CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 1/31

Justification of airworthiness and 

 safety assessment 

 

Version Date Description Author 

V 1.0 23.12.2013 Technical documentation SenseFly 

V2.0 04.04.2014 Correction SenseFly

 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 2/31

Table of content 

1 INTRODUCTION ........................................................................................................................................ 4

2 AIRCRAFT SEGMENT .............................................................................................................................. 4

2.1 AIRFRAME ................................................................................................................................................. 4

2.1.1 Structure ............................................................................................................................................. 4

2.1.2 Composition ....................................................................................................................................... 5

2.1.3 Load analysis ..................................................................................................................................... 5

2.1.4 Technical information ........................................................................................................................ 5

2.1.5 Performance characteristics .............................................................................................................. 6

2.2 PROPULSION SYSTEM ................................................................................................................................ 6

2.3 ELECTRICAL SYSTEM ................................................................................................................................ 7

2.4 FLIGHT CONTROL SURFACES AND ACTUATORS .......................................................................................... 8

2.5 PAYLOADS ................................................................................................................................................. 9

3 CONTROL AND COMMUNICATION SEGMENT ............................................................................... 9

3.1 AVIONICS .................................................................................................................................................. 9

3.2 NAVIGATION ........................................................................................................................................... 10

3.3 UA FLIGHT CONTROLS ............................................................................................................................ 10

3.4 AUTOPILOT .............................................................................................................................................. 11

3.5 COMMUNICATION AND CONTROL ............................................................................................................ 11

3.5.1 Architecture of the command and communication system ............................................................... 11

3.5.2 Lost Link and Flight Recovery ......................................................................................................... 13

3.5.3 Control Station ................................................................................................................................. 13

3.5.4 Control frequencies .......................................................................................................................... 14

3.6 GROUND SUPPORT EQUIPMENT ............................................................................................................... 15

4 PROCESSES AND PROCEDURES ......................................................................................................... 15

4.1 CONFIGURATION MANAGEMENT ............................................................................................................. 15

4.2 SOFTWARE MANAGEMENT ...................................................................................................................... 15

4.3 CONTINUING AIRWORTHINESS ................................................................................................................. 15

5 OPERATIONS ............................................................................................................................................ 16

5.1 NATIONAL AIRSPACE SYSTEM (NAS) INTEGRATION AND INTERACTION ................................................ 16

5.2 FLIGHT PHASES ....................................................................................................................................... 16

5.2.1 Pre-flight / taxi operations ............................................................................................................... 16

5.2.2 Take-off ............................................................................................................................................ 17

5.2.3 Flight ................................................................................................................................................ 17

5.2.4 Landing/recovery ............................................................................................................................. 18

5.2.5 Post flight ......................................................................................................................................... 18

5.3 EMERGENCIES AND PROCEDURES ............................................................................................................ 18

5.3.1 Complete loss of control link ........................................................................................................... 18

5.3.2 Engine Failure ................................................................................................................................. 18

5.3.3 Propeller Loss .................................................................................................................................. 19
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 3/31

5.3.4 Loss of GPS ...................................................................................................................................... 19

5.3.5 Loss of heading information ............................................................................................................ 19

5.3.6 Pitot system malfunction .................................................................................................................. 19

5.3.7 Servo malfunction or loss ................................................................................................................. 19

5.3.8 Payload malfunction ........................................................................................................................ 20

5.3.9 Loss of Autopilot .............................................................................................................................. 20

5.4 MANUALS ............................................................................................................................................... 20

5.5 ORGANIZATIONAL CONSIDERATIONS ...................................................................................................... 20

5.5.1 Training ............................................................................................................................................ 20

5.5.2 Maintenance ..................................................................................................................................... 20

6 ANNEXES ................................................................................................................................................... 21

6.1 ANNEX 1: 3-VIEW DRAWINGS OF THE EBEE ............................................................................................ 21

6.2 ANNEX 2: IN-FLIGHT SAFETY ACTIONS .................................................................................................... 22

6.2.1 In-flight manual safety actions ......................................................................................................... 22

6.2.2 In-flight automatic safety actions ..................................................................................................... 22

6.3 ANNEX 3: AREAS OF OPERATIONS ........................................................................................................... 24

6.4 ANNEX 4: SAFETY ANALYSIS ................................................................................................................... 25

6.4.1 Considerations about risk related to ground impacts ...................................................................... 25

6.4.2 Considerations about the probability of mid-air collisions ............................................................. 26

6.4.3 Pre-flight tests .................................................................................................................................. 27

6.4.4 Take-Off vetos .................................................................................................................................. 28

6.4.5 References ........................................................................................................................................ 29

6.5 ANNEX 5: COMMAND AND CONTROL ....................................................................................................... 30
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 4/31

1 Introduction 

SenseFly is a Swiss company founded at the end of 2009. The company manufactures lightweight 

fixed-wing UAVs (500-750 grams) for mapping applications and develops eMotion, a very powerful 

software package for flight simulation and flight monitoring. 

In June 2012, SenseFly joined the Parrot group, the manufacturer of the smartphone-driven AR 

Drone quadcopters for the hobby market. Within Parrot, senseFly is now leading the development of 

drones for professional use. 

