CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 1 / 31 

# J ustification of airworthiness and

safety assessment

**Version Date**  **Description Author** 

V 1.0 23.12 .2013 Technical documentation Sense Fly

V2.0 04.04.2014 Correction SenseFlyCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 2 / 31 

## Table of content

1 INTRODUCTION

................................ ................................ ................................ ................................ ........ 4

2 AIRCRAFT SEGMENT

................................ ................................ ................................ .............................. 4

2.1 A IRFRAME

................................ ................................ ................................ ................................ ................. 4

2.1.1 Structure

................................ ................................ ................................ ................................ ............. 4

2.1.2 Composition

................................ ................................ ................................ ................................ ....... 5

2.1.3 Load analysis

................................ ................................ ................................ ................................ ..... 5

2.1.4 Technical information

................................ ................................ ................................ ........................ 5

2.1.5 Performance characteristics

................................ ................................ ................................ .............. 6

2.2 P ROPULSION S YSTEM

................................ ................................ ................................ ................................ 6

2.3 E LECTRICAL S YSTEM

................................ ................................ ................................ ................................ 7

2.4 F LIGHT CONTROL SURFAC ES AND ACTUATORS

................................ ................................ .......................... 8

2.5 P AYLOADS

................................ ................................ ................................ ................................ ................. 9

3 CONTROL AND COMMUNIC ATION SEGMENT

................................ ................................ ............... 9

3.1 A VIONICS

................................ ................................ ................................ ................................ .................. 9

3.2 N AVIGATION

................................ ................................ ................................ ................................ ........... 10

3.3 UA F LIGHT C ONTROLS

................................ ................................ ................................ ............................ 10

3.4 A UTOPILOT

................................ ................................ ................................ ................................ .............. 11

3.5 C OMMUNICATION AND CON TROL

................................ ................................ ................................ ............ 11

3.5.1 Architecture of the command and communication system

................................ ............................... 11

3.5.2 Lost Link and Flight Recovery

................................ ................................ ................................ ......... 13

3.5.3 Control Station

................................ ................................ ................................ ................................ . 13

3.5.4 Control frequencies

................................ ................................ ................................ .......................... 14

3.6 G ROUND S UPPORT E QUIPMENT

................................ ................................ ................................ ............... 15

4 PROCESSES AND PROCED URES

................................ ................................ ................................ ......... 15

4.1 C ONFIGURATION M ANAGEMENT

................................ ................................ ................................ ............. 15

4.2 S OFTWARE M ANAGEMENT

................................ ................................ ................................ ...................... 15

4.3 C ONTINUING AIRWORTHIN ESS

................................ ................................ ................................ ................. 15

5 OPERATIONS

................................ ................................ ................................ ................................ ............ 16

5.1 N ATIONAL A IRSPACE S YSTEM (NAS) I NTEGRATION AND I NTERACTION

................................ ................. 16

5.2 F LIGHT P HASES

................................ ................................ ................................ ................................ ....... 16

5.2.1 Pre

- flight / taxi operations

................................ ................................ ................................ ............... 16

5.2.2 Take

- off

................................ ................................ ................................ ................................ ............ 17

5.2.3 Flight

................................ ................................ ................................ ................................ ................ 17

5.2.4 Landing/recovery

................................ ................................ ................................ ............................. 18

5.2.5 Post flight

................................ ................................ ................................ ................................ ......... 18

5.3 E MERGENCIES AND PROCE DURES

................................ ................................ ................................ ............ 18

5.3.1 Complete loss of control link

................................ ................................ ................................ ........... 18

5.3.2 Engine Failure

................................ ................................ ................................ ................................ . 18

5.3.3 Propeller Loss

................................ ................................ ................................ ................................ .. 19CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 3 / 31 5.3.4 Loss of GPS

................................ ................................ ................................ ................................ ...... 19

5.3.5 Loss of heading information

................................ ................................ ................................ ............ 19

5.3.6 Pitot system malfunction

................................ ................................ ................................ .................. 19

5.3.7 Servo malfunction or loss

................................ ................................ ................................ ................. 19

5.3.8 Payload malfunction

................................ ................................ ................................ ........................ 20

5.3.9 Loss of Autopilot

................................ ................................ ................................ .............................. 20

5.4 M ANUALS

................................ ................................ ................................ ................................ ................ 20

5.5 O RGANIZATIONAL C ONSIDERATIONS

................................ ................................ ................................ ...... 20

5.5.1 Training

................................ ................................ ................................ ................................ ............ 20

5.5.2 Maintenance

................................ ................................ ................................ ................................ ..... 20

6 ANNEXES

................................ ................................ ................................ ................................ ................... 21

6.1 A NNEX 1: 3

- V IEW D RAWINGS OF THE E B EE

................................ ................................ ............................ 21

6.2 A NNEX 2: I N

- F LIGHT SAFETY ACTIONS

................................ ................................ ................................ .... 22

6.2.1 In

- flight manual safety actions

................................ ................................ ................................ ......... 22

6.2.2 In

- flight automatic safety actions

................................ ................................ ................................ ..... 22

6.3 A NNEX 3: A REAS OF OPERATIONS

................................ ................................ ................................ ........... 24

