. PeRKINS COle 

[3rcndan Murphy 

l:3M11 rphy@pcrkinscoic.com 

D (206)359-6 179 

F. (206)3 59-7 179 

May19, 20 15 

Via Ema il a nd Rcgulations.Gov 

Jake J. Troutman 

Program Analyst, Rulemaking 

F /\A Office of Aviation Safety 

Airmen and Airspace Rules Division 

.J ake.Troutman@faa.gov 

1 ZCJ 1 rturd t.wenLc 

Su1te ;,:JOo 

Sc3ttle. 'N.t.. <13 101 3099 

0 · 1.ZD6 3)9 8CJO 

0 I 1 206359 9000 

oerk.1nsco1e cor1 

Rc: ARS Elcctronica Section 333 Application/Petition for Exemption 

Docket No. FAA-2014-1095 

Response to Request for Additional Information 

Dear Mr. Troutman: 

This responds to your request for additional info rmation received on May 5, 2015. The 

requests arc reproduced below in bold type face per the numbering in your request, with 

corresponding answers in regular typeface. 

A. On page 4 ofyour petition you indicate that "a few operators can safely manage a 

show involving 200 ai.-cnaft." Further, beginning on page 7 of yo ur petition you 

mention the laptops aa·e linlied and each operatoa· can oversee multiple aircraft from 

one laptop. Can you explain further including: 

1) What is the maximum numbea· of computers linked together for a light show? 

There is one master computer operated by a primary fli ght controller that controls all 

aircraft in the flight. The master computer is connected via cable to secondary computers that 

aiiO\·V secondary flight controll ers to monitor a subset of the aircraft. Each secondary computer 

can monitor up to 35 aircraft. 

We currently envision fli ghts with I 00 aircraft. For such fl ights, there would be one 

master computer and three secondary computers, with 33-34 aircra ft assigned to each secondary 

computer. 

LEG1\L 125982052.2 
May 19,2015 

Page 2 

Our section 333 application and petition for exemption requested approval for up to 200 

aircraft. For flights involving more than 100 aircraft, there would be one master computer and 

one secondary computer per 35 aircraft. 

2) What is the maximum number of unmanned aircraft each computer would 

control? 

The master computer controls all aircraft. It transmits position instructions to all aircraft 

and the primary flight controller at the master computer has the ability to command all or any 

subset of aircraft to land at any time. 

Secondary flight controllers at the secondary computers monitor up to 35 aircraft each. 

The secondary computers do not send position commands to the aircraft during normal flight; the 

master computer does that. The secondary computers provide a monitoring interface for the 

secondary flight controllers. The secondary controllers, via the mouse or keyboard on the 

secondary computer, can, however, manually reposition or land any aircraft assigned to a 

secondary computer. 

3) Will there be one computer which serves as the "ground control station" or 

multiple computers? 

There will be one master computer that serves as the ground control station. Secondary 

computers link to it by cable. The master computer controls the positions of the aircraft in 

normal flight and the secondary computers serve as an interface for secondary flight controllers. 

Commands entered through the secondary computers are transmitted to the aircraft via the 

master computer. 

B. Can you also explain further your contingency plans for any computer and software 

failures, including: 

The contingency plans for computer and software failures fall within four categories: 1) 

reducing the risk of failure through front-end testing and rehearsal; 2) programming the aircraft 

to follow a designated emergency landing procedure if a control link fails or the master computer 

malfunctions; 3) permitting the primary and secondary flight controllers to manually reposition 

or land any or all aircraft if an aircraft develops a problem; and 4) restricting flight to a sanitary 

flight zone surrounded by a two-layer geo-fence and an exclusion zone to protect against injury 

or property damage in the event of in-flight failure. These are described in further detail below, 

before proceeding to answer the specific questions posed in subpart B. 

(l) ARS has conducted extensive testing of the Hummingbird aircraft for purposes of 

light shows. ARS has flown more than 35 test flights involving multiple aircraft in small, defined 

LEGAL 125982052.2 
May 19, 2015 

Page 3 

airspaces. These test flights and the shows it has conducted involve more than 2,800 individual 

aircraft takeoffs. 

(2) The aircraft have a preprogrammed emergency landing protocol, known as 

"emergency home," that they automatically follow if they lose the control link or are 

commanded to land. The emergency home procedure involves three steps. First, the aircraft 

descend vertically to a predetermined safe level, which is programmed into each aircraft before a 

flight. The safe level is developed for each airspace to account for obstructions and other 

airspace-specific concerns. Second, the aircraft move laterally, at the safe level, to the point 

directly above their takeoff locations. Third, the aircraft descend vertically to their takeoff 

locations. 

(3) The flight controllers can manually reposition any aircraft by placing the mouse 

cursor on the aircraft icon on the computer screen and dragging it to a new location inside the 

geo-fence. The controllers can also command any aircraft assigned to them to land. 

