1 **AirCover 425 Safety Checklist 1. Introduction**  . The safety checklist is for the AirCover 425 in conjunction with its application for experimental airworthiness certification. **2. Aircraft Segment.** a. **Airframe (1)**  Structure. The AirCover 425 is a small (4.4 pounds) unmanned aircraft craft with quad rotors powered by electric engines. The aircraft’s dimensions are 32” X 28” X 11”. The aircraft uses 10” fixed
- pitch or 12” polymer propellers, each mounted on an arm of the aircraft protrudin g from its central hub.

**(2)** Composition.

High Strength Composite Body Carbon Fiber Legs, Landing Gear **(3)** The aircraft does not have any controllable surfaces other than the propellers. **(4)** There are no unique design characteristics such as a hydraulic system, environmental control system, parachute, or brakes. **(5)** Measurements. a. Length
– 28” b. Width
– 28” c. Height
– 8” d. Weight
– 4.4 lbs2

b. **UA Performance Characteristics.** The following are the performance of the aircraft within the proposed flight envelope: (1) Maximum allowed altitude
– 400 feet AGL (2) Maximum endurance
– 25
- 30 minutes (3) Maximum range – 2,000 feet (4) Airspeed. a. Cruise
- 0
- 20mph b. Maximum – 32 mph (5) Maximum rate of climb
– 1,100 feet per minute (6) Maximum rate of descent
– 1,100 feet per minute (7) Maximum bank angl e - not applicable (8) Turn rate limits
– not applicable (9) Identify any performance limitations due to environmental and meteorological conditions. Specifically, address the following items: a. Wind speed limitations. i. Headwind
– 30 mph ii. Crosswind
– 30 mph iii. Gusts – 3 0 mph b. Turbulence restrictions
– Not Applicable c. Minimum visibility conditions
– VFR VMC d. Lighting (for example, daytime flights only)
– Not Applicable. e. Outside air temperature (OAT) limits
– 0 degrees F to 110 degrees F f. In
-flight icing
– Does not operate in known icing conditions.
**c. Propulsion System.**  (1) The aircraft uses four electric motors. (2) Fuel
- powered propulsion systems.
– Not Applicable (3) Electric**-** powered propulsion systems.

a. Brushless DC (BLDC) motor. Each motor shaft is fully supported by ball
- bearings, and there are no brushes to wearout. b. 50 watts each, nominally. c. 0 to 120 watts range, each
. d. The UA avionics run off separate power converters from the motors. All load’s power is ultimately derived from the UA battery. d. **Fuel System.** Not Applicable
e. **Electrical System.**  (1) The aircraft uses Lithium Polymer Battery
- 14.8V, a commercial available battery.3

**f. Flight Control Surfaces and Actuators**  **-** The aircraft does not have flight control surfaces other than the propellers. Flight control, including altitude and directional control are managed by the varying speeds of the propellers. The system uses t he AkrionTM onboard flight computer **.**

g. **Payloads.** The aircraft will use various COTS camera sensors that will keep the max gross weight of the vehicle at or under 4.4 lbs. **3. Control and Communications Segment.**
**a. Avionics.**  The aircraft uses the Akrion onboard flight computer**.**

The Akrion handles on one single 4 oz micro circuit all of the avionics architecture, air data, telemetry, tracking, black box, GPS and Gyros.4

