the main screen of eMotion 2, there is a Flight Monitoring tab displaying the flight information (User Manual section 5.5).**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 14/31 **Figure 6** : Display of flight parameters in eMotion 2 On the main screen, the pilot can accurately determine the position of the aircraft, based on the GPS information (1 - 3 meters) for the (x, y) coordinates and barometer (10 cm accurate) for the altitude . For the attitude, the inertial measurement unit has a precision of 3-5 degrees. Several commands are safeguarded from inadvertent activation, like LAND NOW (3 clicks are required). Some other commands require acknowledgment of a warning message. Any inadvertent manipulation of the ground station sof tware may cause an undesirable outcome. For example, a n inadvertent waypoint displacement may cause the eBee to fly to an undesirable location. The ground control station software runs on W indows only . T he operator is responsible for providing primary and backup power to the ground control station. The datalink modem is powered by the laptop or tablet via a USB connectio n. **3.5.4 Control frequencies**  The bi -directional telemetry link used to connect the ground station and the eBee is based on modem which implements a custom 2.4 GHz FHSS, 100 mWd ata link (FCC Part 15.247, IC RSS210, CE).**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 15/31 

### 3.6 **Ground Support Equipment** No equipment is used but the laptop computer or tablet and the USB ground datalink modem. 

## 4 **Processes and Procedures 4.1**  **Configuration Management** All changes in the hardware configuration are notified by a change in the version of the eBee (EB 01 -xxx-xxx ..... EB 03 - xxx-xxx). These changes are obviously logged internally with a tracking file for each unit produced. Quality of each manufactured eBee is ensured by one or more test flights with post-analysis of the flight data recorded by the different sensors. 

### 4.2 **Softw are Management**  Users are automatically notified to the availability of software updates when the ground control software is launched. The ground station software verifies the embedded firmware upon connection to the eBee in order to ensure embedded sof tware/ground software compatibility. Most embedded sof

tware is written in C. Ground control station sof tware is written in C++ and is based on the Qt framework. 

### 4.3 **Continuing airw orthiness**  Reliability is asserted by extensive test flight during all phases of the development. Each drone assembled at senseFly goes through several quality and inspection tests (ground and in -fl ight tests) to ensure conformity of the product as defined in the specifications. Each drone is tied with a "quality control" document that follows the drone during its manufacturing process. This document is then archived at senseFly. SenseFly has also a servicing structure (after sales support team) , which provides support to clients and monitors product quality control. In case a defa ult is found, the support team backs the problem so that the Production & Industrialization department takes the necessary action in terms of quality or design (continued airworthiness). It is possible to do that internally because SenseFly masters all aspects of the design, from hardware to software. The end - users are notified directly when they use the flight manage ment software or by email.**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 16/31 

## 5 **Operations 5.1**  **National A irspace Sy** **stem (NA S) Integration and Interaction**  The eBee has a high -visibility paint scheme on the blisters (yellow colour) that enables other pilots to see and avoid the eBee and enables the observer(s) to visually acquire and track the UA . No specific support for ATC communication is implemented since the eBee stays usually in Class G Airspace. No specific support for pilot-to- pilot communication is implemented. No automatic method is implemented for sense-and -avoid of airborne objects. A working area radius can be defined in order to make sure that the eBee wi ll not go beyond the line of sight of the operator. The eBee is also equipped with a ground proximity sensor that will detect ground proximity and initiate ground avoidance when reaching a height over ground of 30m or less. This feature can be disabled by the operator. 