6.4 A NNEX 4: S AFETY ANALYSIS

................................ ................................ ................................ ................... 25

6.4.1 Considerations about risk related to ground impacts

................................ ................................ ...... 25

6.4.2 Considerations about the probability of mid

- air collisions

................................ ............................. 26

6.4.3 Pre

- flight tests

................................ ................................ ................................ ................................ .. 27

6.4.4 Take

- Off vetos

................................ ................................ ................................ ................................ .. 28

6.4.5 References

................................ ................................ ................................ ................................ ........ 29

6.5 A NNEX 5: C OMMAND AND CONTROL

................................ ................................ ................................ ....... 30CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 4 / 31 

## 1 Introduction

SenseFly is a Swiss company founded at the end o f 2009. The company manufactures light weight

fixed

- w ing UAVs (500

- 75 0 grams) for mapping applications and develops eMotion

, a very powerful

software package for flight simulation and flight monitoring

.

In June 2012, SenseFly joined the Parrot group, the manufacturer of the smartphone

- driven AR

Drone quadcopters for the hobby market. Within Parrot , senseFly i s now leading the development of

drones for professional use.

S enseFly masters all aspects of mini

- drone development (from hardware to software) and is

therefore capable of achieving very high level s of system integration.



## 2 Aircraft s egment

2.1 Airframe

2.1.1 Struc ture

The eBee (see figure below) is a ready

- to

- launch UAV based on fixed

- wing architecture. This simple

and robust design provides aerodynamic effi ciency, manoeuvrability and an excellent gliding ratio

.

**Figure 1** : Architecture of the eBeeCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 5 / 31 T he four main characteristics of the eBee are :

a. Very light weight

The eBee is so light that the operator can launch it by hand and let it land on almost any surface

without requiring a parachute or landing net (belly land). Its low impact energy ( 38 J In case of a

controlled emergency landing ) also significantly reduces the risk of third

- party collision damage (see

Annex 4 , safety analysis ) . The wing is made of flexible foam with no sha rp or hard edges and almost

no internal strengthening structure.

b. Electric Powered

The eBee is electric powered . A brushless engine technology makes it silent and reliable. The

propeller is attached with a rubber band to the body of the plane so that it can easily flex away in

case of contact or crash with any object.

c

. Semi

- Automatic flight

The artificial intel ligence incorporated within the eBee autopilot system continuously analyz es data

from the Inertial Measurement Unit and from the onboard GPS and takes care of all the aspects of

the flight, even in the absence of radio connection with the laptop. Take

- off and landing phases are

also fully controlled by the autopilot.

d. Manual control

Additionally, the eBee provides an override capability that allows the operator to take manual

actions during the flight (Go to Home, Go Land, Hold and Resume the mission) an d also suspend

automated operations and take manual control of the aircraft should it become necessary to

respond emergent circumstances, thanks to the remote controller provided with the system.

2.1.2 Composition

W ings are composed of 25g/litre injected e xpanded polypropylene (EPP) and the fusel age is

composed of 35g/lit r e injected EPP. The leading edge protection is thermo

- formed polycarbonate.

Additional parts are made of injected fibre

- reinforced ABS plastic.

The electronic components are installed ins ide the fuselage in dedicated cavities to ensure proper

positioning . T he EPP part s and carbon spars are manually glued with EPP glue.

2.1.3 Load analysis

In

- flight testing of s truct ural resistance has been conducted by experienced pilots. The airframe was

subjected to the maximum possible aero dynamical load and airspeeds exceeding two times the

regular flight envelope. Results showed that the structure is capable of withstanding all possible

loads and no flutter arise s throughout the flight envelope and bey ond.

2.1.4 Technical information

• Wingspan: 96 cm

• Fuselage length: 60 cmCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 6 / 31 • Central body: 40 cm x 16 cm x 6 cm

• MTOW (Maximum Take

- Off Weight): 750 g (including battery

, camera payload and all

options )

• Empty weight (without battery, camera payload and options): 410 g ± 2 0 g

• 7’ ’ x 5’ ’ pusher propeller

2.1.5 Performance characteristics

• Maximum altitude : tested up to 17 000 feet ASL

• Nominal endurance with standard payload, no wind and 20°C : 50 min

• Airspeed :

- Stall speed: 9 m/s

- C ruise speed : 11 to 25 m/s

- Never

- exceed speed : 28 m/s

• Maximum rate of climb: 4 m/s

, and 8 m/s during take

- off, emergency ground avoidance and

emergency climb procedure.

• Maximum rate of desce nt: 4 m/s

, and 8 m/s during emergency descent procedure

• Maximum bank angle: 60 

### °

• Turn rate limits: 80 °/s

• Maximum Headwind. 12 m/s

• Maximum Tailwind (launch/recovery) 12 m/s for launch, 12 m/s for recovery on grass, 5 m/s

on hard surface

• Maximum Crosswind. 12 m/s

• Maximum Gusts. 15 m/s

• Datalink range: 3

- 5 km

Weather l imitations:

The eBee runs in light rain and light snow , with wind up to 12 m/s (27 mph)

. No visibility/lighting

restrictions apply beyond within

- line

- of

- sight operation requirements. The eBee has been tested in

the

- 15° to 35°C OAT range (5 ° F to 95 ° F) . No de

- icing system is implemented so operat ions in icing

conditions must be avoided.