**b. Navigation.** 
– The aircraft is flown line of sight of the operator at or below 400 AGL. The onbo ard flight computer provides heading, GPS location and altitude to the operator. However, all information is verified through line of sight assessment of the aircraft.
**c. UA Flight Controls.**  **(1)** The RPM of each motor is varied (using electronic PWM motor control) to achieve desired UA pitch, roll, and yaw. There are no gears, belts, servo motors, or linkages to wear out or act as failure mechanisms. (2) The aircraft is either controlled autonomously through the Akrion autopilot or it may be manually controlled using the ground station. (3) Flight control computer. a. The flight control computer has no other auxiliary controls that interfere in any of the flight control. Constant monitoring of controls i s reported to the ground station for all movements; any actions are immediately reported to the ground station with warning and suggested messages to avoid unintended movement. b. GS300 provides RF commands to the Akrion which is onboard the 425 aircraft. This communication is run via 256 encrypt and is written in firmware code that is tracking over 40,000 lines of motion control code every 100 seconds. **d. Autopilot.**  (1) The Autopilot system was modeled after the UAS military reports and tests that have been pub lished and the direct development from the more advanced work with our engineering that has experience in DOD UAV uses and combined with Aviation Standards of VFR private pilot experience. In addition, we researched Los Angeles Police Department, Aviation Programs. (2) The autopilot is not COTS. The autopilot is a proprietary system designed specifically for this class of UA. (3) Correct installation is verified on several levels to provide redundant verification. First, a visual inspection is performed. Next, au tomatic diagnostics are performed which ensure proper mounting orientation and connectivity prior to powering motors. Then a functional test is performed while the UA is held in place. In this manner, all autopilot connections, wiring, mounting, and orien tation are verified before the any flight is performed. (4) The autopilot employs input limit parameters to keep the aircraft within structural limits. There are limits on motor RPM, thrust, angular rotation rate, absolute attitude orientation angles, grou nd speed, airspeed, climb rate, and rate of descent. (5) Autopilot commands are passed through the GCS and stored and in and executed by the UA autopilot. (6) Akrion control is based on the imbedded chip technology that operates firmware control of all hardware fu nctions. Akion is an advanced motion control5 architecture that is designed to control vertical takeoff and landing, thrust vectored systems in flight. SIL and HIL simulations are carried out in over 9000 events or simulated and physical flights that cont rol power, coordinated thrust to lift the aircraft in control position. Some of the outcomes included; timing of opposing prop rotation, sable flight characteristics with increasing load, cross wind component testing, vibration dampening and intended in troduction of system failures and the reaction of firmware, hardware and flight components. Extensive years and months have been dedicated to SIL and HIL calculations on simulations that allow full 3 D simulated results to be displayed on screen. The res ults provide a minimum of 40,000 attributes in 100 seconds that can be plotted on graphical data charts.
e. **Communications.** (1) A time
-triggered embedded system is employed to provide extremely robust, predictable behavior with absolute worse
-case autopilot latency of 9mS and worse -case control latency of 27mS. (2) Communications datalink(s) connecting the UA and the control station. a. 900 MHz ISM frequency band is used for control and telemetry. Frequency Hopping Spread Spectrum is used to obtain robust link eve n in noisy environments. b. 256
- Bit AES encryption on both control of aircraft as well as telemetry data. c. The maximum data link budget was tested at 5,000 MSL (ground level) and with the ground station powered on
– the test unit was driven(in the back of a pi ckup truck) while holding by hand the unit. At various intervals and in constant voice communication the ground station gave commands to operate all systems which was a max
– 7 feet above ground level. Max distance was 1
. 2 miles. d. The system includes con stant monitor of the signal health at all times. e. The signal strength is determined by constant communication algorithms in the Akrion to determine and report any weakling of signal. The report of any signal heath is immediate to the ground station. f. The system employs redundant communications and constant communication validations of the system, its location, performance of all system on a millisecond level of detail. All indications of any anomaly are reported to the ground station with immediate reporting g. For satellite links, estimate the system communications latencies associated with using the satellite link for aircraft control and for air traffic control (ATC) communications. The use of SATCOM is optional and has been developed with a program that cannot be reported in this communication. The native system does not require any use of any SATCOM system. **h.** The signal interference is assessed to be minimal
– however as policy we assess with customer questions of what frequencies they use or have6 obse rved. We include a spectrum analysis to assess. The 900Mh and 2.4GH can be adjusted according to communications requirements, bleed
-over from other RF systems. Provided we can verify the signal is within acceptable bands for unmanned system
– safe operat ion and total control. (3) Design characteristics or procedures are in place to prevent or mitigate the loss of the control data link due to the following: a. RF or other interference? Frequency Hopping Spread Spectrum(FHSS), is utilized to reduce susceptibility to interference. In addition, 256 bit AES encryption ensures rejection of stray, random, and unfriendly radio signal intrusion.