SenseFly masters all aspects of mini-drone development (from hardware to software) and is 

therefore capable of achieving very high levels of system integration. 

2 Aircraft segment 

2.1 Airframe 

2.1.1 Structure 

The eBee (see figure below) is a ready-to-launch UAV based on fixed-wing architecture. This simple 

and robust design provides aerodynamic efficiency, manoeuvrability and an excellent gliding ratio. 

 

Figure 1: Architecture of the eBee 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 5/31

The four main characteristics of the eBee are: 

a. Very lightweight 

The eBee is so light that the operator can launch it by hand and let it land on almost any surface 

without requiring a parachute or landing net (belly land). Its low impact energy (38 J In case of a 

controlled emergency landing) also significantly reduces the risk of third-party collision damage (see 

Annex 4, safety analysis). The wing is made of flexible foam with no sharp or hard edges and almost 

no internal strengthening structure. 

b. Electric Powered 

The eBee is electric powered. A brushless engine technology makes it silent and reliable. The 

propeller is attached with a rubber band to the body of the plane so that it can easily flex away in 

case of contact or crash with any object. 

c. Semi-Automatic flight 

The artificial intelligence incorporated within the eBee autopilot system continuously analyzes data 

from the Inertial Measurement Unit and from the onboard GPS and takes care of all the aspects of 

the flight, even in the absence of radio connection with the laptop. Take-off and landing phases are 

also fully controlled by the autopilot. 

d. Manual control 

Additionally, the eBee provides an override capability that allows the operator to take manual 

actions during the flight (Go to Home, Go Land, Hold and Resume the mission) and also suspend 

automated operations and take manual control of the aircraft should it become necessary to 

respond emergent circumstances, thanks to the remote controller provided with the system. 

2.1.2 Composition 

Wings are composed of 25g/litre injected expanded polypropylene (EPP) and the fuselage is 

composed of 35g/litre injected EPP. The leading edge protection is thermo-formed polycarbonate. 

Additional parts are made of injected fibre-reinforced ABS plastic. 

The electronic components are installed inside the fuselage in dedicated cavities to ensure proper 

positioning. The EPP parts and carbon spars are manually glued with EPP glue. 

2.1.3 Load analysis 

In-flight testing of structural resistance has been conducted by experienced pilots. The airframe was 

subjected to the maximum possible aerodynamical load and airspeeds exceeding two times the 

regular flight envelope. Results showed that the structure is capable of withstanding all possible 

loads and no flutter arises throughout the flight envelope and beyond. 

2.1.4 Technical information 

 Wingspan: 96 cm 

 Fuselage length: 60 cm 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 6/31

 Central body: 40 cm x 16 cm x 6 cm 

 MTOW (Maximum Take-Off Weight): 750 g (including battery, camera payload and all 

options) 

 Empty weight (without battery, camera payload and options): 410 g ± 20 g 

 7’’x 5’’ pusher propeller 

2.1.5 Performance characteristics 

 Maximum altitude: tested up to 17 000 feet ASL 

 Nominal endurance with standard payload, no wind and 20°C: 50 min 

 Airspeed: 

- Stall speed: 9 m/s 

- Cruise speed: 11 to 25 m/s 

- Never-exceed speed: 28 m/s 

 Maximum rate of climb: 4 m/s, and 8 m/s during take-off, emergency ground avoidance and 

emergency climb procedure. 

 Maximum rate of descent: 4 m/s, and 8 m/s during emergency descent procedure 

 Maximum bank angle: 60°

 Turn rate limits: 80°/s 

 Maximum Headwind. 12 m/s 

 Maximum Tailwind (launch/recovery) 12 m/s for launch, 12 m/s for recovery on grass, 5 m/s 

on hard surface 

 Maximum Crosswind. 12 m/s 

 Maximum Gusts. 15 m/s 

 Datalink range: 3-5 km 

Weather limitations: 

The eBee runs in light rain and light snow, with wind up to 12 m/s (27 mph). No visibility/lighting 

restrictions apply beyond within-line-of-sight operation requirements. The eBee has been tested in 

the -15° to 35°C OAT range (5°F to 95°F). No de-icing system is implemented so operations in icing 

conditions must be avoided. 

2.2 Propulsion System 

The eBee propulsion system is based on a brushless DC motor with a dedicated electronic 

controller and a 2150 mAh 3S-cells Lithium-Polymer (LiPo) battery. 

The maximum input electric power for the motor is 160W. It provides a thrust-to-weight ratio of more 

than 0.9 (static thrust of about 630 gram force), which allows for steep, high-performance take-offs. 

The electric current draw is 2 to 16A. The LiPo battery is the sole source of electric current. 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 7/31

The motor is attached to the body of the aircraft with screws. 

The main screen of the flight management software eMotion 2 displays: 

- Raw voltage level 

- Estimated percentage of battery remaining (based on battery model, current voltage, integrated 

power used, etc...) 

- Ratio of estimated remaining energy versus the estimated energy required to reach the Home 

point. 

