CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 1/31 

# Justification of airworthiness and safety assessment

Version Date Description Author

V 1.0 23.12.2013 Technical documentation SenseFly V2.0 04.04.2014 Correction SenseFlyCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 2/31 

## Table of content

1 INTRODUCTION .................................................................................................................. ...................... 4

2 AIRCRAFT SEGMEN T ......................................

........................................................................ ................ 4

2.1 A IRFRAME

.............................................................................................................................. ................... 4

2.1.1 Structure ..................................................................................................................... ........................ 4

2.1.2 Composition ................................................................................................................... .................... 5

2.1.3 Load analysis ................................................................................................................. .................... 5

2.1.4 Technical information ......................................................................................................... ............... 5

2.1.5 Performance characteristics ................................................................................................... ........... 6

2.2 P ROPULSION S YSTEM

.............................................................................................................................. .. 6

2.3 E LECTRICAL S YSTEM

.............................................................................................................................. .. 7

2.4 F LIGHT CONTROL SURFACES AND ACTUATORS .......................................................................................... 8

2.5 P AYLOADS

.............................................................................................................................. ................... 9

3 CONTROL AND COMMUNICATION SEGMENT ............................................................................... 9

3.1 A VIONICS

.............................................................................................................................. .................... 9

3.2 N AVIGATION

.............................................................................................................................. ............. 10

3.3 UA F LIGHT C ONTROLS ............................................................................................................................ 1 0

3.4 A UTOPILOT

.............................................................................................................................. ................ 11

3.5 C OMMUNICATION AND CONTROL ............................................................................................................ 11

3.5.1 Architecture of the command and communication system ............................................................... 11

3.5.2 Lost Link and Flight Recovery ................................................................................................. ........ 13

3.5.3 Control Station ............................................................................................................... .................. 13

3.5.4 Control frequencies ........................................................................................................... ............... 14

3.6 G ROUND S UPPORT E QUIPMENT ............................................................................................................... 15

4 PROCESSES AND PROCEDURES ...................................................................................................... ... 15

4.1 C ONFIGURATION M ANAGEMENT ............................................................................................................. 15

4.2 S OFTWARE M ANAGEMENT ...................................................................................................................... 15

4.3 C ONTINUING AIRWORTHINESS ................................................................................................................. 15

5 OPERATIONS .................................................................................................................... ........................ 16

5.1 N ATIONAL A IRSPACE S YSTEM (NAS) I NTEGRATION AND I NTERACTION ................................................ 16

5.2 F LIGHT P HASES

.............................................................................................................................. ......... 16

5.2.1 Pre-flight / taxi operations .................................................................................................. ............. 16

5.2.2 Take-off ...................................................................................................................... ...................... 17

5.2.3 Flight ........................................................................................................................ ........................ 17

5.2.4 Landing/recovery .............................................................................................................. ............... 18

5.2.5 Post flight ................................................................................................................... ...................... 18

5.3 E MERGENCIES AND PROCEDURES ............................................................................................................ 18

5.3.1 Complete loss of control link ................................................................................................. .......... 18

5.3.2 Engine Failure ................................................................................................................ ................. 18

5.3.3 Propeller Loss ................................................................................................................ .................. 19CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 3/31 5.3.4 Loss of GPS ................................................................................................................... ................... 19

5.3.5 Loss of heading information ................................................................................................... ......... 19

5.3.6 Pitot system malfunction ...................................................................................................... ............ 19

5.3.7 Servo malfunction or loss ..................................................................................................... ............ 19

5.3.8 Payload malfunction ........................................................................................................... ............. 20

5.3.9 Loss of Autopilot ............................................................................................................. ................. 20

5.4 M ANUALS

.............................................................................................................................. ................. 20

5.5 O RGANIZATIONAL C ONSIDERATIONS ...................................................................................................... 20

5.5.1 Training ...................................................................................................................... ...................... 20

5.5.2 Maintenance ................................................................................................................... .................. 20

6 ANNEXES ....................................................................................................................... ............................ 21