### 2.2 Propulsion System

The eBee propulsion system is based on a brushless DC motor with a dedica ted electronic

controller and a 2150 mAh 3S

- cells Lithium

- Polymer (LiPo) battery.

The maximum input electric power for the motor is 160 W. It provides a thrust

- to

- weight ratio of more

than 0.9 (static thrust of about 630 g ram f orce ), which allows for steep, hi gh

- performance take

- off s

. The electric current draw is 2 to 16 A. The LiPo batte ry is the sole source of electric current

.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 7 / 31 The motor is attached to the body of the aircraft with screws.

The main screen of the flight management software eMotion 2 displays :

- Raw voltage level

- Estimated percentage of battery remaining (based on battery mod el, current voltage, integrated

power used, etc

... )

- Ratio of estimated remaining energy versus the estimated energy required to reach the Home

point.



### 2.3 Electrical System

The LiPo battery provides between 9 and 12.6V to the system. A 3.3V bus, pro vided by the

autopilot, powers the electronics and radio

- modem. A 5V bus, provided by the motor controller,

powers the RC receiver and the control surfaces servo.

**Figure 2**  : Cabling schematics eBeeCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 8 / 31



### 2.4 Flight control surfaces and a ctuators

The eBee is equipped with two control surfaces . The p itch rate is controlled with both control

surfaces in the same direction. Roll rate is controlled by orienting the control surfaces in opposite

directions. The yaw is passively stabilized by the winglets a nd the wing leading edge drag (flying

wing).

The control surfaces are made of EPP and are connected to the wings. A thinner section of the EPP

material acts as a hinge between the wings and the flight surfaces.

Failure may occur:

- A t a local level on the servos;

- A t a local level on the link level between th e servo and the control surface;

- A nd at a global level

– by break ing the control surface itself (e.g. EPP material tearing apart).

**Figure 3**  : Flight surfaces of the eBee (in yellow)

In case of servo failure, the autopilot tries to keep the roll angle with the other servo.

If the servo fails in 'down' position, it is likely that the eBee will dive and accelerate. If the aircraft

achieves airspeed of 30 m/s , over

- speed condit ion is detected and the motor is put in a reverse

mode to slow down the aircraft. The reverse mode also makes a high noise that can alert any

potential people on the ground.

If the servo fails in 'level' or 'up' position, the aircraft may be able to continue to fly but with a

degraded behaviour, likely loosing altitude in curves or having troubles to turn. If the aircraft cannot

turn enough and leaves the working area, the motor is turned off to minimize the impact energy and

the aircraft glides towar d the ground.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 9 / 31 A critical "Servo failure" message is sh own in eMotion and a ringing alarm is raised when a servo is

stuck or malfunctioning

. Other warnings may appear such as "Cannot maintain altitude", "Roll

instabilities" or "Pitch instabilities".



### 2.5 Payload s

(1) Internal.

150

- 170 grams camera protected by the EPP body of the aircraft.

(2) External: n one



## 3 Cont rol and c ommunication s egment

3.1 Avionic s

The eBee avionics is composed of the following components:

• 1 autopilot integrated in the body of the aircraft

, which includes the central processing unit, a

GPS receiver (with integrated antenna), and the telemetry modem (with an external antenna

visible on the figure 1 ). The central processing unit PCB is fitted with an inertial measurement

unit (accelerometer, gy rometers

, and magnetometer ), a barometer and a differential pressure

sensor.

**Figure 4**  : Autopilot schematicsCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 10 / 31 • 1 P itot probe (visible in the figure 1 ) connected with tubes to the differential pressure sensor.

• 1 RC receiver with a wire antenna integrated in to the fuselage.

• 1 optic al flow sensor pointing downwards for ground proximity detection.



### 3.2 Navigation

The l ocation is given by the GPS (x,y,z) and the barometer (z).

The operator can modify the flight pl an of the eBee at any time , using the flight management

software interface or the remote controller . Additionally, the operator can instruct the eBee to hold

(loiter) at its current position, return to the Home waypoint, initiate the planned land ing procedure

and immedi ately land in a spiral approach at the current location (see the User Manual for further

details).

The autopilot controls the altitude and trajectory of the eBee . If a loss of altitude due to loss of thrust

(broken propeller, motor failure, etc.) is detec ted, the eBee will initiate an emergency glide landing

towards the Home waypoint (see the User Manual for further details).

There is no redundant navigation system implemented in the eBee other than the capability to

switch to the manual mode

. Should the autopilot malfunction, t he operator can switch to this manual

mode and gain direct access to the control surface through the remote control.

Loss of heading:

- When the wind is too strong and the ground speed cannot be held, the heading

information might be temporarily lost and the aircraft will go backwind to regain the heading

information.

- When the GPS fails, the aircraft will start the emergency GPS

- lost procedure and will

hold a constant bank angle while gliding to the ground (motor off).

If the GP S position is no longer available, which makes it impossible for the eBee to know where it is

and thus to navigate, an emergency action is taken automatically: the eBee turns off its motor, sets

a bank angle and glides in a large circle towards the ground, using the altitude data from the

barometer. If there is a strong wind, the eBee may be pushed far from its current position. If a GPS

position is re

- acquired the eBee will abort the landing procedure and go to the Home waypoint.