2.3 Electrical System 

The LiPo battery provides between 9 and 12.6V to the system. A 3.3V bus, provided by the 

autopilot, powers the electronics and radio-modem. A 5V bus, provided by the motor controller, 

powers the RC receiver and the control surfaces servo. 

 

Figure 2: Cabling schematics eBee 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 8/31

2.4 Flight control surfaces and actuators 

The eBee is equipped with two control surfaces. The pitch rate is controlled with both control 

surfaces in the same direction. Roll rate is controlled by orienting the control surfaces in opposite 

directions. The yaw is passively stabilized by the winglets and the wing leading edge drag (flying 

wing). 

The control surfaces are made of EPP and are connected to the wings. A thinner section of the EPP 

material acts as a hinge between the wings and the flight surfaces. 

Failure may occur: 

- At a local level on the servos; 

- At a local level on the link level between the servo and the control surface; 

- And at a global level – by breaking the control surface itself (e.g. EPP material tearing apart). 

 Figure 3: Flight surfaces of the eBee (in yellow) 

In case of servo failure, the autopilot tries to keep the roll angle with the other servo. 

If the servo fails in 'down' position, it is likely that the eBee will dive and accelerate. If the aircraft 

achieves airspeed of 30 m/s, over-speed condition is detected and the motor is put in a reverse 

mode to slow down the aircraft. The reverse mode also makes a high noise that can alert any 

potential people on the ground. 

If the servo fails in 'level' or 'up' position, the aircraft may be able to continue to fly but with a 

degraded behaviour, likely loosing altitude in curves or having troubles to turn. If the aircraft cannot 

turn enough and leaves the working area, the motor is turned off to minimize the impact energy and 

the aircraft glides toward the ground. 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 9/31

A critical "Servo failure" message is shown in eMotion and a ringing alarm is raised when a servo is 

stuck or malfunctioning. Other warnings may appear such as "Cannot maintain altitude", "Roll 

instabilities" or "Pitch instabilities". 

2.5 Payloads 

(1) Internal. 

150-170 grams camera protected by the EPP body of the aircraft. 

(2) External: none 

3 Control and communication segment 

3.1 Avionics 

The eBee avionics is composed of the following components: 

 1 autopilot integrated in the body of the aircraft, which includes the central processing unit, a 

GPS receiver (with integrated antenna), and the telemetry modem (with an external antenna 

visible on the figure 1). The central processing unit PCB is fitted with an inertial measurement 

unit (accelerometer, gyrometers, and magnetometer), a barometer and a differential pressure 

sensor. 

 Figure 4: Autopilot schematics 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 10/31

 1 Pitot probe (visible in the figure 1) connected with tubes to the differential pressure sensor. 

 1 RC receiver with a wire antenna integrated into the fuselage. 

 1 optical flow sensor pointing downwards for ground proximity detection. 

3.2 Navigation 

The location is given by the GPS (x,y,z) and the barometer (z). 

The operator can modify the flight plan of the eBee at any time, using the flight management 

software interface or the remote controller. Additionally, the operator can instruct the eBee to hold 

(loiter) at its current position, return to the Home waypoint, initiate the planned landing procedure 

and immediately land in a spiral approach at the current location (see the User Manual for further 

details). 

The autopilot controls the altitude and trajectory of the eBee. If a loss of altitude due to loss of thrust 

(broken propeller, motor failure, etc.) is detected, the eBee will initiate an emergency glide landing 

towards the Home waypoint (see the User Manual for further details). 

There is no redundant navigation system implemented in the eBee other than the capability to 

switch to the manual mode. Should the autopilot malfunction, the operator can switch to this manual 

mode and gain direct access to the control surface through the remote control. 

Loss of heading: - When the wind is too strong and the ground speed cannot be held, the heading 

information might be temporarily lost and the aircraft will go backwind to regain the heading 

information. - When the GPS fails, the aircraft will start the emergency GPS-lost procedure and will 

hold a constant bank angle while gliding to the ground (motor off). 

If the GPS position is no longer available, which makes it impossible for the eBee to know where it is 

and thus to navigate, an emergency action is taken automatically: the eBee turns off its motor, sets 

a bank angle and glides in a large circle towards the ground, using the altitude data from the 

barometer. If there is a strong wind, the eBee may be pushed far from its current position. If a GPS 

position is re-acquired the eBee will abort the landing procedure and go to the Home waypoint. 

There is an automatic pre-flight test to check the GPS signal and the barometer values. If there is an 

error with the GPS, the barometer or inconsistent values, the aircraft is prevented from taking-off. If 

the error happens while in flight, the aircraft will use GPS altitude only and will go to the Home 

waypoint. If both the GPS and the barometer are malfunctioning, the eBee will start a controlled 

emergency landing procedure. 

3.3 UA Flight Controls 

The control surfaces are each actuated by a servo. The two servos are both activated by the 

autopilot through a regular RC interface with variable length pulse from 1 to 2ms, every 20ms. 

The operator can provide live input through the drag-and-drop interface of the eMotion software 

Possible in-flight adjustments include the addition and removal of waypoints, as well as the 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 11/31

modification of waypoints position. Alternatively, manual take-over is possible through a regular RC 

remote control. 

