PROPRIETARY INFORMATION-NOT FOR PUBLIC RELEASE

Date: 20150516 Revision: 1.0 Revision:1.0

Page 1 of 11

PROPRIETARY INFORMATION - NOT FOR PUBLIC RELEASE

DJI Multi-rotor 

Operational Safety Assessment

Rupestrian CyberServices

3644 N. Stone Crest Street

Flagstaff, AZ 86004

(928) 526-3625
PROPRIETARY INFORMATION-NOT FOR PUBLIC RELEASE

Date: 20150516 Revision: 1.0 Revision:1.0

Page 2 of 11

PROPRIETARY INFORMATION - NOT FOR PUBLIC RELEASE

Table of Contents

1. Introduction

2. Description of the Aircraft and System

3. Operational Context

4. Hazard Identification

5. Risk Assessment

6. Control Measures
PROPRIETARY INFORMATION-NOT FOR PUBLIC RELEASE

Date: 20150516 Revision: 1.0 Revision:1.0

Page 3 of 11

PROPRIETARY INFORMATION - NOT FOR PUBLIC RELEASE

Revision Control Page

Revision # Date Initials
PROPRIETARY INFORMATION-NOT FOR PUBLIC RELEASE

Date: 20150516 Revision: 1.0 Revision:1.0

Page 4 of 11

PROPRIETARY INFORMATION - NOT FOR PUBLIC RELEASE

1. Introduction

This operational safety assessment is intended to identify the hazards associated with 

the operation of the Phantom 2 and 3 made by DJI. It will serve to identify hazards that 

may be encountered, assess risk, and offer mitigation strategies to ensure those risks 

do not create challenges to safety of flight.

A general outline of this safety assessment is shown below. It was derived from the 

Operational Risk Management (ORM) process as described in chapter 15 of the FAA 

System Safety Handbook.

1. Description of the UAS - provides a description of the system and the aircraft's 

performance.

2. Definition of Operational Context – defines how the aircraft is to be used and 

outlines a general description of the operational environment.

3. Hazard Identification – operational hazards are identified and listed in a preliminary 

hazard assessment.

4. Risk Assessment – explores operational risk utilizing qualitative assessment tools 

used to determine probability and severity of possible hazards.

5. Implementation of Risk Controls – a plan for applying safety measures to increase 

operational safety.

This general outline allows mitigation strategies to be considered, implemented, and 

reviewed for multiple scenarios.

2. Description of the Aircraft and System

The aircraft is primarily constructed from vinyl, carbon fiber and aluminum alloy. The 

aircraft is a Multifunctional Quad-rotor Aerial System. The system is powered by four 

920kV electric motors powered by a 5200mAh lithium polymer battery. The Naza-M V2 

is a powerful flight controller/autopilot which receives positional guidance from GPS. 

Built into it are automatic GPS course correction plus GPS and compass interference 

monitoring, which combine to offer more stable flight and minimal magnetic interference. 

If the system suffers a motor failure in flight in attitude or GPS mode, it will maintain its 

altitude and rotate around the stopped motor. This allows it to fly safely back to home 

and land. If the connection between the multirotor and the remote control are 
PROPRIETARY INFORMATION-NOT FOR PUBLIC RELEASE

Date: 20150516 Revision: 1.0 Revision:1.0

Page 5 of 11

PROPRIETARY INFORMATION - NOT FOR PUBLIC RELEASE

disconnected during flight, a failsafe system will activate. The multirotor will fly back to 

its point of takeoff and land automatically. This feature can also be triggered manually 

using the One-Key Go-Home function activated using Assistant. The aircraft can be 

controlled by both a 2.5GHz telemetry signal from a remote control link or a 5.8GHz

signal from a manual RC controller.