( 4) All aircraft are confined to a small, defined cylindrical airspace and are strictly 

separated from nonparticipating personnel by a two-layer geo-fence and an exclusion zone. This 

separation minimizes the risk of injury or property damage if an aircraft experiences an in-flight 

failure. 

1) What will happen to the unmanned vehicles if one or more computers 

malfunction? 

The effect of a malfunction of the master computer depends on the nature and extent of 

the malfunction. A malfunction that disrupts the transmission of position commands to the 

aircraft causes the aircraft to enter the lost link protocol. The aircraft hold position and altitude 

for I 0 seconds and attempt to regain the signal. If the malfunction resolves in that period, the 

aircraft resume flight per the commands transmitted by the master computer. If the malfunction 

does not resolve within 10 seconds, the aircraft follow the emergency home procedure and land. 

The secondary computers cannot take over the master computer's function of transmitting 

position commands to the aircraft, so if the master computer fails completely the aircraft enter 

the lost link protocol. 

A malfunction in any of the secondary computers does not affect any aircraft because the 

master computer controls the aircraft during normal flight. The secondary computers serve as an 

interface that enables the secondary controllers to monitor the aircraft assigned to them, and to 

reposition or land the aircraft if necessary. If a secondary computer malfunctions, the primary 

flight controller can still reposition or land any aircraft because the master computer has control 

over all of the aircraft at all times. 

LEGAL 125982052.2 

Per'.<ns Cruc l.l.P 
May 19,2015 

Page4 

2) Holv does a malfunction affect each of the unmanned aircraft it controls? 

See answer to question B. I above. 

3) Is there one independent "kill" switch which would direct all UAs in the light 

show to land? If not, does each computer have this capability or would each operator have 

to direct the UAs s/he controls to land immediately in an emergency? 

Yes, the emergency home procedure effectively acts as a "kill switch." The primary flight 

controller at the master computer can command all or any subset of aircraft to enter the 

emergency home procedure. 

4) How do you ensure that UAs do not collide if you have to suddenly command 

them to land due to an emergency situation? 

ARS uses vehicle separation in the light show choreography to minimize the risk of 

collision during normal flight and an emergency landing. ARS designs each show so that aircraft 

maintain at least 6 meters separation from each other, in all axes, at every point in the show. 

ARS also designs the show to avoid, to the extent possible, any aircraft flying directly above or 

below another at any point in the show. ARS runs computer simulations of the show to verify 

that the aircraft have the required 6 meters separation and do not overlap in the vertical axis. 

An important safety feature is the large exclusion zone surrounding the two-layer geofence, which we described in section H of our submission. The geo-fences and exclusion zone 

ensure that the aircraft operate within a small cylindrical airspace with no persons on the ground 

in that cylinder. This provides an additional layer of protection beyond the separation parameters 

described above. 

5) How do the unmanned aircraft respond to a lost communication link with the 

ground based control unit? 

If an aircraft loses the link with the master computer, it holds position and altitude for 1 0 

seconds and attempts to regain the signal. If the aircraft regains the signal within I 0 seconds, it 

resumes flight per the commands transmitted by the master computer. If I 0 seconds elapse 

without regaining the signal, the aircraft executes the emergency home procedure, which is 

described in section B above. 

C. Given that you have performed many light shows around the world can you provide 

information about any failures or incidents which occurred and what your response was to 

those incidents or failures such as changes to your operations? 

LEGAL 125982052.2 

Perl<ms Cou: UP 
May 19,2015 

Page 5 

There have been no failures or incidents during the light shows that resulted in injury, 

property damage, or disruption of a show. There have been a few unexpected events, which are 

described below along with ARS' response to them. 

1. Two aircraft contacted each other during the London Star Trek Into Darkness 

Promotion show in March 20 13. That show is described in section E of our submission. There 

was no failure or malfunction in the computers or aircraft. GPS position error resulted in the 

contact in-flight in the aircraft horizontal axis, causing one to descend to the ground. This event 

created no safety risk because the geo-fences and exclusion zone ensure ample separation 

between the aircraft and persons on the ground. 

ARS made several changes to its choreography and light show procedures after this 

event. First, ARS increased the minimum separation between aircraft from 5 meters to 6 meters. 

Second, ARS reduced the groundspeed to 2 rn/s, with a maximum of 3 rn/s under some 

circumstances. This change reduced the time lag between the position commands and the 

aircrafts' actual positions. Third, ARS changed the software simulation procedures to require at 

least two people to review the simulations together and in sequence to verify that the aircraft 

maintain the minimum separation throughout the show. 