3.4 Autopilot 

The autopilot is designed by senseFly and is not a COTS product. 

When assembled, the autopilot is manually installed into the dedicated slot of the EPP fuselage. Its 

alignment with the airframe is calibrated during the manufacturing process. 

In the “automatic” mode, the autopilot has full, high-level control of the eBee. The only input is the 

flight plan. This flight plan is always stored on the autopilot. Thus, all commands issued keep the 

aircraft within structural limits. All autopilot commands (airspeed, pitch angle and roll angle) are 

bounded. 

 Airspeed: 10.5 - 25 m/s. 

 Roll: -60 - +60 degrees. 

 Pitch: -15 - +30 degrees. 

In the full manual mode, the pilot has full authority on the control surfaces and no input limitation is 

done by the autopilot. 

In order to test the autopilot, software in the loop simulations are performed. Indeed, the software 

simulator uses the same code for the high-level logics than the real aircraft. This allows us to test all 

the logics in simulation before flying. Moreover, real flight tests on dedicated platforms are 

conducted at our test center in Switzerland. 

3.5 Communication and control 

3.5.1 Architecture of the command and communication system 

The following diagram illustrates the communication between the various subsystems. 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 12/31

 

Figure 5: Architecture of the command and communication system 

The spectrum used for the communication between the ground control station and the aircraft is the 

ISM 2.4 GHz band. A unique, random ID is used to pair the ground modem and the air modem. No 

encryption is used. All ISM-based equipment (Wi-Fi, etc.) may interfere with the radio link. Thanks to 

the spread-spectrum technology, these interferences have only a limited effect (one packet). 

Nothing in particular is made to mitigate these interferences. 

The modem estimates link strength based on RSSI and displays it on the ground datalink modem 

with 3 LEDs (all LEDs switched on for the maximum signal strength). The ground station software 

displays a link strength percentage based on the rate of successfully transmitted packets. 

The only redundant link is the manual override RC link. 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 13/31

A working area radius and flight ceiling are defined. The eBee flight will be bounded by these 

parameters and the aircraft will return to the Home waypoint if the flight plan leads it beyond the 

working zone. It prevents the eBee from going beyond the communication range. 

The eBee will then not even start its mission (go to the first waypoint) if one of the pre-programmed 

waypoints is outside of the working area. 

However the eBee doesn’t rely on the ground station to operate. If the operator chooses so (this is 

enabled by default), the eBee will fly to the Home waypoint after 30s of not receiving any packet 

from the ground, in order to re-establish the communication link. 

Antenna masking during turns and pitch angles has not been detected. Communications are also 

unaffected by atmospheric attenuation including precipitations. 

3.5.2 Lost Link and Flight Recovery 

In order to determine if the aircraft is experiencing a lost link situation, the autopilot checks that no 

packets have been received during a certain period of time. The ground control station displays then 

a red warning indicating that the communication link is lost. 

In case of a lost link situation, the flight continues as planned. But the operator can also program the 

eBee (in eMotion 2) to automatically return to the Home Point if that scenario happens. 

The Home waypoint is defined by the user during flight planning using eMotion. When the eBee 

reaches this point, it will loiter at this location until the battery is low – at which point it will land 

according to the planned procedure. 

No flight recovery mechanism is implemented beyond adequate flight/navigation behaviour in 

response of detected problem. 

3.5.3 Control Station 

The control station consists of a laptop or tablet and the datalink USB modem. The laptop/tablet is 

used to run eMotion 2, the flight management software developed by SenseFly. 

On the main screen of eMotion 2, there is a Flight Monitoring tab displaying the flight information 

(User Manual section 5.5). 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 14/31

 

Figure 6: Display of flight parameters in eMotion 2 

On the main screen, the pilot can accurately determine the position of the aircraft, based on the 

GPS information (1 - 3 meters) for the (x, y) coordinates and barometer (10 cm accurate) for the 

altitude. For the attitude, the inertial measurement unit has a precision of 3-5 degrees. 

Several commands are safeguarded from inadvertent activation, like LAND NOW (3 clicks are 

required). Some other commands require acknowledgment of a warning message. 

Any inadvertent manipulation of the ground station software may cause an undesirable outcome. 

For example, an inadvertent waypoint displacement may cause the eBee to fly to an undesirable 

location. 

The ground control station software runs on Windows only. The operator is responsible for providing 

primary and backup power to the ground control station. The datalink modem is powered by the 

laptop or tablet via a USB connection. 

3.5.4 Control frequencies 

The bi-directional telemetry link used to connect the ground station and the eBee is based on 

modem which implements a custom 2.4 GHz FHSS, 100 mW datalink (FCC Part 15.247, IC 

RSS210, CE). 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 15/31

3.6 Ground Support Equipment 

No equipment is used but the laptop computer or tablet and the USB ground datalink modem. 

4 Processes and Procedures 

4.1 Configuration Management 

All changes in the hardware configuration are notified by a change in the version of the eBee (EB 

01-xxx-xxx ..... EB 03 - xxx-xxx). These changes are obviously logged internally with a tracking file 

for each unit produced. Quality of each manufactured eBee is ensured by one or more test flights 

with post-analysis of the flight data recorded by the different sensors. 