Aircraft dimensions: 20 x 10 x 14 inches, diagonal length 350mm

Autopilot: Naza-M V2

Telemetry radio: 2.4 GHz

Motor: DJI Brushless Motor 2212 920Kv

Propellers: 2 CW/CCW 9 inch

Battery: 3S lithium polymer, 5200 mAh, 11.1V

Aircraft weight (with battery): 1300g

Radio range: .6 miles* (1 km)

Flight time: 25 min*

Maximum operational wind speed: 25 mph (11 m/s)

Recommended flight speed: less than 33 mph (15 m/s)

*Figures reflect estimated values at ideal operating conditions. Environmental conditions

can affect flight time, range, area coverage, and ground sampling distance.

The aircraft includes a gimbal mount that is capable of carrying a small point-and-shoot 

camera as well as a small, servo-driven gimbal to point the camera. The camera can be 

connected and controlled via the Naza-M V2 autopilot and stores images internally to 

the camera that are recovered after flight. 

3. Operational Context

The aircraft will be utilized for various operations in support of; aerial surveying, aerial 

photography, agriculture, wildlife and forestry monitoring, patrolling, aerial inspection, 

real estate surveying, crew member training, fire fighting, and mapping operations. The 
PROPRIETARY INFORMATION-NOT FOR PUBLIC RELEASE

Date: 20150516 Revision: 1.0 Revision:1.0

Page 6 of 11

PROPRIETARY INFORMATION - NOT FOR PUBLIC RELEASE

aircraft will typically be flown in a raster pattern over the desired location taking photos 

that need to overlap side-to-side and front-to-back. The aircraft will maintain low 

altitudes over areas and is limited to no higher than 400' AGL. The aircraft will be 

operated over private property during day VMC. Due to the low altitude operations of 

the system it should not encounter any manned operations. 

4. Hazard Identification

A general hazard list pertaining to sUAS operation is shown below.

4.1 Structural Failure

The aircraft is constructed from vinyl, carbon fiber and aluminum alloy. The most likely 

structural failure would occur at the point of a weakness in the vinyl, either from fatigue 

or a manufacturing defect. Since the autopilot will have a limited ability to compensate 

for a structural failure, the best recovery method would require the pilot to take over 

manual control and recover the aircraft. The most probable result being the loss of the 

aircraft. The DJI family of UAS is a popular quad copter flown by many hobbyists. With 

thousands of these sold and flown in the hobby market, there are no specific structural 

weaknesses identified by hobby users.

4.2 Flight Control Malfunction

The flight controls of the DJI are moved by lightweight R/C servos with no "actual 

position" feedback to the autopilot. The only indication to the pilot of a malfunction is a 

lack of response or erratic behavior of the aircraft. The autopilot will attempt to correct 

attitude deviations with additional control input, but does not have the ability to identify 

and isolate a malfunctioning flight control. The best recovery method would require the 

pilot to take over manual control and recover the aircraft with the remaining control 

surfaces.

4.3 Autopilot Malfunction

There are several types of autopilot malfunctions that can be grouped into two 

categories: partial malfunction, and a complete malfunction. In a partial malfunction, the 

pilot's manual control inputs are passed through the autopilot to the servos, allowing the 

pilot to recover the aircraft manually. When the DJI enters “Ready to Fly” from the 

“Ready to Fly status (non-GPS), the GPS coordinates will be recorded and set as the 
PROPRIETARY INFORMATION-NOT FOR PUBLIC RELEASE

Date: 20150516 Revision: 1.0 Revision:1.0

Page 7 of 11

PROPRIETARY INFORMATION - NOT FOR PUBLIC RELEASE

home point. When the remote controller signal is lost, the aircraft will return to the 

recorded home point coordinates and land. 

4.4 Power Plant Failure

If the autopilot detects and engine failure, it will enter a limited capability mode and 

return the aircraft to the home point. Upon reaching the home point the aircraft will land 

automatically. At any point, the pilot will be able to override the autopilot and switch to 

MANUAL mode for a manual forced landing.

4.5 Lost Command Link

There are two links to the aircraft. The first is through the manual R/C controller which, 

in addition to flying the aircraft manually, sets the autopilot modes for autonomous flight. 