There is an automatic pr e

- flight test to check the GPS signal and the barometer values . If there is an

error with the GPS, the barometer or inconsistent values, the aircraft is prevented from taking

- off. If

the error happens while in flight , the aircraft will use GPS altitude onl y and will go to the Home

waypoint. If both the GPS and the barometer are malfunctioning, the eBee will start a controlled

emergency landing procedure.



### 3.3 UA Flight Controls

The control surfaces are each actuated by a servo. The two servos are both activated by the

autopilot through a regular RC interface with variable length pulse from 1 to 2ms, every 20ms

.

The operator can provide live input through the drag

- and

- drop interface of the eMotion software

Possible in

- flight adjustments include the addition and removal of waypoints, as well as theCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 11 / 31 modification of waypoints position . Alternatively, manual take

- over is possible through a regular RC

remote control.



### 3.4 Autopilot

The autopil ot is designed by senseFly and is not a COTS product

.

When assembled, t he autopi lot is manually installed in to the dedicated slot of the EPP fuselage. Its

alignment with the airframe is calibrated d uring the manufacturing process.

In the “ automatic ” mode, the autopilot has full, high

- level control of the eBee. The only input is the

flight plan. This flight plan is always stored on the autopilot

. Thus, all commands issued keep the

aircraft within structural limits. All autopilot commands (airspeed, pi tch angle and roll angle) are

bounded.

• Airspeed: 10.5

- 25 m/s.

• Roll:

- 60

- +60 degrees.

• Pitch:

- 15

- +30 degrees.

In the full manual mode, the pilot has full authority on the control surface s and no input limitation is

done by the autopilot.

I n order t o test the autopilot, software in the l oop simulations are performed. Indeed, t he software

simulator uses the same code for the high

- level logi cs than the real aircraft. This allows us to test all

the logics in simulation before flying . Moreover, real flig ht tests on dedicated platforms are

conducted at our test center in Switzerland.



### 3.5 Communication and control

3.5.1 Architecture of the command and communication system

The fol l o wing diagram illustrate s the communication between the various subsystems.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 12 / 31 **Figure 5**  : Architecture of the command and communication system

The spectrum used for the communication between the ground control station and the aircraft is the

ISM 2.4 GHz band. A unique, random ID is used to pair the ground modem and the air modem. No

encryption is used. All ISM

- based equipment (Wi

- Fi, etc.) may interfere with the radio link. Thanks to

the spread

- spectrum technology, these interferences have only a limited effect (one packet)

. Nothing in particular is made to mitigate these interferences.

The modem estimate s link strength based on RSSI and displays it on the ground datalink modem

with 3 LEDs (all LEDs switched on for the maximum signal strength) . The ground station software

display s a link strength percentage based on the rate of successfully transmitted packet s

.

The only redundant link is the manual override RC link.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 13 / 31 A working area radius and flight ceiling are defined. The eBee flight will be bounded by t hese

parameters and the aircraft will return to the Home waypoint if the flight plan leads it beyond the

working zone. It prevents the eBee from going bey o nd the communication range.

The eBee will then not even start its mission (go to the first waypoint) if one of the pre

- programmed

waypoints is outside of the working area.

However t he eBee doesn’t rely on the ground station to operate. If the operator chooses so (this is

enabled by default), the eBee will fly to the Home waypoint after 30s of not receiv ing any packet

from the ground, in order to re

- establish the communication link.

A ntenna masking during turns and pitch angles has not been detected. Communications are also

unaffected by atmospheric attenuation including precipitations.

3.5.2 Lost Link and Flight Recovery

In order to determine if the aircraft is experiencing a lost link situation, the autopilot check s that n o

packet s have been received during a certain period of time

. The ground control station displays then

a red warning indicating that the communication link is lost.

In case of a lost link situation, the f light continues as planned. But the operator can also program the

eBee (in eMotion 2) to automatically return to the Home Point if that scenario happens.

The Home waypoint is defined by the user during flight planning using eMotion . When the eBee

reaches this point, it will loiter at this location until the battery is low

– at which point it will land

according to the planned procedure.

No flight recovery mechanism is implemented beyond adequate flight/navigation behaviour in

response of detected problem

.

3.5.3 Control Station

The control station consists of a laptop or tablet and the datalink USB modem. The laptop/tablet is

used to run eMotion 2, the flight management software developed by SenseFly.

On the main screen of eMotion 2, there is a Flight Monitoring tab displaying the flight information

(User Manual section 5.5).CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 14 / 31 **Figure 6**  : Display of flight parameters in eMotion 2

On the main screen, the pilot can accurately determine the position of the aircraft, b ased on the

GPS information (1

- 3 meters) for the (x, y) coordinates and barometer (10 cm accurate) for the

altitude

. For the attitude, the inertial measurement unit has a precision of 3

- 5 degrees.

Several commands are safeguar ded from inadvertent activation, like LAND NOW (3 clic ks are

required). Some other commands require acknowledgment of a warning message.

Any inadvertent manipulation of the ground station software may cause an undesirable outcome.

For example, a n inadvertent waypoint displacement may cause the eBee to fly to an undesirable

location.