4.2 Software Management 

Users are automatically notified to the availability of software updates when the ground control 

software is launched. 

The ground station software verifies the embedded firmware upon connection to the eBee in order 

to ensure embedded software/ground software compatibility. 

Most embedded software is written in C. Ground control station software is written in C++ and is 

based on the Qt framework. 

4.3 Continuing airworthiness 

Reliability is asserted by extensive test flight during all phases of the development. Each drone 

assembled at senseFly goes through several quality and inspection tests (ground and in-flight tests) 

to ensure conformity of the product as defined in the specifications. Each drone is tied with a "quality 

control" document that follows the drone during its manufacturing process. This document is then 

archived at senseFly. 

SenseFly has also a servicing structure (after sales support team), which provides support to clients 

and monitors product quality control. In case a default is found, the support team backs the problem 

so that the Production & Industrialization department takes the necessary action in terms of quality 

or design (continued airworthiness). It is possible to do that internally because SenseFly masters all 

aspects of the design, from hardware to software. The end-users are notified directly when they use 

the flight management software or by email. 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 16/31

5 Operations 

5.1 National Airspace System (NAS) Integration and Interaction 

The eBee has a high-visibility paint scheme on the blisters (yellow colour) that enables other pilots 

to see and avoid the eBee and enables the observer(s) to visually acquire and track the UA. 

No specific support for ATC communication is implemented since the eBee stays usually in Class G 

Airspace. 

No specific support for pilot-to-pilot communication is implemented. 

No automatic method is implemented for sense-and-avoid of airborne objects. A working area radius 

can be defined in order to make sure that the eBee will not go beyond the line of sight of the 

operator. The eBee is also equipped with a ground proximity sensor that will detect ground proximity 

and initiate ground avoidance when reaching a height over ground of 30m or less. This feature can 

be disabled by the operator. 

5.2 Flight Phases 

5.2.1 Pre-flight / taxi operations 

1. Weather check 

2. Flight planning with eMotion2 (see Part 1 and 4 of the User Manual) on the field. 

For cached map data (OpenStreet Map, Bing, Ovi), the operator has to load the background map 

manually. For online maps (Google Map), the map is always displayed based on the latest mapping 

data available online. 

3. Programming of the linear landing according to the wind direction 

4. Aircraft inspection 

Each operator shall inspect (where applicable) the following components of the UAV: 

(a) Body: Fabric and skin - for deterioration, distortion, and other evidence of failure; 

(b) Flight controls - for deterioration or improper installation; 

(c) Batteries - for improper installation or deformation; 

(d) Engine section - for deterioration; 

(e) Propeller section (blades and rubber bands) - for cracks, nicks, binds or deterioration; 

(f) All components of the wings, body-section assembly and flight surfaces for poor general 

condition, fabric or skin deterioration, distortion, evidence of failure, and insecurity of attachment; 

(g) Camera system for improper installation, poor general condition, defects, and insecure 

attachment; 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 17/31

(h) Radio modem and electronic equipment, sensors (Pitot) - for improper installation and/or cracks. 

5.2.2 Take-off 

The motor is started by a specific shaking procedure (User Manual section 2.4). The motor is first 

started at very low power and current draw is monitored to detect if the propeller is free from any 

object. If this is the case, the motor is slowly ramped up to full power. At this point, the operator may 

launch the eBee. 

Step 1: Orient horizontally and against the wind. Orient yourself against the direction of the wind, 

and confirm that the take-off direction in front of you is free of obstacles. Firmly grasp the eBee with 

both hands, one hand on the front of each wing as shown in the figure. Hold the eBee horizontally 

with the nose pointed against the wind and level wings 

Step 2: Switch the motor on 

Shake the eBee back and forth 3 times longitudinally (within approx. 3 seconds) to begin the motor 

power-up sequence. The status LED will pulse blue until the motor is at full power and ready for 

take-off. 

Step 3: Launch the eBee 

Once the motor is at full power the status LED will blink green. Orient the eBee with approximately 

10 degrees nose up and level wings. When the angle is correct the status LED will turn solid green, 

indicating that the eBee is ready for take-off. Launch the eBee with a gentle push by walking 1-2 

steps forward while releasing it with both hands in a purely forward motion. After take-off, the eBee 

tries to maintain its initial direction by keeping its wings level with full thrust until reaching the takeoff transition height, by default 20 meters. 

At this point, it will switch into waypoint navigation mode and fly towards the Start waypoint. Once 

it reaches the Start waypoint location and height the eBee will circle around the waypoint 1-2 times 

to estimate the wind and calibrate its sensors before starting the mapping mission 

5.2.3 Flight 

A laptop and the USB datalink modem are needed to connect to the eBee, check its status and 

modify its flight plan. The drag-and-drop interface offered by the ground control station software 

(eMotion 2) allows the operator to modify the trajectory of the eBee in real-time. 