- b. The system will power on with a full system diagnostics report on operating cycles, engine cycles and lost link. It also includes Akrion Firmware revision control and GCS firmware Rev Level. This screen clears after any of the control sticks are moved in order for us to proceed with a flight. c. Flight beyond communications range? Alert Message and Signal Strength is constantly reported. d. Antenna masking during turns and pitch angles? The system is designed with antenna type and arrangement to optimize signa l strength about all allowable orientations and minimize null effects. e. Loss of control station functionality? If the station is inoperable or the function s are disabled for any reason, t he aircraft will stay in a hover and remain on station until: 1. Th e problem is rectified or 2. the aircraft deplete s the power and will auto land, or 3. The user can optionally cut power to the GCS to force the aircraft into lost link mode (see section “Lost Link and Flight Recovery”)7 f. Loss of UA functionality? In case of loss of UA communication functions the aircraft will perform safe recovery (For details, see section “Lost Link and Flight Recovery”). In the case a payload malfunctions, the remainder of the aircraft will remain operable. For example, in the extreme condition that a payload shorts out the power rail, the UA electronics will continue to operate due to isolated power subsystems.
**f. Lost Link and Flight Recovery.**  (1) Lost link. a. The screen display alerts lost data link, not able to connect with UA. The system continues to attempt to establish reconnect until power is exhausted or successful connection. The status display is in the lower left side of the screen. The range has been tested to 1.1 miles from ground station to UA on ground hold of 9’ MSL, which provides headroom for the specified decreased operational range. b. In the condition of lost link
– the 425 will continue to seek connection. If connection remains lost for 3 or more seconds, the aircraft will go into lost link mode. In this mode, the aircraft will perform one of two operations, depending on whether the operator has enabled Emergency Return (E
- return): 1.) If the operator has E
- return enabled, then upon lost link occurrence, the UA will first stop the current flight maneuver. Next it will climb to the clearance altitude previously set by the operator (i f it is not already at least as high as the clearance altitude). Next it will fly to the home location. Finally, it will descend and land at the home position. At any time, if communication is re
- established, the operator can optionally regain control. 2.) If E
- return is not enabled, then upon lost link occurrence, the aircraft will first stop the current flight maneuver. Next, it will hold a hover indefinitely until either a.) communication is re
- established or b.) the battery gets low. In the case the battery gets low, the aircraft will then auto land at its current location. At any time, if communication is re
established, the operator can optionally regain control. In addition, the system also reports the GPS location at all times and will give the last known position at the time communications were lost. c. The system reports on the ground station loss of data link, alert messages and continue until successful or the system lands with no further movement. If temporary loss link occurs and then link recovers, an alert message is displayed for the remainder of the flight to alert the operator that a loss link has occurred in the past during the current flight.8 d. The E
- return system previously described allows the operator to determine in advance the type of obstacle conditions present, and decide accordingly the proper clearance altitude and whether or not to enable E
return. This results in safe lost
- link operation even when operated at ultra low altitudes o r near structures, while simultaneously preventing the aircraft from climbing to an unintended altitude
. It allows for auto return and land capability, but only when it makes sense to do so, and when it can be done safely. e. If the control joysticks are eng aged while in return home mode the operator command override will cancel the return home. The return home can be reengaged at any time by pressing the home button
. f. The lost link message is displayed in the control station in simple language and has been tested with untrained persons who can see and understand the command report “lost data link.” (2) Flight recovery system (FRS).
– Not Applicable
**g. Control Station.**  (1) The flight platform and Ground Control Station (GCS) unit folds into a small footprint for under 5 lbs.. The AirCover ® 425 complete system (aircraft, 1410 grams with battery and camera options).