The ground control station software runs on Windows only

. T he operator is responsible for providing

primary and backup power to the ground control station. The datalink modem is powered by the

laptop or tablet via a USB connectio n.

3.5.4 Control frequencies

The bi

- directional telemetry link used to connect the ground station and the eBee is based on

modem which implements a c ustom 2.4 GHz FHSS, 100 mW data link (FCC Part 15.247, IC

RSS210, CE).CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 15 / 31



### 3.6 Ground Support Equipment

No equipment is used but the laptop computer or tablet and the USB ground datalink modem.



## 4 Processes and Procedures

4.1 Configuration Management

All changes in the hardware configuration are notified by a change in the version of t he eBee (EB

01

- xxx

- xxx ..... EB 03

- xxx

- xxx ). These changes are obviously logged internally with a tracking file

for each unit produced. Quality of each manufactured eBee is ensured by one or more test flights

with post

- analysis of the flight data recorded by the different sensors.



### 4.2 Software Management

Users are automatically notified to the availability of software updates when the ground control

software is launched.

The ground station software verifies the embedded firmware upon connection to the eBee in order

to ensure embedded software/ground software compatibility.

Most embedded software is written in C. Ground control station software is written in C++ and is

based on the Qt framework.



### 4.3 Continuing airworthiness

Reliability is asserted by extensive test flight during all phases of the development. Each drone

assembled at senseFly goes through several quality and inspection tests (ground and in

- flight tests)

to ensure conformity of the product as defined in the specifications. Each drone is tied with a "quality

control" document that follows the drone during its manufacturing process. This document is then

archived at senseFly.

SenseFly has also a servicing struct ure (after sales support team)

, which provides support to clients

and monitors product quality control. In case a defa ult is found, the support team backs the problem

so that the Production & Industrialization department takes the necessary action in terms of quality

or design (continued airworthiness). It is possible to do that internally because SenseFly masters all

asp ects of the design, from hardware to software. The end

- users are notified directly when they use

the flight manage ment software or by email.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 16 / 31 

## 5 Operations

5.1 National Airspace System (NAS) Integration and Interaction

The eBee has a high

- visibility paint scheme on the blisters (yellow colour) that enables other pilots

to see and avoid the eBee and enables the observer(s) to visually acquire and track the UA

. No specific support for A TC communication is implemented since the eBee s tays usually in Class G

Airspace.

No specific support for pilot

- to

- pilot communication is implemented.

No automatic method is implemented for sense

- and

- avoid of airborne objects. A working area radius

can be defined in order to make sure that the eBee wi ll not go beyond the line of sight of the

operator. The eBee is also equipped with a ground proximity sensor that will detect ground proximity

and initiate ground avoidance when reaching a height over ground of 30m or less. This feature can

be disabled by the operator.



### 5.2 Flight Phases

5.2.1 Pre

- flight / taxi operations

1. Weather check

2. Flight planning with eMotion2 (see Part 1 and 4 of the User Manual) on the field

.

For cached map data (OpenStreet Map, Bing, Ovi), the operator has to load the background map

manually. For online maps (Google Map), the map is always displayed based on the latest mapping

data available online.

3. Programming of the linear landing according to the wind direction

4. Aircraft inspection

Each operator shall inspect (where applica ble) the following components of the UAV:

(a) Body: Fabric and skin

- for deterioration, distortion, and other evidence of failure;

(b) Flight controls

- for deterioration or improper installation;

(c) Batteries

- for improper installation or deformation;

(d) Engine section

- for deterioration;

(e) Propeller section (blades and rubber bands)

- for cracks, nicks, binds or deterioration;

(f) All components of the wings, body

- section assembly and flight surfaces for poor general

condition, fabric or skin dete rioration, distortion, evidenc e of failure, and insecurity of attachment;

(g) Camera system for improper installation, poor general c ondition, defects, and insecure

attachment;CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 17 / 31 (h) Radio modem and electronic equipment, sensors (Pitot)

- for improper installation and/or cracks.

5.2.2 Take

- off

The motor is started by a specific shaking procedure (User Manual section 2.4). The motor is first

started at very low power and current draw is monitored to detect if the propeller is free from any

object. If this is the case, the motor is slowly ramped up to full power. At this point, the operator may

launch the eBee.

Step 1 : Orient horizontally and against the wind. Orient yourself against the direction of the wind,

and confirm that the take

- off direction in front o f you is free of obstacles. Firmly grasp the eBee with

both hands, one hand on the front of each wing as shown in the figure. Hold the eBee horizontally

with the nose pointed against the wind and level wings

Step 2 : Switch the motor on

Shake the eBee back and forth 3 times longitudinally (within approx. 3 seconds) to begin the motor

power

- up sequence. The status LED will pulse blue until the motor is at full power and ready for

take

- off.

Step 3 : Launch the eBee

Once the motor is at full power the status L ED will blink green. Orient the eBee with approximately

10 degrees nose up and level wings. When the angle is correct the status LED will turn solid green,

indicating that the eBee is ready for take

- off. Launch the eBee with a gentle push by walking 1

- 2

st eps forward while releasing it with both hands in a purely forward motion. After take

- off, the eBee

tries to maintain its initial direction by keeping its wings level with full thrust until reaching the take

off tran sition height, by default 20 meters

.