By default, the eBee flies autonomously and does not need the provided remote controller to be 

operated. However, by using the remote control, it is possible to override the eBee autopilot by 

switching to one of two available manual modes: Full Manual or Assisted Manual. 

In Full Manual mode the sticks of the remote controller directly set the motor power and the angle of 

the ailerons of the eBee. 

In Assisted Manual mode the sticks of the remote control are used to set the speed, turn rate and 

climb or sink rate. 

Turning on the remote controller will cause the eBee to change to either Assisted Manual or Full 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 18/31

Manual mode, depending on the mode set on the Ground Control Station in the Flight Parameters 

tab. To warn the operator that the eBee is operated in Manual / Assisted Manual mode, a 

continuous sound is emitted by the GCS. A visual yellow warning indicates that the aircraft is in 

manual mode. 

2. Turning off the remote control will cause the eBee to return to the last autonomous operation 

mode it was in before Manual mode was enabled, or a safe flight phase (if manual control was 

enabled during a critical flight phase). 

Note: Ensure that the "Ignore RC signals" option in the Flight Parameters tab is unchecked; 

otherwise the eBee will ignore the commands from the remote control and remain in autonomous 

operation mode 

5.2.4 Landing/recovery 

No equipment is required. The eBee offers two type of landing procedure: circular landing (based on 

GPS and barometer) and linear landing with a 20-degree slope. An optical ground sensor 

technology allows to flare when approaching the ground and to improve landing precision for the 

linear landing. 

5.2.5 Post flight 

Cleaning and after-flight maintenance operations (see document “Maintenance and procedures”) 

5.3 Emergencies and procedures 

5.3.1 Complete loss of control link 

If the option is enabled, the eBee flies towards the Home waypoint at an altitude defined by the 

Home waypoint's "Change altitude parameter" (by default, set to "Highest"). 

User action: Try to improve radio signal quality by following the instructions in section "Improving 

radio signal communication" of the user manual. 

5.3.2 Engine Failure 

The eBee attempts to re-start the electric motor. If the first attempt fails a “Critical Failure: 

Motor malfunction” warning is announced and the eBee starts an emergency landing procedure. 

User action: If the error disappears, land as soon as possible and perform Check 1 in section 

"Full airframe and sensor inspection". Otherwise, the aircraft will land automatically. 

If the motor is not working even after an attempted re-start commanded by a "Motor malfunction" Inflight warning, the eBee orients itself in the direction of the Home waypoint and glides towards the 

ground while continuously trying to re-start the motor. If the eBee reaches the Home waypoint with 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 19/31

sufficient altitude, it will enter the landing circuit without power and will re-adapt the base waypoint's 

position depending on its current altitude. 

If motor re-start is successful the eBee cancels the landing and flies towards the Home waypoint at 

an altitude defined by the Home waypoint's Change altitude parameter (by default, set to "Highest"). 

5.3.3 Propeller Loss 

In case of a propeller loss, the eBee will detect a motor failure and start the same procedure as the 

engine failure. 

5.3.4 Loss of GPS 

The GPS position is no longer available, which makes it impossible for the eBee to know where it is 

and to navigate. The eBee will turn off its motor, sets a constant bank angle and glide in a large 

circle towards the ground. If there is a strong wind the eBee may be pushed far from its current 

position. If a GPS fix is re-acquired the eBee will abort the landing procedure and go to the Home 

waypoint. 

5.3.5 Loss of heading information 

The eBee navigation is degraded and will likely result in a turn in the direction of the wind (back 

wind) to regain a ground speed and thus a GPS course information. However, the eBee 

automatically adapt its airspeed command to avoid having a low or null ground speed. This only 

happens if the wind is much stronger than the maximum wind allowed (> 18 m/s), or if the eBee is 

already in Critical failure state where the motor does not output thrust (motor failure, empty battery, 

GPS loss). 

5.3.6 Pitot system malfunction 

The aircraft will use GPS altitude only. 

5.3.7 Servo malfunction or loss 

In case of servo failure, the autopilot tries to keep the roll angle by using the other servo. 

If the servo fails in 'down' position, it is likely that the eBee will start to dive and accelerate. If 

reaching 30 m/s of airspeed, over-speed condition is detected and the motor is put into reverse 

mode to slow down the aircraft. The reverse mode is also noisy which can alert any potential people 

on the ground. 

If the servo fails in 'level' or 'up' position, the aircraft will possibly be able to continue to fly but with a 

degraded behaviour, including loss of altitude in curves and inhibited turning ability. If the aircraft 

cannot turn enough and leaves the working area, the motor is turned off to minimize impact energy 

and the aircraft glides toward the ground. 

Moreover, there is also a detection of servo malfunction. The autopilot correlates the output 

commands to the ailerons (expected positions) with the measured rotation rates (real positions 

found from simple model). When a servo fails, this error becomes huge and the autopilot is able to 

tell which servo is more likely to have failed. 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 20/31

5.3.8 Payload malfunction 

If the payload stops working, a warning appears on the ground control station and if set so, the 

aircraft will return to the Home waypoint. 

