PROPRIETARY INFORMAT ION

- NOT FOR PUBLIC RELEA SE

Date: 20150 516 Revision: 1.0 Revision:1.0 Page 1 of 11
PROPRIETARY INFORMATION

- NOT FOR PUBLIC RELEASE 

# DJI Multi

- rotor
Operational Safety Assessment

Rupestrian CyberServices

3644 N. Stone Crest Street

Flagstaff, AZ 86004

(928) 526

- 3625PROPRIETARY INFORMAT ION

- NOT FOR PUBLIC RELEA SE

Date: 20150 516 Revision: 1.0 Revision:1.0 Page 2 of 11
PROPRIETARY INFORMATION

- NOT FOR PUBLIC RELEASE 

## Table of Contents

1. Introduction

2. Description of the Aircraft and System

3. Operational Context

4. Hazard Identification

5. Risk Assessment

6. Control MeasuresPROPRIETARY INFORMAT ION

- NOT FOR PUBLIC RELEA SE

Date: 20150 516 Revision: 1.0 Revision:1.0 Page 3 of 11
PROPRIETARY INFORMATION

- NOT FOR PUBLIC RELEASE 

## Revision Control Page

Revision # Date InitialsPROPRIETARY INFORMAT ION

- NOT FOR PUBLIC RELEA SE

Date: 20150 516 Revision: 1.0 Revision:1.0 Page 4 of 11
PROPRIETARY INFORMATION

- NOT FOR PUBLIC RELEASE 

### 1. Introduction

This operational safety assessment is intended to identify the hazards associated with the operation of the Phantom 2 and 3 made by DJI . It will serve to identify hazards that may be encountered, assess risk, and offer mitigation strategies to ensure those risks do not create challenges to safety of flight.

A general outline of this safety assessment is shown below. It was derived from the Operational Risk Management (ORM) process as described in chapter 15 of the FAA System Safety Handbook.

1. Description of the UAS

- provides a description of the system and the aircraft's performance.

2. Definition of Operational Context

– defines how the aircraft is to be used and outlines a general description of the operational environment.

3. Hazard Identification

– op erational hazards are identified and listed in a preliminary
hazard assessment.

4. Risk Assessment

– explores operational risk utilizing qualitative assessment tools used to determine probability and severity of possible hazards.

5. Implementation of Risk Controls

– a plan for applying safety measures to increase operational safety.

This general outline allows mitigation strategies to be considered, implemented, and reviewed for multiple scenarios.


### 2. Description of the Aircraft and System

The aircraft is p rimarily constructed from v inyl, c arbon fiber and aluminum alloy . The
aircraft is a Multifunctional Quad

- rotor Aerial System . The system is powered by four
920 kV electric motor s powered by a 5200mAh lithium polymer battery. The Naza

- M V2 is a powerful flight controller/ autopilot which receives positional guidance from GPS. Built into it are automatic GPS course correction plus GPS and compass interference monitoring, which combine to offer more stable flight and minimal magnetic interference

. If the s ystem suffers a motor failure in flight in attitude or GPS mode, it will maintain its altitude and rotate around the stopped motor. This allows it to fly safely back to home
and land

. If the connection between the multirotor and the remote control arePROPRIETARY INFORMAT ION

- NOT FOR PUBLIC RELEA SE

Date: 20150 516 Revision: 1.0 Revision:1.0 Page 5 of 11
PROPRIETARY INFORMATION

- NOT FOR PUBLIC RELEASE d isconnected during flight, a failsafe system will activate. T he multirotor will fly back to its point of takeoff and land automatically. This feature can also be triggered manually using the One

- Key Go

- Home function activated using Assistant

. The aircraft can be controlled by both a 2.5GHz telemetry signal from a remote control link or a 5.8GHz signal from a manual RC controller.