At this point, it will switch into waypoint navigation mode and fly towards the Start waypoint. Once

it reaches the Start waypoint location and height the eBee will circle around the waypoint 1

- 2 times

to estimate the wind and calibrate its sensors before st arting the mapping mission

5.2.3 Flight

A laptop and the USB datalink modem are needed to connect to the eBee, check its status and

modify its flight plan. The drag

- and

- drop interface offered by the ground control station software

(eMotion 2) allows the operator to modify the trajectory of the eBee in real

- time.

By default, the eBee flies autonomously and does not need the provided remote controller to be

operated. However, by using the remote control, it is possible to override the eBee autopilot by

swi tching to one of two available manual modes: Full Manual or Assisted Manual.

In Full Manual mode the sticks of the remote controller directly set the motor power and the angle of

the ailerons of the eBee.

In Assisted Manual mode the sticks of the remote control are used to set the speed, turn rate and

climb or sink rate.

Turning on the remote controller will cause the eBee to change to either Assisted Manual or FullCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 18 / 31 Manual mode, depending on the mode set on the Ground Control Station in the Flight Parame ters

tab. To warn the operator that the eBee is operated in Manual / Assisted Manual mode, a

continuous sound is emitted by the GCS. A visual yellow warning ind icates that the aircraft is in

manual mode

.

2. Turning off the remote control will cause the eB ee to return to the last autonomous operation

mode it was in before Manual mode was enabled, or a safe flight phase (if manual control was

enabled during a critical flight phase).

Note: Ensure that the "Ignore RC signals" option in the Flight Parameters t ab is unchecked;

otherwise the eBee will ignore the commands from the remote control and remain in autonomous

operation mode

5.2.4 Landing/recovery

No equipment is required. The eBee offers two type of landing procedure: circular landing (based on

GPS and barometer) and linear landing with a 20

- degree slope. An optical ground sensor

technology allows to flare when approaching the ground and to improve landing precision for the

linear landing.

5.2.5 Post flight

C leaning and afte r

- flight maintenance operations (see document “Maintenance and procedures” )



### 5.3 Emergencies and procedures

5.3.1 Complete loss of control link

If the option is enabled, t he eBee flies towards the Home waypoint at an altitude defined by the

Home waypoint's "Change altitude parameter" (by default, set to "Highest").

User action: Try to improve radio signal quality by following the instructions in section "Improving

radio si gnal communication" of the user manual.

5.3.2 Engine Failure

The eBee attempts to re

- start the electr ic motor. If the first attempt fails a “ Critical Failure:

Motor malfunction ” warning is announced and the eBee starts an emergency landing procedure.

User action: If the error disappears, land as soon as possible and perform Check 1 in section

"Full airfr ame and sensor inspection". Ot herwise, the aircraft will land automatically.

If the motor is not working even after an attempted re

- start commanded by a "Motor malfunction" In

flight warning, the eBee orients itself in the direction of the Home waypoint a nd glides towards the

ground while continuously trying to re

- start the motor. If the eBee reaches the Home waypoint withCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 19 / 31 sufficient altitude, it will enter the landing circuit without power and will re

- adapt the base waypoint's

position depending on its c urrent altitude.

If motor re

- start is successful the eBee cancels the landing and flies towards the Home waypoint at

an altitude defined by the Home waypoint's Change altitud e parameter (by default, set to "Highest").

5.3.3 Propeller Loss

In case of a propeller loss, the eBee will detect a motor failure and start the same procedure as the

engine failure.

5.3.4 Loss of GPS

The GPS position is no longer available, which makes it impossible for the eBee to know where it is

and to navigate. The eBee will turn off its motor, sets a constant bank angle and glide in a large

circle towards the ground. If there is a strong wind the eBee may be pushed far from its current

position. If a GPS fix is re

- acquired the eBee will abort the landi ng procedure and go to the Home

waypo int.

5.3.5 Loss of heading information

The eBee navigation is degraded and will likely result in a turn in the direction of the wind (back

wind) to regain a ground speed and thus a GPS course information. However, the eBee

automatically adapt its airspeed command to avoid having a low or null ground speed. This only

happens if the wind is much stronger than the maximum wind allowed (> 18 m/s), or if the eBee is

already in Critical failure state where the motor does not output thrust (motor failure, empty ba ttery,

GPS loss).

5.3.6 Pitot system malfunction

The aircraft will use GPS altitude only.

5.3.7 Servo malfunction or loss

In case of servo failure, the autopilot tries to keep the roll angle by using the other servo.

If the servo fails in 'down' position, it is likel y that the eBee will start to dive and accelerate. If

reaching 30 m/s of airspeed, over

- speed condition is detected and the motor is put into reverse

mode to slow down the aircr aft. The reverse mode is also noisy which can alert any potential people

on the ground.

If the servo fails in 'level' or 'up' position , the aircraft will possibly be able to continue to fly but with a

degraded behaviour

, including loss of altitude in curves and inhibited turn ing ability . If the aircraft

cannot turn enough and leaves the working area, the motor is turne d off to minimize impact energy

and the aircraft glides toward t he ground

.

