# . PeRKINS COle

[3rc ndan Murph y l:3M 11 rphy @ pcrkin sco i c.c o m D (2 0 6)359

- 6 17 9 F

. (206)3 59- 7 17 9

May19 , 20 1 5

V ia E m a il a nd Rcgulation s . G o v Jake J. Troutman Program A nal ys t, Rulemaking F

/\A Office of Av iation Saf ety A irm en and A irspace R ul e s Division .J ake.Tr outman @ faa.gov 1 ZCJ 1 rturd t.wenLc Su 1 te ; ,:JOo Sc3ttl e. 'N.t.. <13 10 1 3099 0 · 1.ZD6 3)9 8CJO 0 I 1206359 9000 oerk.1nsco 1e cor1

Rc: ARS Elcctronica Sec tion 333 A pplicati on/Petition for Exemption Docket No. FAA-2014-1095 Response to Request for Additional Information Dear 

### Mr. Troutman: Thi s r esponds to yo ur r equ es t for additiona l inf o rm ation received on May 

### 5 , 20 15. The r eq ues ts ar c r e produ ced below in bo ld t ype fa ce per th e numb erin g in yo ur reques t, w ith c o r r es ponding an s we rs in regu lar typefa ce . A. On page 4 ofyour petition you indi cate that "a few ope rators can sa fel y mana ge a s how involving 200 a i.-cnaft." Further, b eg innin g on p age 7 of yo ur petition yo u mention the laptop s aa·e linli e d and each operato a· can oversee multiple aircraft from one laptop. C an y ou explain further including: 1) What is the maximum numbea· of computers linked together for a li g ht s how? Ther e is one ma s te r co mpute r ope rated by a prim ary fli gh t co ntr o ll e r that co ntr o ls a ll airc raft in th e flight. The maste r comp uter is con nected via cab le to seco nda r y computers th at aii O \ · Vsecondary flight co ntro ll e rs to mon itor a s ub se t o f th e airc raf t. Eac h se co nd ar y compu t e r ca n monitor up to 35 aircraft. W e c urrently env is io n fli g ht s w ith I 00 airc raft. For s uc h fl ig ht s, th ere wo uld be o ne mas t er co mputer and three seconda ry co mpu t ers , with 33 -34 aircra f t ass igned to eac h se condary c o mpu te r.

L EG1 \L 1259 82052.2May 19,2015 Page 2

Our section 333 application and petition for exemption requested approval for up to 200 aircraft. For flights involving more than 100 aircraft, there would be one master computer and one secondary computer per 35 aircraft. 

### 2) What is the maximum number of unmanned aircraft each computer would control? The master computer controls all aircraft. It transmits position instructions to all aircraft and the primary flight controller at the master computer has the ability to command all or any subset of aircraft to land at any time. Secondary flight controllers at the secondary computers monitor up to 35 aircraft each. The secondary computers do not send position commands to the aircraft during normal flight; the master computer does that. The secondary computers provide a monitoring interface for the secondary flight controllers. The secondary controllers, via the mouse or keyboard on the secondary computer, can, however, manually reposition or land any aircraft assigned to a secondary computer. 

### 3) Will there be one computer which serves as the "ground control station" or multiple computers? There will be one master computer that serves as the ground control station. Secondary computers link to it by cable. The master computer controls the positions of the aircraft in normal flight and the secondary computers serve as an interface for secondary flight controllers. Commands entered through the secondary computers are transmitted to the aircraft via the master computer. 

### B. Can you also explain further your contingency plans for any computer and software failures, including: The contingency plans for computer and software failures fall within four categories: 1) reducing the risk of failure through front-end testing and rehearsal; 2) programming the aircraft to follow a designated emergency landing procedure if a control link fails or the master computer malfunctions; 3) permitting the primary and secondary flight controllers to manually reposition or land any or all aircraft if an aircraft develops a problem; and 4) restricting flight to a sanitary flight zone surrounded by a two-layer geo-fence and an exclusion zone to protect against injury or property damage in the event of in-flight failure. These are described in further detail below, before proceeding to answer the specific questions posed in subpart B. (l) ARS has conducted extensive testing of the Hummingbird aircraft for purposes of light shows. ARS has flown more than 35 test flights involving multiple aircraft in small, defined

LEGAL 125982052.2May 19, 2015 Page 3 airspaces. These test flights and the shows it has conducted involve more than 2,800 individual aircraft takeoffs. (2) The aircraft have a preprogrammed emergency landing protocol, known as "emergency home," that they automatically follow 

### if they lose the control link or are commanded to land. The emergency home procedure involves three steps. First, the aircraft descend vertically to a predetermined safe level, which is programmed into each aircraft before a flight. The safe level is developed for each airspace to account for obstructions and other airspace-specific concerns. Second, the aircraft move laterally, at the safe level, to the point directly above their takeoff locations. Third, the aircraft descend vertically to their takeoff locations. (3) The flight controllers can manually reposition any aircraft by placing the mouse cursor on the aircraft icon on the computer screen and dragging it to a new location inside the geo-fence. The controllers can also command any aircraft assigned to them to land. (4) All aircraft are confined to a small, defined cylindrical airspace and are strictly separated from nonparticipating personnel by a two-layer geo-fence and an exclusion zone. This separation minimizes the risk of injury or property damage if an aircraft experiences an in-flight failure. 