6.1 A NNEX 1: 3-V IEW D RAWINGS OF THE E B EE ............................................................................................ 21

6.2 A NNEX 2: I N -F LIGHT SAFETY ACTIONS .................................................................................................... 22

6.2.1 In-flight manual safety actions ............................................................................................... .......... 22

6.2.2 In-flight automatic safety actions ............................................................................................ ......... 22

6.3 A NNEX 3: A REAS OF OPERATIONS ........................................................................................................... 24

6.4 A NNEX 4: S AFETY ANALYSIS ................................................................................................................... 25

6.4.1 Considerations about risk rela ted to ground impacts ...................................................................... 25

6.4.2 Considerations about th e probability of mid-air collisions ............................................................. 26

6.4.3 Pre-flight tests .............................................................................................................. .................... 27

6.4.4 Take-Off vetos ................................................................................................................ .................. 28

6.4.5 References .................................................................................................................... .................... 29

6.5 A NNEX 5: C OMMAND AND CONTROL ....................................................................................................... 30CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 4/31 

## 1 Introduction

SenseFly is a Swiss company founded at the end of 2009. The company manufactures lightweight fixed-wing UAVs (500-750 grams) for mapping applications and develops eMotion, a very powerful software package for flight simulation and flight monitoring.

In June 2012, SenseFly joined the Parrot group, the manufacturer of the smartphone-driven AR Drone quadcopters for the hobby market. Within Parrot, senseFly is now leading the development of drones for professional use.

SenseFly masters all aspects of mini-drone development (from hardware to software) and is therefore capable of achieving very high levels of system integration.



## 2 Aircraft segment

2.1 Airframe

2.1.1 Structure

The eBee (see figure below) is a ready-to-launch UAV based on fixed-wing architecture. This simple and robust design provides aerodynamic efficiency, manoeuvrability and an excellent gliding ratio.

Figure 1 : Architecture of the eBeeCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 5/31 The four main characteristics of the eBee are:

a. Very lightweight The eBee is so light that the operator can launch it by hand and let it land on almost any surface without requiring a parachute or landing net (belly land). Its low impact energy (38 J In case of a controlled emergency landing) also significantly reduces the risk of third-party collision damage (see Annex 4, safety analysis). The wing is made of flexible foam with no sharp or hard edges and almost no internal strengthening structure.

b. Electric Powered The eBee is electric powered. A brushless engine technology makes it silent and reliable. The propeller is attached with a rubber band to the body of the plane so that it can easily flex away in case of contact or crash with any object.

c. Semi-Automatic flight The artificial intelligence incorporated within th e eBee autopilot system continuously analyzes data from the Inertial Measurement Unit and from the onboard GPS and takes care of all the aspects of the flight, even in the absence of radio connection with the laptop. Take-off and landing phases are also fully controlled by the autopilot.

d. Manual control Additionally, the eBee provides an override capability that allows the operator to take manual actions during the flight (Go to Home, Go Land, Hold and Resume the mission) and also suspend automated operations and take manual control of the aircraft should it become necessary to respond emergent circumstances, thanks to the re mote controller provided with the system.

2.1.2 Composition

Wings are composed of 25g/litre injected expanded polypropylene (EPP) and the fuselage is composed of 35g/litre injected EPP. The leading ed ge protection is ther mo-formed polycarbonate. Additional parts are made of injected fibre-reinforced ABS plastic.

The electronic components are installed inside the fuselage in dedicated cavities to ensure proper positioning. The EPP parts and carbon spars are manually glued with EPP glue.

2.1.3 Load analysis

In-flight testing of structural resistance has been conducted by experienced pilots. The airframe was subjected to the maximum possible aerodynamical load and airspeeds exceeding two times the regular flight envelope. Results showed that the structure is capable of withstanding all possible loads and no flutter arises throughout the flight envelope and beyond.