Moreover , there is also a detection of servo malfunction. The autopilot correlates the output

commands to the ailerons (expected positions) with the measured rotation rates (real positions

found from simple model). When a servo fails, this error becomes huge and the autopilot is able to

tell which servo is more likely to have failed.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 20 / 31 5.3.8 Payload malfunction

If the payload stops working, a warning appears on the ground control station and if s et so, the

aircraft will return to the Home waypoint.

5.3.9 Loss of Autopilot

- Partial:

If the autopilot experiences a hard

- fault due to external factors (el ectrical discharge) or due to a

code issue, it w ill enter a special section of the code: Everything is stopped except direct manual

control of the ailerons with the remote controller. The motor is switched off.

- Total:

If the autopilot shuts down (electrical failure), the eBee will stop controlling th e ailerons

. The motor

will turn off and the aircraft will start an uncontrolled descent or spin.



### 5.4 Manuals

• U ser manual which includes:

- 1 section with all of the aircraft limitations

- 1 section with all failures that can occur during the pre

- flight tests and flights



### 5.5 Organizational Considerations

5.5.1 Training

See document “training”

5.5.2 Maintenance

See document “Maintenance and procedures”CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 21 / 31 

## 6 Annex es

6.1 Annex 1 : 3

- View Drawings of the eBeeCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 22 / 31



### 6.2 Annex 2 : In

- Flight safety actions

In order to guarantee the safety of a mission, SenseFly has integrated safety actions as part of the

autopilot and software pre

- flight tests, as well as specific in

- flight pr ocedures. The se fully automatic

procedures are undertaken either by the operator (by clicking the matching button) or the autopilot

(when sensors measure critical values of different parameters).

6.2.1 In

- flight manual safety actions

During a flight, the operator can undertake the following actions by clicking the matching button:

1. Hold : the UAV stops its mission and flies around its current position

2. Resume : the UAV resumes its flight from the point where it stopped

3. Go to H ome/Start waypoint : the mission ends and the UAV goes back t o its Home position (or

the start position)

4. Emergency landing : the aircraft gently lands at the current position , with the minimum possible

vertical speed (circular landing).

6.2.2 In

- flight automatic safety actions

The autopilot is continuously monitoring the status of its sensors and will activate emergency

procedures as soon as any anomaly is detected. In the event of a failure that makes it impossible to

reach the home location, an emergency landing procedure is i nitiated using a low

- velocity gliding

mode with engine off.

- Empty battery: When the battery is empty (<5%), the eBee turns off its motor and glides towards

the ground in the direction of the Home waypoint.

This critical failure is always preceded by a low battery warning, w hich leads the aircraft to the H ome

waypoint. Thus, if the aircraft is not too far away, it is able to land safely on the H ome waypoint.

- Low battery: When the batt ery is low (<20%), a warning appears in eMotion 2 and the eBee flie s

back to the Home waypoint.

- Loss of GPS signal : When the GPS position (or ‘fix’) is no longer available, which makes it

impossible for the eBee to know where it is and thus to navigate, an emergency action is taken : t he

eBee turns off its motor, sets a bank angle and glides in a large circle around its current position. If

there is a strong wind the eBee may be pushed far from its current position. If a GPS ‘fix’ is re

acquired the eBee will abort the landing procedure and resume the mission.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 23 / 31 - Barometer error : The barometer gives abnormal values . The eBee is programmed to go to the

Home point using the altitude given by the GPS to control its approach.

- Battery error : The measurement of the current voltage gives an abnormal value. The eBee is

programmed to go to the Home point

.

- Airspeed error: The measurement of the air speed gives an unexpected value. The eBee is

programmed to go to the Home point

.

- Out of working area : the eBee is out of the flight zone ( Working area r adius defined in eM otion 2).

The eBee is programmed to go to the Home point

.

- Above working area : The aircraft exceeded the maximum flight ceiling of the flight zone. The

eBee is programmed to go to the Home point

- Far out of working area : The aircraft is out of the fl ight zone (defined in eMotion 2), due to strong

wind conditions . The eBee is programmed to start its descent phase toward the Home Waypoint.

- Poor GPS coverage: GPS signal is low (risk of signal loss). The eBee is programmed to go to the

Home point

.

- Wind too strong : the measurement of the wind indicates that it is too strong. The eBee is

programmed to go to the Home point

.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 24 / 31



### 6.3 Annex 3 : Areas of operations

U K Flight approval for VLOS operations

Switzerland Flight approval for VLOS operations

Australia Flight approval for VLOS operations

Canada Flight approval for VLOS operations

USA NMSU COA

AWR certificate (Army Corps of Engineers)

France Flight approval for E

- VLOS operations

Ireland Flight approval for VLOS operations

Denmark Flight approval for VLOS operations

Norway Flight approval for VLOS operations

Germany Flight approval for VLOS operations

Italy Flight approval for VLOS operations

Netherlands Flight approval for VLOS operations

Sweden Flight approval for VLOS operationsCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 25 / 31



### 6.4 Annex 4 : Safety analysis

6.4.1 Considerations about risk related to ground impacts

Early

- flight termination

Early flight termination, either controlled or uncontrolled, will result in ground or water impact. The

diagram below summarizes the different failures that entail flight termination and related actions

taken by the autopilot.