Aircraft dimensions: 20 x 10 x 14 inches, diagonal length 350mm

Autopilot: Naza

- M V2

Telemetry radio: 2.4 GHz

Motor: DJI Brushless Motor 2212 920Kv

Propellers: 2 CW/CCW 9 inch

Battery: 3S lithium polymer , 5200 mAh, 11.1V

Aircraft weight (with battery): 1300g

Radio range: .6 miles* (1 km)

Flight time: 25 min*

Maximum operational wind speed: 25 mph (11 m/s)

Recommended flight speed: less than 33 mph (15 m/s)

*Figures reflect estimated values at ideal operating conditions. Environmental conditions

can affect flight time, range, area coverage, and ground sampling distance.

The aircraft includes a gimbal mount that is capable of c arrying a small point

- and

- shoot camera as well as a small, servo

- driven gimbal to point the camera. The camera can be
connected and controlled via the Naza

- M V2 autopilot and stores images internally to the camera that are recovered after flight.

3. Operational Context

The aircraft will be utilized for various operations in support of; aerial surveying, aerial photography, agriculture, wildlife and forestry monitoring, patrolling, aerial inspection, real estate surveying, crew member training, fire fi ghting, and mapping operations

. ThePROPRIETARY INFORMAT ION

- NOT FOR PUBLIC RELEA SE

Date: 20150 516 Revision: 1.0 Revision:1.0 Page 6 of 11
PROPRIETARY INFORMATION

- NOT FOR PUBLIC RELEASE aircraft will typically be flown in a raster pattern over the desired location taking photos that need to overlap side

- to

- side and front

- to

- back. The aircraft will maintain low
altitudes over areas and is limited to no higher than 400' AGL. The aircraft will be operated over private property during day VMC. Due to the low altitude operations of the system it should not encounter any manned operations.

4. Hazard Identification

A general hazard list pertaining to sUAS operation is shown below.

4.1 Structural Failure

The aircraft is constructed from v inyl, c arbon fiber and aluminum alloy . The most likely structural failure would occur at the point of a weakness in the vinyl , either from fatigue or a manufacturing defect . Since the autopilot will have a limited ability to compensate for a structural failure, the best recovery method would require the pilot to take over manual control and recover the aircraft. The most probable result being the loss of the
aircraft. The DJ I family of UAS is a popular quad copter flown by many hobbyists . With
thousands of these sold and flown in the hobby market, there are no specific structural weaknesses identified by hobby users.

4.2 Flight Control Malfunction

The flight controls of the D JI are moved by lightweight R/C servos with no "actual position" feedback to the autopilot. The only indication to the pilot of a malfunction is a lack of response or erratic behavior of the aircraft. The autopilot will attempt to correct
attitude deviatio ns with additional control input, but does not have the ability to identify and isolate a malfunctioning flight control. The best recovery method would require the pilot to take over manual control and recover the aircraft with the remaining control
surfac es.

4.3 Autopilot Malfunction

There are several types of autopilot malfunctions that can be grouped into two categories: partial malfunction, and a complete malfunction. In a partial malfunction, the pilot's manual control inputs are passed through the aut opilot to the servos, allowing the pilot to recover the aircraft manually. When the DJI enters “Ready to Fly” from the “Ready to Fly status (non

- GPS), the GPS coordinates will be recorded and set as thePROPRIETARY INFORMAT ION

- NOT FOR PUBLIC RELEA SE

Date: 20150 516 Revision: 1.0 Revision:1.0 Page 7 of 11
PROPRIETARY INFORMATION

- NOT FOR PUBLIC RELEASE home point. When the remote controller signal is lost, the aircraft will return to the recorded home point coordinates and land.

4.4 Power Plant Failure

If the autopilot detects and engine failure, it will enter a limited capability mode and return the aircraft to the home point. Upon reaching the home point the aircraft will land automatically

. At any point, the pilot will be able to override the autopilot and switch to MANUAL mode for a manual forced landing.