5.3.9 Loss of Autopilot 

- Partial: 

If the autopilot experiences a hard-fault due to external factors (electrical discharge) or due to a 

code issue, it will enter a special section of the code: Everything is stopped except direct manual 

control of the ailerons with the remote controller. The motor is switched off. 

- Total: 

If the autopilot shuts down (electrical failure), the eBee will stop controlling the ailerons. The motor 

will turn off and the aircraft will start an uncontrolled descent or spin. 

5.4 Manuals 

 User manual which includes: 

- 1 section with all of the aircraft limitations 

 - 1 section with all failures that can occur during the pre-flight tests and flights 

5.5 Organizational Considerations 

5.5.1 Training 

See document “training” 

5.5.2 Maintenance 

See document “Maintenance and procedures” 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 21/31

6 Annexes 

6.1 Annex 1: 3-View Drawings of the eBee 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 22/31

6.2 Annex 2: In-Flight safety actions 

In order to guarantee the safety of a mission, SenseFly has integrated safety actions as part of the 

autopilot and software pre-flight tests, as well as specific in-flight procedures. These fully automatic 

procedures are undertaken either by the operator (by clicking the matching button) or the autopilot 

(when sensors measure critical values of different parameters). 

6.2.1 In-flight manual safety actions 

During a flight, the operator can undertake the following actions by clicking the matching button: 

1. Hold: the UAV stops its mission and flies around its current position 

2. Resume: the UAV resumes its flight from the point where it stopped 

3. Go to Home/Start waypoint: the mission ends and the UAV goes back to its Home position (or 

the start position) 

4. Emergency landing: the aircraft gently lands at the current position, with the minimum possible 

vertical speed (circular landing). 

6.2.2 In-flight automatic safety actions 

The autopilot is continuously monitoring the status of its sensors and will activate emergency 

procedures as soon as any anomaly is detected. In the event of a failure that makes it impossible to 

reach the home location, an emergency landing procedure is initiated using a low-velocity gliding 

mode with engine off. 

- Empty battery: When the battery is empty (<5%), the eBee turns off its motor and glides towards 

the ground in the direction of the Home waypoint. 

This critical failure is always preceded by a low battery warning, which leads the aircraft to the Home 

waypoint. Thus, if the aircraft is not too far away, it is able to land safely on the Home waypoint. 

- Low battery: When the battery is low (<20%), a warning appears in eMotion 2 and the eBee flies 

back to the Home waypoint. 

- Loss of GPS signal: When the GPS position (or ‘fix’) is no longer available, which makes it 

impossible for the eBee to know where it is and thus to navigate, an emergency action is taken: the 

eBee turns off its motor, sets a bank angle and glides in a large circle around its current position. If 

there is a strong wind the eBee may be pushed far from its current position. If a GPS ‘fix’ is reacquired the eBee will abort the landing procedure and resume the mission. 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 23/31

- Barometer error: The barometer gives abnormal values. The eBee is programmed to go to the 

Home point using the altitude given by the GPS to control its approach. 

- Battery error: The measurement of the current voltage gives an abnormal value. The eBee is 

programmed to go to the Home point. 

- Airspeed error: The measurement of the air speed gives an unexpected value. The eBee is 

programmed to go to the Home point. 

- Out of working area: the eBee is out of the flight zone (Working area radius defined in eMotion 2). 

The eBee is programmed to go to the Home point. 

- Above working area: The aircraft exceeded the maximum flight ceiling of the flight zone. The 

eBee is programmed to go to the Home point 

- Far out of working area: The aircraft is out of the flight zone (defined in eMotion 2), due to strong 

wind conditions. The eBee is programmed to start its descent phase toward the Home Waypoint. 

- Poor GPS coverage: GPS signal is low (risk of signal loss). The eBee is programmed to go to the 

Home point. 

- Wind too strong: the measurement of the wind indicates that it is too strong. The eBee is 

programmed to go to the Home point. 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 24/31

6.3 Annex 3: Areas of operations 

UK Flight approval for VLOS operations 

Switzerland Flight approval for VLOS operations 

Australia Flight approval for VLOS operations 

Canada Flight approval for VLOS operations 

USA NMSU COA 

AWR certificate (Army Corps of Engineers) 

France Flight approval for E-VLOS operations 

Ireland Flight approval for VLOS operations 

Denmark Flight approval for VLOS operations 

Norway Flight approval for VLOS operations 

Germany Flight approval for VLOS operations 

Italy Flight approval for VLOS operations 

Netherlands Flight approval for VLOS operations 

Sweden Flight approval for VLOS operations 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 25/31

6.4 Annex 4: Safety analysis 

6.4.1 Considerations about risk related to ground impacts 

Early-flight termination 

Early flight termination, either controlled or uncontrolled, will result in ground or water impact. The 

diagram below summarizes the different failures that entail flight termination and related actions 

taken by the autopilot. 