(2) The pilot has a standardized screen set up at the initiation of each phase of flight. The screen is initialized with GPS location if GPS is acce ssible, altitude, power on 425 and power on GS300, camera system, virtual radar, artificial horizon (3) The attitude and position are highly precise
– synthetic horizon bar and orientation of 425 is reported on GS 300 at all times. (4) Inadvertent activation of s afeguards is managed by a safety cover on kill switch and separate power on off switch9 (5) The following inadvertent inputs could the pilot enter to cause an undesirable outcome: the aircraft power can be killed by pulling the spool up switch. The master key can be switched off and the aircraft will continue to establish contact until the GS300 is turned back on, if the kill switch is off the system will wait until the command clears and kill switch is on. At that time the kill switch can disable the 425. (6) Th e ground station is running simple commands to the Akrion control, this reporting is intended to simplify the flight control. The ground station is providing commands that can override the autonomious control of up down left right f If so, what precaution ary measures are used to ensure that flight
critical processing will not be adversely affected? (7) Control position lock
- up is not possible unless 256 encryption and signal hopping is hacked for only seconds. (8) No primary flight controls are based on the Windows operating system? (9) The system provides constant reporting on battery for the aircraft and battery for the ground station. Signal strength, virtual radar and distance from ground station. (10) Primary power is closed lead acid battery, backup is trickle charge from AC power for extended and persistent use. **(11)** If the ground station loss of power occurs, first the imagery is lost with test pattern screen and alert of signal is displayed. Second the system on board the aircraft continues to re - establish contact and holds position until re
established, if unsuccessful the system will consume aircraft power in the hover while reporting its last GPS position; the aircraft will conduct an auto land procedure. **4. Ground Support Equipment.** Not A pplicable **5. Processes and Procedures.**
**a. Configuration Management**  (1) All configurations are rev controlled with affectivity rolls to the next higher level change according to documented approvals. (2) Describe the procedures used for controlling drawings, test p rocedures, engineering changes, etc. Part Number, Rev Level, Date and configuration control using CADCAMCAE control files for all hardware and firmware . (3) All systems undergo a 100% AQL level of inspection. We have team members with extensive backgrounds from Hewlett Packard and Caterpillar Management. We employ re
- qualification of all parts both internal and external. We take full advantage of proto b. **Software Management.** (1) 100% of all software functions were developed by AirCover.10 (2) Software development process(es) have been used in the development of software components for the aircraft and the ground control station, and software lifecycle data is available for review
- Applied configuration control, software practices used at Agilent and Hewlett Packard. All version control changes or enhancements undergo extensive regression testing. All firmware life cycle data can be reviewed including all onboard flight history of all flights within the flight data recorder. (3) System software updates configuration control is based on serial number, part number, documented supply chain parts for the particular period build. Updates are documented in control documents, drawings, CAD,CAM,CAE math. (4) The function of software, is in effectly referred to as firmware that is computer programing at the level (no windows or other proprietary tools). The design of Akrion is based on raw chip programing, firmware that is imbedded and software that interfaces to present and full system that is coded. The commands between akrion controller, speed controllers, power management, and motors is highly advanced and proven in design and testing for over 7 years. (5) Firmware and software are validated in virtual simulations, tested on test sleds inside out test hanger. The other testing is conducted on measurement test sleds, dyno test sleds and other fixed testing platforms indoors at our testing lab and hanger. (6) The supplier oversight includes research into the supplier, history review, sample materials testing to include significant destr uctive testing. Configuration is managed with control documents specifications and formal drawings. (7) The control of loading is conducted with naming conventions, block builds of product in controlled areas using JIT/KANBAN and Rolling Carts for each specifi c unit build. The software components are loaded via lead firmware engineer. The lead firmware engineer approves the block build and the naming of each controller for the named components to be loaded. This results in a named unit, date, and approval si gnoff. (8) The following software quality assurance processes are used in the development of the system software
- AirCover uses two person integrity and control logs for testing, changes, and effectivity rolling of system firmware/software. Suppliers are vetted based on detail technical review. One part sampling and destructive testing validation before they can be approved. (9) Reporting is conducted on a daily basis and collected via testing reports, field reports customers and logged into a master data base fo r priority testing. How are suppliers integrated into the problem reporting system? Suppliers are integrated by furnishing reports on part test results, destructive testing and AirCover pilot test unit testing before acceptance from suppliers. (10) Configurat ion changes are handled by three levels, inline change, roll to the next level of interchangeability, and change to the top level. Each level has11 review of the part numbers, CAD FILEs and CAM programs if machined. Documentation of procedures are defined as resident assembly procedures to build. And, engineering procedures to address effectivity as described above. How are they documented? CAD CAM file naming linked to part files used in fabrication and assembly. (11) C++ programming language is used. (12) Cont rol logs, tracking, self