### 5.2 **Flight Phases 5.2.1**  **Pre -** **flight /**  **taxi operations** 1. Weather check 2. Flight planning with eMotion2 (see Part 1 and 4 of the User Manual) on the field . For cached map data (OpenStreet Map, Bing, Ovi), the operator has to load the background map manually. For online maps (Google Map), the map is always displayed based on the latest mapping data available online. 3. Programming of the linear landing according to the wind direction 4. Aircraft inspection Each operator shall inspect (where applica ble) the following components of the UAV: (a) Body: Fabric and skin - for deterioration, distortion, and other evidence of failure; (b) Flight controls - for deterioration or improper installation; (c) Batteries - for improper installation or deformation; (d) Engine section - for deterioration; (e) Propeller section (blades and rubber bands) - for cracks, nicks, binds or deterioration; (f) All components of the wings, body-section assembly and flight surfaces for poor general condition, fabric or skin dete rioration, distortion, evidence of failure, and insecurity of attachment; (g) Camera system for improper installation, poor general condition, defects, and insecure attachment;**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 17/31 (h) Radio modem and electronic equipment, sensors (Pitot) - for improper installation and/or cracks. **5.2.2 Take**  **- off**  The motor is started by a specific shaking procedure (User Manual section 2.4). The motor is first started at very low power and current draw is monitored to detect if the propeller is free from any object. If this is the case, the motor is slowly ramped up to full power. At this point, the operator may launch the eBee. Step 1 : Orient horizontally and against the wind. Orient yourself against the direction of the wind, and confirm that the take-off direction in front of you is free of obstacles. Firmly grasp the eBee with both hands, one hand on the front of each win g as shown in the figure. Hold the eBee horizontally with the nose pointed against the wind and level wings Step 2 : Switch the motor on Shake the eBee back and forth 3 times longitudinally (within approx. 3 seconds) to begin the motor power- up sequence. The status LED will pulse blue until the motor is at full power and ready for take-off. Step 3 : Launch the eBee Once the motor is at full power the status L ED will blink green. Orient the eBee with approximately 10 degrees nose up and level wings. W hen the angle is correct the status LED will turn solid green, indicating that the eBee is ready for take-off. Launch the eBee with a gentle push by walking 1 -2 steps forward while releasing it with both hands in a purely forward motion. After take-off, the eBee tries to maintain its initial direction by keeping its wings level with full thrust until reaching the takeoff tran sition height, by default 20 meters . At this point, it will switch into waypoint navigation mode and fly towards the Start waypoint. Once it reaches the Start waypoint location and height the eBee will circle around the waypoint 1 -2 times to estimate the wind and calibrate its sensors before starting the mapping mission **5.2.3 Flight**  A laptop and the USB datalink modem are needed to connect to the eBee, check its status and modify its flight plan. The drag -and -drop interface offered by the ground control station software (eMotion 2) allows the operator to modify the trajectory of the eBee in real -time. By default, the eBee flies autonomously and does not need the provided remote controller to be operated. However, by using the remote control, it is possible to override the eBee autopilot by switching to one of two available manual modes: Full Manual or Assisted Manual. In Full Manual mode the sticks of the remote controller directly set the motor power and the angle of the ailerons of the eBee. In Assisted Manual mode the sticks of the remote control are used to set the speed, turn rate and climb or sink rate. Turning on the remote controller will cause the eBee to change to either Assisted Manual or Full**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 18/31 Manual mode, depending on the mode set on the Ground Control Station in the Flight Parameters tab. To warn the operator that the eBee is operated in Manual / Assisted Manual mode, a continuous sound is emitted by the GCS. A visual yellow warning ind icates that the aircraft is in manual mode . 2. Turning off the remote control will cause the eB ee to return to the last autonomous operation mode it was in before Manual mode was enabled, or a safe flight phase (if manual control was enabled during a critical flight phase). Note: Ensure that the "Ignore RC signals" option in the Flight Parameters tab is unchecked; otherwise the eBee will ignore the commands from the remote control and remain in autonomous operation mode **5.2.4 Landing/recovery**  No equipment is required. The eBee offers two type of landing procedure: circular landing (based on GPS and barometer) and linear landing with a 20-degree slope. An optical ground sensor technology allows to flare when approaching the ground and to improve landing precision for the linear landing. **5.2.5 Post flight**  C leaning and afte r-flight maintenance operations (see document “Maintenance and procedures” ) 