2.1.4 Technical information

 Wingspan: 96 cm

 Fuselage length: 60 cmCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 6/31  Central body: 40 cm x 16 cm x 6 cm

 MTOW (Maximum Take-Off Weight): 750 g (including battery, camera payload and all options)

 Empty weight (without battery, camera payload and options): 410 g ± 20 g

 7’’x 5’’ pusher propeller

2.1.5 Performance characteristics

 Maximum altitude: tested up to 17 000 feet ASL

 Nominal endurance with standard payload, no wind and 20°C: 50 min

 Airspeed: - Stall speed: 9 m/s - Cruise speed: 11 to 25 m/s - Never-exceed speed: 28 m/s

 Maximum rate of climb: 4 m/s, and 8 m/s during take-off, emergency ground avoidance and emergency climb procedure.

 Maximum rate of descent: 4 m/s, and 8 m/s during emergency descent procedure

 Maximum bank angle: 60 

### °

 Turn rate limits: 80°/s

 Maximum Headwind. 12 m/s

 Maximum Tailwind (launch/recovery) 12 m/s for launch, 12 m/s for recovery on grass, 5 m/s

on hard surface

 Maximum Crosswind. 12 m/s

 Maximum Gusts. 15 m/s

 Datalink range: 3-5 km

Weather limitations:

The eBee runs in light rain and light snow, with wind up to 12 m/s (27 mph). No visibility/lighting restrictions apply beyond within-line-of-sight operation requirements. The eBee has been tested in the -15° to 35°C OAT range (5°F to 95°F). No de -icing system is implemented so operations in icing

conditions must be avoided.



### 2.2 Propulsion System

The eBee propulsion system is based on a brushless DC motor with a dedicated electronic controller and a 2150 mAh 3S-cells Lithium-Polymer (LiPo) battery.

The maximum input electric power for the motor is 160W. It provides a thrust-to-weight ratio of more than 0.9 (static thrust of about 630 gram force), which allows for steep, high-performance take-offs.

The electric current draw is 2 to 16A. The LiPo battery is the sole source of electric current.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 7/31 The motor is attached to the bo dy of the aircraft with screws. The main screen of the flight management software eMotion 2 displays: - Raw voltage level - Estimated percentage of battery remaining (based on battery model, current voltage, integrated power used, etc...) - Ratio of estimated remaining energy versus the estimated energy required to reach the Home point.



### 2.3 Electrical System

The LiPo battery provides between 9 and 12.6 V to the system. A 3.3V bus, provided by the autopilot, powers the electronics and radio-modem. A 5V bus, provided by the motor controller, powers the RC receiver and the control surfaces servo.

Figure 2 : Cabling schematics eBeeCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 8/31



### 2.4 Flight control surfaces and actuators

The eBee is equipped with two control surfaces. The pitch rate is controlled with both control surfaces in the same direction. Roll rate is controlled by orienting the control surfaces in opposite directions. The yaw is passively stabilized by the winglets and the wing leading edge drag (flying wing).

The control surfaces are made of EPP and are conn ected to the wings. A thinner section of the EPP material acts as a hinge between the wings and the flight surfaces.

Failure may occur:

- At a local level on the servos; - At a local level on the link level between the servo and the control surface; - And at a global level – by breaking the control surface itself (e.g. EPP material tearing apart).

Figure 3 : Flight surfaces of the eBee (in yellow)

In case of servo failure, the autopilot tries to keep the roll angle with the other servo.

If the servo fails in 'down' position, it is likely that the eBee will dive and accelerate. If the aircraft achieves airspeed of 30 m/s, over-speed condition is detected and the motor is put in a reverse

mode to slow down the aircraft. The reverse m ode also makes a high noise that can alert any potential people on the ground.

If the servo fails in 'level' or 'up' position, the aircraft may be able to continue to fly but with a degraded behaviour, likely loosing altitude in curves or having troubles to turn. If the aircraft cannot turn enough and leaves the working area, the motor is turned off to minimize the impact energy and the aircraft glides toward the ground.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 9/31 A critical "Servo failure" message is shown in eMotion and a ringing alarm is raised when a servo is stuck or malfunctioning. Other warnings may appear such as "Cannot maintain altitude", "Roll

instabilities" or "Pitch instabilities".



### 2.5 Payloads

(1) Internal.