Figure 4: Management of critical situations by the autopilot 

Under controlled emergency landing the autopilot will control the speed and orientation of the 

aircraft, thus reducing the probability of injuring people on the ground as well as damages to 

property and the aircraft itself. In case of a controlled emergency landing, the airspeed of the aircraft 

is close to 10 m/s and the kinetic energy will amount to 38 Joule at MTOW, which can be considered 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 26/31

harmless. In case of an uncontrolled emergency landing (e.g. loss of battery power or servo-motor 

lock), the vertical speed should never exceed 28 m/s, which corresponds to 180 J at MTOW. As a 

comparison, a soccer ball weighs about 450 g and can be kicked at up to 50 m/s, which 

corresponds to approximately 560 J. 

Calculation of the ELOS 

A standard way of quantifying the risk level in the aviation industry is through the Expected Level Of 

Safety (ELOS). In the commercial aviation a level of 3.7 · 10-7 fatalities on ground per hour of flight 

has been reached on average in the USA between 1989 and 2008 [5,6]. The 1309 AMC section of 

EASA CS 25 [2] refers to the same order of magnitude (10-7 per flight hour) as a maximum 

acceptable rate for hazardous events. 

The ICAT-2005-1 report by the MIT International Center for Air Transportation [9] proposes a 

method to evaluate the ELOS of UAS in terms of fatalities per hours of operation: 

ELOS = (1 / MTBF) · Aexp ·  · PPenetration

With: 

 ELOS: Equivalent Level of Safety (fatalities / hours of operation) 

 MTBF: Mean time between failures (hours); e.g. an MTBF of 50 is certainly a worst case 

scenario for the eBee; 

 Aexp: Lethal area; for the eBee, Aexp ≈ 0.04 m2 based on [9]; 

: Local population density (average value in the US: ρ = 113 inhabitant/km2); 

 PPenetration: probability of fatality per impact, should be set close to 5% for the eBee according 

to [9]. 

Here is the numerical application using the suggested values above: 

 ELOS = (1 / 50 h) · 0.04 m2 · 113 · 10-6 m-2 · 5% 

 = 4.5 · 10-9

The resulting value is typically lower than the one achieved by the commercial aviation, which 

denotes a lower risk, even though the MTBF of UAS is known to be smaller than with commercial 

aircraft. 

6.4.2 Considerations about the probability of mid-air collisions 

Airspace 

In general, the operator is responsible for avoiding any collision with other sky users. The risk of 

encountering other sky users can be lowered by flying at low altitude (generally <120m or 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 27/31

150m/AGL) and far from airports. It is also recommended to contact the local aviation authorities to 

be aware of the prevailing rules. 

To ensure that the eBee stays in a given area while flying, it is possible to define a working area 

radius and a flight ceiling in ground control software, eMotion. Furthermore, the eBee operator can 

take manual actions in case an other aircraft enters the zone: e.g. Go to the Home Waypoint, Go the 

Start Waypoint, Go Land, Initiate an emergency landing, Hold the mission (and loiter around its 

current position). 

Analogy with Birds 

It is interesting to note that the Airframe Bird Strike Airworthiness Standards (FAR 25) stipulates that 

any transport aircraft should be able to withstand a bird impact corresponding to two to three times 

the weight of the eBee. 

6.4.3 Pre-flight tests 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 28/31

 

6.4.4 Take-Off vetos 

There are several conditions that need to be fulfilled before the aircraft can accept a take-off order. 

The conditions are calculated continuously when in Idle and when the pre-flight checks are 

successful. The list of conditions is the following: 

- Low battery. 

- Security issue not acknowledged. 

- Wings not detected (eBee only). 

- USB cable plugged. 

- Pitch angle not horizontal. 

- Roll angle not horizontal. 

- Motor blocked. 

 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 29/31

 

6.4.5 References 

1. Joint JAA / Eurocontrol Initiative on UAVs (2004) A concept for European regulations for civil 

unmanned aerial vehicles (UAV). Final Report 

2. European Aviation Safety Agency (EASA) (2007) Certification specification 25 (CS25). 

Amendment 3 

3. European Aviation Safety Agency (EASA) (2005) A-NPA, No. 16/2005, policy for unmanned 

aerial vehicle (UAV) certification 

4. Joint Capability Group on Unmanned Aerial Vehicles (2007) STANAG 4671 – Unmanned Aerial 

Vehicle Systems Airworthiness Requirements (USAR). draft, NATO Naval Armaments Group 

5. National Transportation Safety Board (NTSB) (2008) Accident database and synopses. 

http://www.ntsb.gov/ntsb/query.asp 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 30/31

6. National Transportation Safety Board (NTSB) (2008) Aviation accident statistics. 

http://www.ntsb.gov/aviation/Stats.htm

7. Range Safety Group, Range Commanders Council (1999) Range safety criteria for unmanned air 

vehicles – rationale and methodology supplement. Supplement to document 323-99 

8. Range Safety Group, Range Commanders Council (2007) Common risk criteria standards for 

national test ranges: Supplement. Supplement to document 321-07 

9. Weibel RE, Hansman RJ (2005) Safety considerations for operation of small unmanned aerial 

vehicles in civil airspace. MIT Report No. ICAT-2005-1 March 2005. 

6.5 Annex 5: Command and control 
CONFIDENTIAL DOCUMENT

Author Document Title 

SenseFly eBee: justification of airworthiness and safety assessment Date Version 

 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 31/31