### 5.3 **Emergencies and procedures 5.3.1**  **Complete loss of control link** If the option is enabled, the eBee flies towards the Home waypoint at an altitude defined by the Home waypoint's "Change altitude parameter" (by default, set to "Highest"). User action: Try to improve radio signal quality by following the instructions in section "Improving radio si gnal communication" of the user manual. **5.3.2 Engine Failure**  The eBee attempts to re-start the electric motor. If the first attempt fails a “ Critical Failure: Motor malfunction ” warning is announced and the eBee starts an emergency landing procedure. User action: If the error disappears, land as soon as possible and perform Check 1 in section "Full airframe and sensor inspection". Otherwise, the aircraft will land automatically. If the motor is not working even after an attempted re-start commanded by a "Motor malfunction" In flight warning, the eBee orients itself in the direction of the Home waypoint a nd glides towards the ground while continuously trying to re-start the motor. If the eBee reaches the Home waypoint with**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 19/31 sufficient altitude, it will enter the landing circuit without power and will re-adapt the base waypoint's position depending on its current altitude. If motor re-start is successful the eBee cancels the landing and flies towards the Home waypoint at an altitude defined by the Home waypoint's Change altitud e parameter (by default, set to "Highest"). **5.3.3 Propeller Loss**  In case of a propeller loss, the eBee will detect a motor failure and start the same procedure as the engine failure. **5.3.4 Loss of GPS**  The GPS position is no longer available, which makes it impossible for the eBee to know where it is and to navigate. The eBee will turn off its motor, sets a constant bank angle and glide in a large circle towards the ground. If there is a strong wind the eBee may be pushed far from its current position. If a GPS fix is re-acquired the eBee will abort the landi ng procedure and go to the Home waypo int. **5.3.5 Loss of heading information**  The eBee navigation is degraded and will likely result in a turn in the direction of the wind (back wind) to regain a ground speed and thus a GPS course information. However, the eBee automatically adapt its airspeed command to avoid having a low or null ground speed. This only happens if

the wind is much stronger than the maximum wind allowed (> 18 m/s), or if the eBee is already in Critical failure state where the motor does not output thrust (motor failure, empty battery, GPS loss). **5.3.6 Pitot sy** **stem malfunction** The aircraft will use GPS altitude only. **5.3.7 Servo malfunction or loss**  In case of servo failure, the autopilot tries to keep the roll angle by using the other servo. If the servo fails in 'down' position, it is likel y that the eBee will start to dive and accelerate. If reaching 30 m/s of airspeed, over-speed condition is detected and the motor is put into reverse mode to slow down the aircraft. The reverse mode is also noisy which can alert any potential people on the ground. If the servo fails in 'level' or 'up' position , the aircraft will possibly be able to continue to fly but with a degraded behaviour, including loss of altitude in curves and inhibited turn ing ability . If the aircraft cannot turn enough and leaves the working area, the motor is turned off to minimize impact energy and the aircraft glides toward the ground . Moreover, there is also a detection of servo malfunction. The autopilot correlates the output commands to the ailerons (expected positions) with the measured rotation rates (real positions found from simple model). Wh en a servo fails, this error becomes huge and the autopilot is able to tell which servo is more likely to have failed.**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 20/31 **5.3.8 Pay** **load malfunction**  If the payload stops working, a warning appears on the ground control station and if set so, the aircraft will return to the Home waypoint. **5.3.9 Loss of A** **utopilot**

- Partial: If the autopilot experiences a hard -fault due to external factors (el ectrical discharge) or due to a code issue, it will enter a special section of the code: Everything is stopped except direct manual control of the ailerons with the remote controller. The motor is switched off.

- Total: If the autopilot shuts down (electrical failure), the eBee will stop controlling th e ailerons . The motor will turn off and the aircraft will start an uncontrolled descent or spin. 

### 5.4 **Manuals**

 U ser manual which includes:

- 1 section with all of the aircraft limitations

- 1 section with all failures that can occur during the pre-flight tests and flights 

### 5.5 **Organizational Considerations 5.5.1**  **Training** See document “training” **5.5.2 Maintenance**  See document “Maintenance and procedures”**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 21 /31 

## 6 **An nex** **es 6.1**  **An nex 1**  **: 3**  **- Vie** **w Draw**  **ings of the eBee** 

**6.2 An**  **nex 2 :**  **In -** **Flight safety actions** **CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 22/31 In order to guarantee the safety of a mission, SenseFly has integrated safety actions as part of the autopilot and software pre-flight tests, as well as specific in -flight procedures. These fully automatic procedures are undertaken either by the operator (by clicking the matching button) or the autopilot (when sensors measure critical values of different parameters). **6.2.1 In**  **- flight manual safety actions**  During a flight, the operator can undertake the following actions by clicking the matching button: 1. **Hold** : the UAV stops its mission and flies around its current position 2. **Resume** : the UAV resumes its flight from the point where it stopped 3. **Go to**  **H ome** **/Start way** **point** : the mission ends and the UAV goes back to its Home position (or the start position) 4. **Emergency**

**l anding**  : the aircraft gently lands at the current position , with the minimum possible vertical speed (circular landing). **6.2.2 In**  **- flight automatic safety actions**  The autopilot is continuously monitoring the status of its sensors and will activate emergency procedures as soon as any anomaly is detected. In the event of a failure that makes it impossible to reach the home location, an emergency landing procedure is i nitiated using a low-velocity gliding mode with engine off.