- audit, revision change control and unit / regression testing and formal documented test procedures.
**c. Electronic Hardware Design and Testing.**  (1) The following standards and processes are used to design, test, and modify electronic hard ware system elements
- IEC 65A Structured programing for control systems which has evolved to IEC SC 65A Control Programming (2) All parts are 100% testing in simulation and physical tests within our secure test facility indoors. All safety features are testing to limits beyond recommended levels of use. All are documented and majority are recorded in full motion view from the UA and from placed camera angles for testing monitoring. **6. Operations.**
**a. National Airspace System (NAS) Integration and**  **Interaction** (1) Surveillance and Aircraft Visibility. a. Is the UA equipped with TSO approved Mode
- C or Mode
-S transponder? No. It will not be flown in Class B, C or D airspace. b. Does the UA have a high
-visibility paint scheme that enables other pilots to see and avoid the UA and enables the observer(s) to visually acquire and track the UA?
– Not the aircraft is a small UAS. c. Does the UA have anti
- collision lights? Does the UA have position lights? What are the procedures if the lights are inoperative? Not Applicabl e (2) Air traffic control and crewmember communications. a. How does the pilot communicate with ATC?
– The pilot will call ATC prior to operations. The pilot will have two way communication capability using cell phones. The pilot will also have a handheld VHF radio. b. How does the pilot communicate with other users of the airspace?
– The pilot will have a hand held VHF radio.
c. Is there an intercommunication system that allows for communication between the pilot(s), ground support personnel, crewmembers, and observers?
– Direct communications as all flight team members will be immediately next to each other.12 d. What procedures have been established in the event of intercom failure? Not Applicable. (3) Sense and avoid. Not Applicable
– The aircraft is flown line of sight at all times. (4) Chase aircraft operations.
– Not Applicable **b. Flight Phases.**  (1) Preflight/taxi operations. a. All participants in a flight operation will attend a pre
-flight briefing that will discuss the nature of the mission, the duration of the flight, an y risks, emergency procedures and objectives. The preflight mission will include a weather briefing. b. Describe your coordination procedures with ATC before takeoff by addressing at a minimum: i. Notices to Airmen (NOTAM).
– If requested by the FAA, a long
term NOTAM may be filed indicating the possibility of UAS operations at or below 400AGL in the vicinity of operations. ii. Filing the flight plan.
– Not Applicable iii. Transponder codes
- Not Applicable iv. ATC will be notified of all flight operations at le ast 1 hour prior to launch and immediately prior to launch. The notification will include the location, duration, maximum altitude, and emergency contact information.
c. Describe UAS preflight activities and the system and support equipment required by ad dressing at a minimum: i. See Attached Safety Checklist ii. See Attached Operations Manual d. The mapping is immediate reporting of ground location by as many as 16 GPS SATCOM interfaces. However in GPS denied space, the system still performs accurate position se nsing. The mapping data is available through multiple interfaces. First, a “virtual radar” map is visible on the primary GCS display at all times. This display is driven by a real
-time embedded system which is highly reliable and not dependent on a windows operating system (or similar). In addition, if further mapping capabilities are required for a particular mission, the GCS can be connected to a PC running Google Earth or other paid for services for13 mapping. The mapping updates can be immediate and reported by porting from ground station to computer laptop accessible to web based mapping software.
e. How do you ensure the area is clear for taxi? Visual inspection f. Describe the procedures to ensure the engine isn’t started in a manner that could cause injury to ground personnel.
– The engines are not activated until all personnel are clear of the aircraft. (2) Take off/launch. The aircraft is a VTOL UAS that permits gradual safe takeoff from a confined area. (3) Flight. a. The aircraft is flown using the ground control station. The aircraft is maintained via line of sight at all times. The pilot can control the aircraft manually or through autonomous flight using the ground control station. b. Describe the method for switching between pilot
-controlled (manual) and autonomous flight modes. At what points during the flight will this happen? Not Applicable
a. What indication does the pilot have that they are in control of the aircraft? There is a visual indication on the ground station showing data link. In addition, the aircraft is within line of sight such that the operator can see the aircraft’s response to direct control inputs. (4) Landing/recovery. The aircraft it a VTOL UAS that will hover to its landing zone. No additional equipment or personnel are needed to secure landing. (5) Post flight. a. Describe the process for a post
-flight inspection.
– The aircraft is inspected after each fl ight to ensure all system are physically intact and operational. Any damage components will be replaced. In the event the aircraft suffers an incident, the aircraft will undergo a full inspection by AirCover engineering. b. Describe the process for inciden t/accident reporting. Any aircraft incident or accident that involves lost link or substantial damage to the aircraft or other property or contact with an individual will be reported to the FAA as soon as possible.
c.14