**Figure 4** : Management of critical situations by the autopilot

Under controlled emergency landing the autopilot will control the sp eed and orientation of the

aircraft, thus reducing the probability of injuring people on the ground as well as damages to

property and the aircraft itself. In case of a controlled emergency landing, the airspeed of the aircraft

is close to 10 m/s and the k inetic energy will amount to 38 Joule at MTOW, which can be consideredCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 26 / 31 harmless. In case of an uncontrolled emergency landing (e.g. loss of battery power or servo

- motor

lock), the vertical speed should never exceed 28 m/s, which corresponds to 180 J at MTO W. As a

comparison, a soccer ball weighs about 450 g and can be kicked at up to 50 m/s, which

corresponds to approximately 560 J.

Calculation of the ELOS

A standard way of quantifying the risk level in the aviation industry is through the Expected Level Of

Safety (ELOS) . In the commercial aviation a level of 3.7 · 10

- 7 fatalities on ground per hour of flight

has been reached on average in the USA between 1989 and 2008 [5,6]. The 1309 AMC section of

EASA CS 25 [2] refers to the same order of magnitude (10

- 7 per flight hour) as a maximum

acceptable rate for hazardous events.

The ICAT

- 2005

- 1 report by the MIT International Center for Air Transportation [9] proposes a

method to evaluate the ELOS of UAS in terms of fatalities per hours of operation:

ELOS = (1 / MTBF) · A exp · ρ · P Penetration

With:

ELOS: Equivalent Level of Safety (fatalities / hours of operation)

MTBF: Mean time between failures (hours); e.g. an MTBF of 50 is certainly a worst case

scenario for the eBee;

A exp : Lethal area; for the eBee, A

ex p ≈ 0.04 m 2 based on [9];

ρ : Local population density (average value in the US: ρ = 113 inhabitant/km 2 );

P Penetration : probability of fatality per impact, should be set close to 5% for the eBee according

to [9].

Here is the numerical application using the suggested values above:

EL O S = (1 / 50 h) · 0.04 m 2 · 113 · 10

- 6 m - 2 · 5%

= 4.5 · 10

- 9

The resulting value is typically lower than the one achieved by the commercial aviation, which

denotes a lower risk, even though the MTBF of UAS is known to be smaller than with commercial

aircraft.

6.4.2 Considerations about the probability of mid

- air collisions

Airspace

In general, the operator is responsible for avoiding any collision with other sky users. The risk of

encountering other sky users can be lowered by flying at low altitude (generally <120m orCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 27 / 31 150m/AGL) and far from airports. It is also recommended to contact the local aviation authorities to

be aware of the prevailing rules.

To ensure that the eBee stays in a given area while flying, it is possible to define a working area

radius and a flight ceiling in ground control software, eMotion. Furthermore, the eBee operator can

take manual actions in case an other aircraft enters the zone: e.g. Go to the Home Waypoint, Go the

Start Waypoint, Go Land, Initiate an emergency landing, Hold the mission (and loiter around its

current position).

Analogy with Birds

It is interesting to note that the Airframe Bird Strike Airworthiness Standards (FAR 25) stipulates that

any transport aircraft should be able to withstan d a bird impact corresponding to two to three times

the weight of the eBee

.

6.4.3 Pre

- flight testsCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 28 / 31 6.4.4 Take

- Off veto s

There are several conditions that need to be fulfilled before the aircraft can accept a take

- off order.

The conditions are calculated continuously when in Idle and when the pre

- flight checks are

successful. The list of conditions is the following :

- Low battery.

- Security issue not acknowledged.

- Wings not detected (eBee only).

- USB cable plugged.

- Pitch angle not horizontal.

- Roll angle not horizontal.

- Motor blocked.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 29 / 31 6.4.5 References

1 . Joint JAA / Eurocontrol Initiative on UAVs (2004) A concept for European regulations for civil

unmanned aerial vehicles (U AV). Final Report

2 . European Aviation Safety Agency (EASA) (2007) Certification specification 25 (CS25).

Amendment 3

3 . European Aviation Safety Agency (EASA) (2005) A

- NPA, No. 16/2005, policy for unmanned

aerial vehicle (UAV) certification

4 . Joint Capability Group on Unmanned Aerial Vehicles (2007) STANAG 4671

– Unmanned Aerial

Vehicle Systems Airworthiness Requirements (USAR). draft, NATO Naval Armaments Group

5 . National Transportation Safety Board (NTSB) (2008) Accident database and synop ses. http://www.ntsb.gov/ntsb/query.aspCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 30 / 31 6 . National Transportation Safety Board (NTSB) (2008) Aviation accident statistics.

http://www.ntsb.gov/aviation/Stats.htm

7. Range Safety Group, Range Commander s Council (1999) Range safety criteria for unmanned air

vehicles

– rationale and methodology supplement. Supplement to document 323

- 99

8. Range Safety Group, Range Commanders Council (2007) Common risk criteria standards for

national test ranges: Supplemen t. Supplement to document 321

- 07

9. Weibel RE, Hansman RJ (2005 ) Safety considerations for operation of small unmanned aerial

vehicles in civil airspace. MIT Report No. ICAT

- 2005

- 1 March 2005.



### 6.5 Annex 5 : Command and controlCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version

04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 31 / 31