If the R/C controller link is lost, the aircraft will switch to RTL mode and return to the 

launch point at the pre-set RTL altitude. The second link is through a 2.4GHz telemetry 

transmitter connected to a PC. If this datalink is lost, the aircraft will continue following 

the mode established by the R/C controller. If the autopilot detects a datalink loss and a 

simultaneous GPS loss, the aircraft will command "Failsafe", and the aircraft will return 

to the home point.

4.6 Aircraft Position Loss

In the event of GPS loss, the GPS signal drops from 6 signals to 5 or less, the Flight 

Control System will automatically control the aircraft to fly back to the home point and 

land. At any point, the pilot will be able to override the autopilot and switch to MANUAL 

mode to recover the aircraft manually.

4.7 Traffic Conflict

The aircraft has no automatic or autonomous means to sense and avoid other air traffic. 

It does not carry a transponder or other traffic management equipment. Sense and 

avoid capability must be provided by the pilot and visual observer. If an air traffic conflict 

arises, the pilot must intervene to direct the aircraft away from the conflict.

5. Risk Assessment

The risk assessment shown below is designed to place risk values on the hazards listed 

in the previous section. Each hazard is assigned a probability and a severity. Probability 

takes into account the likelihood of the hazard posing a risk to the safety of flight over 
PROPRIETARY INFORMATION-NOT FOR PUBLIC RELEASE

Date: 20150516 Revision: 1.0 Revision:1.0

Page 8 of 11

PROPRIETARY INFORMATION - NOT FOR PUBLIC RELEASE

the entire life of the aircraft. (In this case, an estimate of 1,000 cycles is used for the life 

of the aircraft.) Severity is assigned on a scale of 1 to 10; 1 being the least severe with 

little to no damage to the aircraft, and 10 being the most severe with a high likelihood of 

destroying the aircraft and/or causing injury to persons or damage to property.

1 – Little to no effect on the integrity of the aircraft or overall safety.

2 – Possibility superficial damage to the aircraft, no significant chance of injury. There is 

no discernible risk to property.

3 – Light damage to the aircraft will occur, but is considered to be minor and easily 

fixed. There is a slight possibility of injury. Risk to property is very low.

4 – Damage to the aircraft will occur, and there is a slight risk light injuries will result. 

Risk to property is low.

5 – Moderate effect on safety. Damage to the aircraft will occur and there is a 

reasonable expectation of minor injury or damage to property.

6 – Significant effect on safety. Damage will occur to the aircraft. There is a reasonable 

expectation of moderate injury and damage to property.

7 – Significant effect on safety. Damage will occur to the aircraft. Severe injury and 

property damage is expected.

8 – Damage to the aircraft will occur. Severe injury and property damage is assured.

9 – Damage to the aircraft will occur. Very high likelihood of loss of life or significant 

property damage.

10 – Damage to the aircraft will occur. Property will be severely damaged. Serious injury 

and/or death is likely.

The hazard's risk is calculated by multiplying its severity by its probability. For example, 

a hazard with a severity of 2 and a probability of 50% would yield a risk of 1, a LOW 

risk. Values from 0.01 to 3.34 constitute LOW risk. Values from 3.35 to 6.67 are 

considered MODERATE. Values greater than 6.67 are HIGH risk.
PROPRIETARY INFORMATION-NOT FOR PUBLIC RELEASE

Date: 20150516 Revision: 1.0 Revision:1.0

Page 9 of 11

PROPRIETARY INFORMATION - NOT FOR PUBLIC RELEASE

RISK ASSESSMENT

HAZARDS

PROBABILITY (1-100%)

SEVERITY TO PERSONS OR PROPERTY (1-10)

RISK (PROBABILITY x SEVERITY)

LOW, MODERATE, OR HIGH

RISK ASSESSMENT

HAZARDS PROBABILITY 

(1-100%)

SEVERITY TO 

PERSONS OR 

PROPERTY (1-

10)

RISK 

(PROBABILITY x 

SEVERITY)

LOW, 

MODERATE, 

OR HIGH

1. Structural Failure 10% 5 0.5 LOW

2. Flight Control Malfunction 10% 5 0.5 LOW

3. Autopilot Malfunction 10% 5 0.5 LOW

4. Power Plant Failure 30% 3 0.9 LOW

5. Lost Command Link 80% 2 1.6 LOW

6. Aircraft Position Loss 75% 2 1.5 LOW

7. Traffic Conflict 10% 6 .6 LOW

Due to the aircraft's lightweight construction in addition to its operational context, the 

risk to persons or property is low. (Note: 14 CFR 25.631 requires that transport aircraft 

must ensure "continued safe flight and landing of the airplane after impact with an 8-

pound bird" which is very close to the weight of the DJI.)