### 1) What will happen to the unmanned vehicles if 

### one or more computers malfunction? The effect of a malfunction of the master computer depends on the nature and extent of the malfunction. A malfunction that disrupts the transmission of position commands to the aircraft causes the aircraft to enter the lost link protocol. The aircraft hold position and altitude for I 0 seconds and attempt to regain the signal. If the malfunction resolves in that period, the aircraft resume flight per the commands transmitted by the master computer. If the malfunction does not resolve within 10 seconds, the aircraft follow the emergency home procedure and land. The secondary computers cannot take over the master computer's function of transmitting position commands to the aircraft, so if the master computer fails completely the aircraft enter the lost link protocol. A malfunction in any of the secondary computers does not affect any aircraft because the master computer controls the aircraft during normal flight. The secondary computers serve as an interface that enables the secondary controllers to monitor the aircraft assigned to them, and to reposition or land the aircraft if necessary. If a secondary computer malfunctions, the primary flight controller can still reposition or land any aircraft because the master computer has control over all of the aircraft at all times.

LEGAL 125982052.2 Per'.<ns Cruc l.l.PMay 19,2015 Page4 

### 2) Holv does a malfunction affect each of the unmanned aircraft it controls? See answer to question B. I above. 

### 3) Is there one independent "kill" switch which would direct all UAs in the light show to land? If not, does each computer have this capability or would each operator have to direct the UAs s/he controls to land immediately in an emergency? Yes, the emergency home procedure effectively acts as a "kill switch." The primary flight controller at the master computer can command all or any subset of aircraft to enter the emergency home procedure. 

### 4) How do you ensure that UAs do not collide if you have to suddenly command them to land due to an emergency situation? ARS uses vehicle separation in the light show choreography to minimize the risk of collision during normal flight and an emergency landing. ARS designs each show so that aircraft maintain at least 6 meters separation from each other, in all axes, at every point in the show. ARS also designs the show to avoid, to the extent possible, any aircraft flying directly above or below another at any point in the show. ARS runs computer simulations of the show to verify that the aircraft have the required 6 meters separation and do not overlap in the vertical axis. An important safety feature is the large exclusion zone surrounding the two-layer geofence, which we described in section H of our submission. The geo-fences and exclusion zone ensure that the aircraft operate within a small cylindrical airspace with no persons on the ground in that cylinder. This provides an additional layer of protection beyond the separation parameters described above. 

### 5) How do the unmanned aircraft respond to a lost communication link with the ground based control unit? If an aircraft loses the link with the master computer, it holds position and altitude for 1 0 seconds and attempts to regain the signal. If the aircraft regains the signal within I 0 seconds, it resumes flight per the commands transmitted by the master computer. If I 0 seconds elapse without regaining the signal, the aircraft executes the emergency home procedure, which is described in section B above. 

### C. Given that you have performed many light shows around the world can you provide information about any failures or incidents which occurred and what your response was to those incidents or failures such as changes to your operations?

LEGAL 125982052.2 Perl<ms Cou: UPMay 19,2015 Page 

### 5

There have been no failures or incidents during the light shows that resulted in injury, property damage, or disruption of a show. There have been a few unexpected events, which are described below along with ARS' response to them. 1. Two aircraft contacted each other during the London Star Trek Into Darkness Promotion show in March 20 13. That show is described in section E of our submission. There was no failure or malfunction in the computers or aircraft. GPS position error resulted in the contact in-flight in the aircraft horizontal axis, causing one to descend to the ground. This event created no safety risk because the geo-fences and exclusion zone ensure ample separation between the aircraft and persons on the ground. ARS made several changes to its choreography and light show procedures after this event. First, ARS increased the minimum separation between aircraft from 

### 5 meters to 6 meters. Second, ARS reduced the groundspeed to 2 rn/s, with a maximum of 3 rn/s under some circumstances. This change reduced the time lag between the position commands and the aircrafts' actual positions. Third, ARS changed the software simulation procedures to require at least two people to review the simulations together and in sequence to verify that the aircraft maintain the minimum separation throughout the show. In addition, before any show, ARS tests the integrity of the GPS signal. It hovers an aircraft in five locations to take airborne GPS signal readings. It also tests 5 locations on the ground. The GPS signal was tested in London before the show using different software than was used for the show and subsequent shows. The new software has improved recording capabilities, which makes it easier to analyze and interpret the GPS signal readings in these tests. This software also allows for aircraft to take off and land in groups, which improves separation during these phases of flight. 2. Approximately 5 aircraft descended unexpectedly to the ground during various light shows. None of these aircraft exited the flight area or approached the geo-fence. ARS was not able to determine the cause of these events. These events created no safety risk because the geefences and exclusion zone ensure ample separation between the aircraft and persons on the ground.3. In October 2014, during the landing sequence at the conclusion of the light show in Hannover, Germany, one aircraft stopped responding to position commands and exited the flight area and geo-fence, most likely due to a fault in its high-level processor. ARS and the aircraft manufacturer made software changes to ensure that aircraft cannot exit the flight area if a processor fails, and no similar event has occurred since. The aircraft have two processors. The high-level processor controls the aircraft lights, communicates with the ground station, obtains the aircraft's position from the GPS receiver, and communicates the GPS position to the low-level processor. The low-level processor uses the