- **Empty battery**  **:** Wh en the battery is empty (<5%), the eBee turns off its motor and glides towards the ground in the direction of the Home waypoint. This critical failure is always preceded by a low battery warning, which leads the aircraft to the H ome waypoint. Thus, if the aircraft is not too far away, it is able to land safely on the H ome waypoint.

- **Low battery**  **:** Wh en the battery is low (<20%), a warning appears in eMotion 2 and the eBee flies back to the Home waypoint.

- **Loss of**  **GPS signal**  : Wh en the GPS position (or ‘fix’) is no longer available, which makes it impossible for the eBee to know where it is and thus to navigate, an emergency action is taken : the eBee turns off its motor, sets a bank angle and glides in a large circle around its current position. If there is a strong wind the eBee may be pushed far from its current position. If a GPS ‘fix’ is reacquired the eBee will abort the landing procedure and resume the mission.

- **Barometer error** : The barometer gives abnormal values . The eBee is programmed to go to the Home point using the altitude given by the GPS to control its approach.**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 23/31 - **Battery**

**e rror** : The measurement of the current voltage gives an abnormal value. The eBee is programmed to go to the Home point .

- **Ai rspeed**  **error:** The measurement of the air speed gives an unexpected value. The eBee is programmed to go to the Home point .

- **Out of w orking area**  : the eBee is out of the flight zone (Wo rking area radius defined in eM otion 2). The eBee is programmed to go to the Home point .

- **Ab ove**  **wo rking**  **area** : The aircraft exceeded the maximum flight ceiling of the flight zone. The eBee is programmed to go to the Home point

- **Far out**  **of working area** : The aircraft is out of the fl ight zone (defined in eMotion 2), due to strong wind conditions . The eBee is programmed to start its descent phase toward the Home Waypoint.

- **Poor GPS cov** **erage:** GPS signal is low (risk of signal loss). The eBee is programmed to go to the Home point .

- **Wind too**  **strong** : the measurement of the wind indicates that it is too strong. The eBee is programmed to go to the Home point .



### 6.3 **An nex**  **3 :**  **Ar eas**  **of operations CONFIDENTIA** **L DOCUMENT**

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 24/31 **U K**  Flight approval for VLOS operations **Switzerland** Flight approval for VLOS operations
**Au stralia**  Flight approval for VLOS operations **Canada** Flight approval for VLOS operations **USA** NMSU COA AW R certificate (Army Corps of Engineers) **France** Flight approval for E -VLOS operations **Ireland** Flight approval for VLOS operations **Denmark** Flight approval for VLOS operations **Norw ay**  Flight approval for VLOS operations **Germany** Flight approval for VLOS operations **Italy** Flight approval for VLOS operations **Netherlands** Flight approval for VLOS operations **Sweden** Flight approval for VLOS operations**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 25/31 

### 6.4 **An nex**  **4 :**  **Safety**

**analy sis**  **6.4.1 Considerations about risk related to ground impacts**  **Early -** **flight termination** Early flight termination, either controlled or uncontrolled, will result in ground or water impact. The diagram below summarizes the different failures that entail flight termination and related actions taken by the autopilot.