In addition, before any show, ARS tests the integrity of the GPS signal. It hovers an 

aircraft in five locations to take airborne GPS signal readings. It also tests 5 locations on the 

ground. The GPS signal was tested in London before the show using different software than was 

used for the show and subsequent shows. The new software has improved recording capabilities, 

which makes it easier to analyze and interpret the GPS signal readings in these tests. This 

software also allows for aircraft to take off and land in groups, which improves separation during 

these phases of flight. 

2. Approximately 5 aircraft descended unexpectedly to the ground during various light 

shows. None of these aircraft exited the flight area or approached the geo-fence. ARS was not 

able to determine the cause of these events. These events created no safety risk because the geefences and exclusion zone ensure ample separation between the aircraft and persons on the 

ground. 

3. In October 2014, during the landing sequence at the conclusion of the light show in 

Hannover, Germany, one aircraft stopped responding to position commands and exited the flight 

area and geo-fence, most likely due to a fault in its high-level processor. ARS and the aircraft 

manufacturer made software changes to ensure that aircraft cannot exit the flight area if a 

processor fails, and no similar event has occurred since. 

The aircraft have two processors. The high-level processor controls the aircraft lights, 

communicates with the ground station, obtains the aircraft's position from the GPS receiver, and 

communicates the GPS position to the low-level processor. The low-level processor uses the 

LEGAL 125982052.2 

Pc>rktns C01~ LLP 
May 19,2015 

Page 6 

GPS position and inputs from the accelerometers, gyros, magnetic field sensors, and barometer 

to control the aircraft. 

The high-level processor on this aircraft likely stopped communicating position data to 

the low-level processor, for undetermined reasons. Without this position data, and before the 

software changes described in the next paragraph, the aircraft would stop responding to position 

commands and would not respond to the geo-fence. 

ARS and the aircraft manufacturer made two software changes to ensure that aircraft 

cannot exit the flight area if a processor fails. First, they implemented a watchdog timer that 

restarts the high-level processor if that processor does not communicate with the timer for more 

than 500 milliseconds. This change ensures that the processor immediately restarts if it stops 

responding. Testing has shown that the processor can restart itself quickly enough in flight to 

maintain stable flight. Second, they changed the low-level processor software so that if it does 

not receive data or GPS position updates from the high-level processor for more than 5 seconds, 

it commands the aircraft to perform a controlled descent at 8 meters per second. 

The aircraft have built-in protection if the low-level processor fails. The motor controllers 

shut down all motors if they do not receive any commands from the low-level processor for more 

than 200 milliseconds. 

D. On page 4 and 5 of your petition you indicate that you have performed these light shows 

around the world and on page 16 you state that the aircraft are not registered with any 

government implying that no country has required that your aircraft be registered. Do you 

have any documentation from the country of origin of the UAs or the petitioner which 

indicates registration of these UAs is not necessary'? 

ARS Electronica has received approvals for unmanned aircraft light shows from 

regulatory authorities in Germany, Australia, Sweden, and Dubai. None of these authorities 

required registration. The approvals that were provided in written form do not mention 

registration. 

E. On page 18 of your petition you indicate that the individual operator's supervising 

groups of aircraft on the flight control laptop will operate under control of the pilot. Can 

you clarify the roles and responsibilities of the PIC and the operators and their 

communication mechanism between them. 

A pilot with a pilot certification valid in the United States will have operational control of 

the light show flight. The pilot will be positioned next to the primary flight controller at the 

master computer. The pilot and primary flight controller, together with the secondary flight 

LEGAL 125982052.2 

Perk1ns Co1e LLP 
May 19,20 15 

Page 7 

controllers positioned on the secondary computers, comprise the fli ght team. The fli ght team sits 

close enough together to communicate verbally and instantaneously. 

The pilot has operational control over the flight, and as such has the authority to cancel it, 

to command that the primary flight controller land all or any subset of the aircraft at any time, 

and to command that secondary fl ight controllers land or reposition any aircraft assigned to 

them. The pilot will interface with air traffic control, review the weather, evaluate the airspace 

for any potential conflicts with other traffic, and ensure that the show fol lows all operating 

conditions imposed by the FAA. 

The primary flight controller operates the master computer. Subj ect to the pilot's 

oversight, the primary fli ght controller monitors the master computer and can command any or 

all of the aircraf1to land. The primary fli ght controller, not the pilot, physically enters commands 

in the master computer. The reason for this is the primary flight controller has extensive 

experience with the master computer and the software and operating light shows. 

The secondary fli ght controll ers operate the secondary computers and monitor the subset 

of aircraft assigned to them. The secondary computers display information about each aircraft 

such as the state of the battery, GPS signal, and communications link. The secondary controllers 

report any issues with their aircraft to the primary flight controll er and the pi lot. 

Please feel free to contact me at 206.359.6179 or bmurphy@perkinscoie.com if you need 

any additional information or would like to discuss. 

BM 

LEGAL 125982052.2 

Pcrk1ns Cme LLP