LEGAL 125982052.2 Pc>rktns**C01~** LLPMay 19,2015 Page 6

GPS position and inputs from the accelerometers, gyros, magnetic field sensors, and barometer to control the aircraft. The high-level processor on this aircraft likely stopped communicating position data to the low-level processor, for undetermined reasons. Without this position data, and before the software changes described in the next paragraph, the aircraft would stop responding to position commands and would not respond to the geo-fence. ARS and the aircraft manufacturer made two software changes to ensure that aircraft cannot exit the flight area if a processor fails. First, they implemented a watchdog timer that restarts the high-level processor if that processor does not communicate with the timer for more than 500 milliseconds. This change ensures that the processor immediately restarts if it stops responding. Testing has shown that the processor can restart itself quickly enough in flight to maintain stable flight. Second, they changed the low-level processor software so that if it does not receive data or GPS position updates from the high-level processor for more than 5 seconds, it commands the aircraft to perform a controlled descent at 8 meters per second. The aircraft have built-in protection if the low-level processor fails. The motor controllers shut down all motors if they do not receive any commands from the low-level processor for more than 200 milliseconds. 

### D. On page 4 and 5 of your petition you indicate that you have performed these light shows around the world and on page 16 you state that the aircraft are not registered with any government implying that no country has required that your aircraft be registered. Do you have any documentation from the country of origin of the UAs or the petitioner which indicates registration of these UAs is not necessary'? ARS Electronica has received approvals for unmanned aircraft light shows from regulatory authorities in Germany, Australia, Sweden, and Dubai. None of these authorities required registration. The approvals that were provided in written form do not mention registration. 

### E. On page 18 of your petition you indicate that the individual operator's supervising groups of aircraft on the flight control laptop will operate under control of the pilot. Can you clarify the roles and responsibilities of the PIC and the operators and their communication mechanism between them. A pilot with a pilot certification valid in the United States will have operational control of the light show flight. The pilot will be positioned next to the primary flight controller at the master computer. The pilot and primary flight controller, together with the secondary flight

LEGAL 125982052.2 Perk1ns Co1e LLPMay 1 9,20 1 5 Page 7

co ntroll ers po s iti oned on the secondary computers, compri se the fli g ht team. T he fli gh t team s its close enou gh together to co mmunicate ve rball y and in s t ant aneo us l y. The pilot has o pe r ational co ntrol over th e fli ght, an d as suc h has th e authorit y to cancel it , t o command that th e primary flight cont roll er land a ll o r any s ub se t o f th e aircraft at any time , and to command that seco nd ary fl ight co ntro ll ers land or r epos itio n any aircra ft ass ig n ed to th e m. The pilot w ill interf ace w ith air traffic co ntrol , rev iew the wea ther , eva luate th e airspace for any potential co nflicts with other traffi c, and e ns ure that th e show fol lows a ll operating co nditi on s impo se d by the FAA. Th e primar y fli ght con troll e r o perates th e mas t e r co mput er. S ubj ec t to the pilot ' s oversight , th e primary fli ght co ntroll e r monitors th e ma s t e r co mpute r and can command an y o r all of th e airc raf1t o land. The primary fli ght co ntro ll er, no t th e p il ot , phys ica ll y e nters co mmand s in th e mas ter compute r. Th e reaso n f or thi s is th e prim ary fli ght con trol ler ha s ex tens ive experi e nce with th e maste r co mpute r and th e s oftware and operating li g ht shows . The sec ondary fli ght contro ll e rs operate th e seco nd ary co mputers and monitor th e s ub se t of aircra ft as s igned t o th e m. T h e seconda r y comp uters di spl ay inf o rm ati on abo ut each aircraft s uch as th e state of th e battery , GPS s ign al, and commun ication s lin k. The seco ndary co ntro ll e rs r epo rt any iss ues with the ir aircraft t o th e primary fli g ht co ntro ll e r and th e pi lot. Ple ase f ee l free to co nt ac t me at 206. 359.6 179 o r bmurp hy @ perkin sc oie.com if yo u need any addition al in formation or would like t o disc uss .



### BM

LEGAL 12 5982052.2 Pc rk1ns Cme LLP