**Figure 4**: Management of critical situations by the autopilot Under controlled emergency landing the autopilot will control the speed and orientation of the aircraft, thus reducing the probability of injuring people on the ground as well as damages to property and the aircraft itself. In case of a controlled emergency landing, the airspeed of the aircraft is close to 10 m/s and the kinetic energy will amount to 38 Joule at MTOW , which can be considered**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 26/31 harmless. In case of an uncontrolled emergency landing (e.g. loss of battery power or servo- motor lock), the vertical speed should never exceed 28 m/s, which corresponds to 180 J at MTOW.As a comparison, a soccer ball weighs about 450 g and can be kicked at up to 50 m/s, which corresponds to approximately 560 J. **Calculation of the ELOS**  A standard way of quantifying the risk level in the aviation industry is through the Expected Level Of Safety (ELOS) . In the commercial aviation a level of 3.7 · 10 -7 fatalities on ground per hour of flight has been reached on average in the USA between 1989 and 2008 [5,6]. The 1309 AMC section of EASA CS 25 [2] refers to the same order of magnitude (10 -7 per flight hour) as a maximum acceptable rate for hazardous events. The ICAT-2005- 1 report by the MIT International Center for Air Transportation [9] proposes a method to evaluate the ELOS of UAS in terms of fatalities per hours of operation: ELOS = (1 / MT BF) · Aexp ·  · P Penetration With: ELOS: Equivalent Level of Safety (fatalities / hours of operation) MTBF: Mean time between failures (hours); e.g. an MTBF of 50 is certainly a worst case scenario for the eBee; Aexp : Lethal area; for the eBee, Aexp ≈ 0.04 m 2 based on [9];  : Local population density (average value in the US: ρ = 113 inhabitant/km 2 ); P Penetration : probability of fatality per impact, should be set close to 5% for the eBee according to [9]. Here is the numerical application using the suggested values above: EL O S = (1 / 50 h) · 0.04 m 2 · 113 · 10 -6 m -2 · 5% = 4.5 · 10 -9 The resulting value is typically lower than the one achieved by the commercial aviation, which denotes a lower risk, even though the MT BF of UAS is known to be smaller than with commercial aircraft. **6.4.2 Considerations about the probability**  **of mid -** **air collisions Ai**  **rspace** In general, the operator is responsible for avoiding any collision with other sky users. The risk of encountering other sky users can be lowered by flying at low altitude (generally <120m or**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 27/31 150m/AGL) and far from airports. It is also recommended to contact the local aviation authorities to be aware of the prevailing rules. To ensure that the eBee stays in a given area while flying, it is possible to define a working area radius and a flight ceiling in ground control sof tware, eMotion. Furthermore, the eBee operator can take manual actions in case an other aircraft enters the zone: e.g. Go to the Home Waypoint, Go the Start Waypoint, Go Land, Initiate an emergency landing, Hold the mission (and loiter around its current position). **An alogy**  **with Birds** It is interesting to note that the Airframe Bird Strike Airworthiness Standards (FAR 25) stipulates that any transport aircraft should be able to withstan d a bird impact corresponding to two to three times the weight of the eBee . **6.4.3 Pre**  **- flight tests** **CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 28/31 **6.4.4 Take**  **- Off veto** **s** There are several conditions that need to be fulfilled before the aircraft can accept a take-off order. The conditions are calculated continuously when in Idle and when the pre-flight checks are successful. The list of conditions is the following :

- Low battery.

- Security issue not acknowledged.

- Wi ngs not detected (eBee only).

- USB cable plugged.

- Pitch angle not horizontal.

- Roll angle not horizontal.

- Motor blocked.**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 29/31 **6.4.5 References**  1 . Joint JAA / Eurocontrol Initiative on UAVs (2004) A concept for European regulations for civil unmanned aerial vehicles (UAV). Final Report 2 . European Aviation Safety Agency (EASA) (2007) Certification specification 25 (CS25). Amendment 3 3 . European Aviation Safety Agency (EASA) (2005) A- NPA, No. 16/2005, policy for unmanned aerial vehicle (UAV) certification 4 . Joint Capability Group on Unmanned Aerial Vehicles (2007) STANAG 4671 – Unmanned Aerial Vehicle Systems Airworthiness Requirements (USAR). draft, NATO Naval Armaments Group 5 . National Transportation Safety Board (NTSB) (2008) Accident database and synopses. http://www.ntsb.gov/ntsb/query.asp**CONFIDENTIA L DOCUMENT** 

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 30/31 6 . National Transportation Safety Board (NTSB) (2008) Aviation accident statistics. http://www.ntsb.gov/aviation/Stats.htm 7. Range Safety Group, Range Commanders Council (1999) Range safety criteria for unmanned air vehicles – rationale and methodology supplement. Supplement to document 323 -99 8. Range Safety Group, Range Commanders Council (2007) Common risk criteria standards for national test ranges: Supplemen t. Supplement to document 321 -07 9. We ibel RE, Hansman RJ (2005 ) Safety considerations for operation of small unmanned aerial vehicles in civil airspace. MIT Report No. ICAT-2005- 1 March 2005.



### 6.5 **An nex**  **5 :**  **Command and control CONFIDENTIA** **L DOCUMENT**

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 31 /31