4.5 Lost Command Link

There are two links to the aircraft. The first is through the manual R /C controller which, in addition to flying the aircraft manually, sets the autopilot modes for autonomous flight. If the R/C controller link is lost, the aircraft will switch to RTL mode and return to the launch point at the pre

- set RTL altitude. The secon d link is through a 2.4GHz telemetry
transmitter connected to a PC. If this datalink is lost, the aircraft will continue following the mode established by the R/C controller. If the autopilot detects a datalink loss and a simultaneous GPS loss, the aircraf t will command " Failsafe ", and the aircraft will return to the home point.

4.6 Aircraft Position Loss

In the event of GPS loss, the GPS signal drops from 6 signals to 5 or less, the Flight Control System will automatically control the aircraft to fly back to the home point and
land

. At any point, the pilot will be able to override the autopilot and switch to MANUAL mode to recover the aircraft manually.

4.7 Traffic Conflict

The aircraft has no automatic or autonomous means to sense and avoid other air traf fic. It does not carry a transponder or other traffic management equipment. Sense and avoid capability must be provided by the pilot and visual observer. If an air traffic conflict arises, the pilot must intervene to direct the aircraft away from the confl ict.

5. Risk Assessment

The risk assessment shown below is designed to place risk values on the hazards listed in the previous section. Each hazard is assigned a probability and a severity. Probability takes into account the likelihood of the hazard posing a risk to the safety of flight overPROPRIETARY INFORMAT ION

- NOT FOR PUBLIC RELEA SE

Date: 20150 516 Revision: 1.0 Revision:1.0 Page 8 of 11
PROPRIETARY INFORMATION

- NOT FOR PUBLIC RELEASE the entire life of the aircraft. (In this case, an estimate of 1,0 00 cycles is used for the life of the aircraft.) Severity is assigned on a scale of 1 to 10; 1 being the least severe with little to no damage to the a ircraft, and 10 being the most severe with a high likelihood of destroying the aircraft and/or causing injury to persons or damage to property.

1

– Little to no effect on the integrity of the aircraft or overall safety.

2

– Possibility superficial damage t o the aircraft, no significant chance of injury. There is no discernible risk to property.

3

– Light damage to the aircraft will occur, but is considered to be minor and easily fixed. There is a slight possibility of injury. Risk to property is very low.

4

– Damage to the aircraft will occur, and there is a slight risk light injuries will result. Risk to property is low.

5

– Moderate effect on safety. Damage to the aircraft will occur and there is a reasonable expectation of minor injury or damage to proper ty.

6

– Significant effect on safety. Damage will occur to the aircraft. There is a reasonable expectation of moderate injury and damage to property.

7

– Significant effect on safety. Damage will occur to the aircraft. Severe injury and property damage is expected.

8

– Damage to the aircraft will occur. Severe injury and property damage is assured.

9

– Damage to the aircraft will occur. Very high likelihood of loss of life or significant property damage.

10

– Damage to the aircraft will occur. Property will be severely damaged. Serious injury and/or death is likely.

The hazard's risk is calculated by multiplying its severity by its probability. For example, a hazard with a severity of 2 and a probability of 50% would yield a risk of 1, a LOW
risk. Values fro m 0.01 to 3.34 constitute LOW risk. Values from 3.35 to 6.67 are considered MODERATE. Values greater than 6.67 are HIGH risk.PROPRIETARY INFORMAT ION

- NOT FOR PUBLIC RELEA SE

Date: 20150 516 Revision: 1.0 Revision:1.0 Page 9 of 11
PROPRIETARY INFORMATION

- NOT FOR PUBLIC RELEASE RISK ASSESSMENT

HAZARDS

PROBABILITY (1

- 100%)

SEVERITY TO PERSONS OR PROPERTY (1

- 10)

RISK (PROBABILITY x SEVERITY)

LOW, MODERATE, OR HIGH

RISK ASSESSMENT

HAZARDS PROBABILITY (1

- 100%) SEVERITY TO

PERSONS OR PROPERTY (1

- 10) RISK

(PROBABILITY x SEVERITY) LOW,

MODERATE, OR HIGH

1. Structural Failure 10% 5 0.5 LOW 2. Flight Control Malfunction 10% 5 0.5 LOW 3. Autopilot Malfunction 10% 5 0.5 LOW 4. Power Plant Failure 30% 3 0.9 LOW 5. Lost Command Link 80% 2 1.6 LOW 6. Aircraft Position Loss 75% 2 1.5 LOW 7. Traffic Conflict 10% 6 .6 LOW