6. Control Measures and Implementation

This section lists the operational control measures used to mitigate risks associated with 

the hazards defined in previous section.

6.1 Structural Failure

In order to prevent a structural failure, the aircraft will be visually inspected before every 

flight. In addition, a detailed Full Airframe and Sensor Inspection will be conducted after 

every 10 flight hours. The details of this inspection are included in the DJI Inspection 

and Maintenance Manual.
PROPRIETARY INFORMATION-NOT FOR PUBLIC RELEASE

Date: 20150516 Revision: 1.0 Revision:1.0

Page 10 of 11

PROPRIETARY INFORMATION - NOT FOR PUBLIC RELEASE

6.2 Flight Control Malfunction

In order to prevent flight control malfunction, the aircraft will be visually inspected before 

every flight. In addition, a detailed Full Airframe and Sensor Inspection will be 

conducted after every 10 flight hours. The details of this inspection are included in the 

DJI Inspection and Maintenance Manual.

6.3 Autopilot Malfunction

In order to prevent an autopilot malfunction, the aircraft will be checked for proper 

stability control inputs prior to every flight. In addition, a detailed Full Airframe and 

Sensor Inspection will be conducted after every 10 flight hours. The details of this 

inspection are included in the DJI Inspection and Maintenance Manual.

6.4 Power Plant Failure

In order to limit the effects of a power plant failure, the aircraft will be flown within 1/2 

mile of the Return to Launch location at all times. This will allow the pilot to maintain 

visual contact with the aircraft and attempt a forced landing or direct the aircraft away 

from persons or property on the ground.

6.5 Lost Command Link

In order to reduce the risk of a command link, the aircraft will remain within 1/2 mile of 

the pilot (and the R/C transmitter) at all times. The RTL altitude will be set to 100' AGL 

in order to improve the likelihood of reestablishing the command link while the aircraft is 

loitering. The pilot will carry an additional transmitter battery at all times.

6.6 Aircraft Position Loss

In order to limit the effects of a GPS, the aircraft will be flown within 1/2 mile of the home 

point location at all times. This will allow the pilot to maintain visual contact with the 

aircraft and attempt to recover the aircraft manually and direct the aircraft away from 

persons or property on the ground. Since an aircraft in an autonomous mode will 

immediately revert to dead reckoning for navigation; attitude, compass, and pitot/static 

systems should be checked with a Full Airframe and Sensor Inspection after every 10 

flight hours. The details of this inspection are included in the DJI Inspection and 

Maintenance Manual.
PROPRIETARY INFORMATION-NOT FOR PUBLIC RELEASE

Date: 20150516 Revision: 1.0 Revision:1.0

Page 11 of 11

PROPRIETARY INFORMATION - NOT FOR PUBLIC RELEASE

6.7 Traffic Conflict

In order to reduce the probability of a traffic conflict, the Aero will be flown with a pilot 

and visual observer. The pilot will maintain primary responsibility to position the aircraft 

and will keep visual contact with the aircraft at all times. The visual observer will assist 

the pilot, by scanning the area for other air traffic. In order to ensure the aircraft stays 

within visual range, the aircraft will only be flown during day-VMC conditions and will 

remain within 1/2 mile of the flight crew at all times. The visual observer will stay within 

voice range of the pilot and call out the position of any air traffic observed. In addition, 

the crew will file a NOTAM no more than 48 hours prior to any commercial operations, 

in order to notify other pilots that a UAS will be operating in the area.