**c. Operating Areas.**  (1) How do you ensure that there is no unusual ground activity under the flight operations area? For example, are there any weekend events scheduled? Are there housing areas or public gathering places? The aircraft is flown on private land with a secure perim eter. (2) See attached documentation for the operating areas. **d. Flight Envelope and Test Plans.**  (1) Describe the conditions under which flight envelopes will be tested. How close will operations be to any populated areas and major highways? See attached documen tation for operating areas. The flight will be operated over rural land that is privately owned. (2) Describe how you plan to meet test objectives under the proposed flight envelope and operating area. Include test plans, if possible. i. See FAA Test Area Sub mission for Whiskey Town Lake application ii. See FAA Iowa Test Area application iii. See FAA 7 Hills Cattle Ranch Testing Area application. iv. Conduct stable flight missions for imagery v. Conduct medium altitude testing for flight duration vi. Conduct high wind testing to hold in close urban area’ vii. Conduct extended range flights to determine limits on range in different weather conditions viii. Conduct flight with extended down
- range control

**e. Operating History.**  (1) The test bed and prototypes UA’s have undergone 5 years of testing and over 6,000 power
- on or flight events. Estimated total test flight time exceeds 150 hours with flights averaging 5 minutes to 23 minutes. (2) Destructive testing resulted in changes to inner body, placement of UA controller, leg and arm re
- design. **f. Manu**  **als.** (1) Is there an operating manual for the aircraft? See Attached (2) Does the manual have a section with all of the aircraft limitations in one location? See Attached (3) Does the operating manual have bolded or underlined procedures for emergencies for memory item steps? See Attached (4) Is there an operational checklist for all phases of the operation? See Attached15 (5) Are there separate checklist items for normal, abnormal, or emergency procedures? See Attached **7. Organizational Considerations.**
a. **Pilot/Crew Qualifica tions/Training Reference**  : 14 CFR part 61 – Certification: pilots, flight instructors, and ground instructors; part 63
– Certification: flight crewmembers other than pilots; part 65
– Certification: airmen other than flight crewmembers. (1) Crew. Is there a crew resource management training program? If so, describe the program. AirCover provides a training program for its operators. See Attached. The CRM is managed through standard process for pre
-flight, flight planning, mission execution and post
-flight briefing. The operators will include a pilot and observer. (2) Pilot. a. Do the pilots have a current pilot certificate? Yes, commercial and private pilot certificated pilots. b. Do the pilots have a current medical certificate? 2 nd class medical certificates. c. Describe in detail and reference any procedures that show that the pilots are properly trained.
– In addition to FAA pilot knowledge exams, the pilots will also complete the attached AirCover training. d. Is there an established formal training curriculum fo r all pilots including PIC, supplemental, or chase pilots(s)? Yes. See Attached. e. Is the pilot type rated for the aircraft being flown? Not Applicable. (3) Observer. a. Do the observers have a current pilot certificate? If so, what type of pilot certificate? Yes, commercial and private pilot certificated pilots. b. Do the observers have a current medical certificate? If so, what class of medical certificate? 2 nd class medical certificates. c. Does the observer understand the applicable aviation regulations such as see a nd avoid, clear of clouds, and right of way rules? Yes d. Is the observer a current pilot or have a training curriculum? Is there an established formal training curriculum for all observers? If so, please provide it during the site visit.