Due to the aircraft's lightweight construction in addition to its operational context, the risk to persons or property is low. (Note: 14 CFR 25.631 requires that transport aircraft must ensure "continued safe flight and landing of the airplane after impact with an 8

- pound bird" which is very close to the weight of the DJI .)

6. Control Measures and Implementation

This section lists the operational control measures used to mitigate risks associated with the hazards defined in previous section.

6.1 Structural Failure

In order to prevent a structural failure, the aircraft will be visually inspected before every flight. In addition, a detailed Full Airframe and Sensor Inspection will be conducted after every 10 flight hours. The details of this inspection are inc luded in the DJI Inspection
and Maintenance Manual

.PROPRIETARY INFORMAT ION

- NOT FOR PUBLIC RELEA SE

Date: 20150 516 Revision: 1.0 Revision:1.0 Page 10 of 11
PROPRIETARY INFORMATION

- NOT FOR PUBLIC RELEASE 6.2 Flight Control Malfunction

In order to prevent flight control malfunction, the aircraft will be visually inspected before every flight. In addition, a detailed Full Airframe and Sensor Inspection wil l be conducted after every 10 flight hours. The details of this inspection are included in the
DJI In spection and Maintenance Manual

. 6.3 Autopilot Malfunction

In order to prevent an autopilot malfunction, the aircraft will be checked for proper stability control inputs prior to every flight. In addition, a detailed Full Airframe and Sensor Inspection will be conducted after every 10 flight hours. The details of this inspection are included in the DJI Inspection and Maintenance Manual.

6.4 Power Plant Failu re

In order to limit the effects of a power plant failure, the aircraft will be flown within 1/2 mile of the Return to Launch location at all times. This will allow the pilot to maintain visual contact with the aircraft and attempt a forced landing or dire ct the aircraft away from persons or property on the ground.

6.5 Lost Command Link

In order to reduce the risk of a command link, the aircraft will remain within 1/2 mile of the pilot (and the R/C transmitter) at all times. The RTL altitude will be set to 100' AGL in order to improve the likelihood of reestablishing the command link while the aircraft is loitering. The pilot will carry an additional transmitter battery at all times.

6.6 Aircraft Position Loss

In order to limit the effects of a GPS, the airc raft will be flown within 1/2 mile of the home point location at all times. This will allow the pilot to maintain visual contact with the aircraft and attempt to recover the aircraft manually and direct the aircraft away from persons or property on the ground. Since an aircraft in an autonomous mode will
im mediately revert to dead reckoning for navigation; attitude, compass, and pitot/static systems should be checked with a Full Airframe and Sensor Inspection after every 10 flight hours. The details of this inspection are included in the DJI Inspection and
M aintenance Manual.PROPRIETARY INFORMAT ION

- NOT FOR PUBLIC RELEA SE

Date: 20150 516 Revision: 1.0 Revision:1.0 Page 11 of 11
PROPRIETARY INFORMATION

- NOT FOR PUBLIC RELEASE 6.7 Traffic Conflict

In order to reduce the probability of a traffic conflict, the Aero will be flown with a pilot and visual observer. The pilot will maintain primary responsibility to position the aircraft and will keep visual contac t with the aircraft at all times. The visual observer will assist the pilot, by scanning the area for other air traffic. In order to ensure the aircraft stays within visual range, the aircraft will only be flown during day

- VMC conditions and will
remain wi thin 1/2 mile of the flight crew at all times. The visual observer will stay within voice range of the pilot and call out the position of any air traffic observed. In addition, the crew will file a NOTAM no more than 48 hours prior to any commercial operat ions, in order to notify other pilots that a UAS will be operating in the area.