150-170 grams camera protected by the EPP body of the aircraft.

(2) External: none



## 3 Control and communication segment

3.1 Avionics

The eBee avionics is composed of the following components:

 1 autopilot integrated in the body of the aircraft, which includes the central processing unit, a GPS receiver (with integrated antenna), and the telemetry modem (with an external antenna visible on the figure 1). The central processing unit PCB is fitted with an inertial measurement unit (accelerometer, gyrometers, and magnetometer), a barometer and a differential pressure

sensor.

Figure 4 : Autopilot schematicsCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 10/31  1 Pitot probe (visible in the figure 1) connected with tubes to the differential pressure sensor.

 1 RC receiver with a wire antenna integrated into the fuselage.

 1 optical flow sensor pointing downwards for ground proximity detection.



### 3.2 Navigation

The location is given by the GPS (x,y,z) and the barometer (z).

The operator can modify the flight plan of the eBee at any time, using the flight management software interface or the remote controller. Additionally, the operator can instruct the eBee to hold (loiter) at its current position, return to the Ho me waypoint, initiate the planned landing procedure and immediately land in a spiral approach at the current location (see the User Manual for further details).

The autopilot controls the altitude and trajectory of the eBee. If a loss of altitude due to loss of thrust (broken propeller, motor failure, etc.) is detected, the eBee will initiate an emergency glide landing towards the Home waypoint (see the User Manual for further details).

There is no redundant navigati on system implemented in the eBee other than the capability to switch to the manual mode. Should the autopilot malfunction, the operator can switch to this manual mode and gain direct access to the control surface through the remote control.

Loss of heading: - When the wind is too strong and the ground speed cannot be held, the heading information might be temporarily lost and the aircraft will go backwind to regain the heading information. - When the GPS fails, the aircraft will start the emergency GPS-lost procedure and will hold a constant bank angle while gliding to the ground (motor off).

If the GPS position is no longer available, which makes it impossible for the eBee to know where it is and thus to navigate, an emergency action is taken automatically: the eBee turns off its motor, sets a bank angle and glides in a large circle towards the ground, using the altitude data from the barometer. If there is a strong wind, the eBee may be pushed far from its current position. If a GPS position is re-acquired the eBee will abort the landing procedure and go to the Home waypoint.

There is an automatic pre-flight test to check the GPS signal and the barometer values. If there is an error with the GPS, the barometer or inconsistent values, the aircraft is prevented from taking-off. If the error happens while in flight, the aircraft will use GPS altitude only and will go to the Home waypoint. If both the GPS and the barometer are malfunctioning, the eBee will start a controlled emergency landing procedure.



### 3.3 UA Flight Controls

The control surfaces are each actuated by a servo. The two servos are both activated by the autopilot through a regular RC interface with variable length pulse from 1 to 2ms, every 20ms.

The operator can provide live input through the drag-and-drop interface of the eMotion software Possible in-flight adjustments include the addition and removal of waypoints, as well as theCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 11/31 modification of waypoints position. Alternatively, manual take-over is possible through a regular RC

remote control.



### 3.4 Autopilot

The autopilot is designed by senseFly and is not a COTS product.

When assembled, the autopilot is manually installed into the dedicated slot of the EPP fuselage. Its alignment with the airframe is calibrated during the manufacturing process.

In the “automatic” mode, the autopilot has full, high-level control of the eBee. The only input is the flight plan. This flight plan is always stored on the autopilot. Thus, all commands issued keep the aircraft within structural limits. All autopilot commands (airspeed, pitch angle and roll angle) are

bounded.

 Airspeed: 10.5 - 25 m/s.

 Roll: -60 - +60 degrees.

 Pitch: -15 - +30 degrees.

In the full manual mode, the pilot has full authority on the control surfaces and no input limitation is done by the autopilot.

In order to test the autopilot, software in the loop simulations are performed. Indeed, the software simulator uses the same code for the high-level logics than the real aircraft. This allows us to test all the logics in simulation before flying. Moreover, real flight tests on dedicated platforms are

conducted at our test center in Switzerland.



### 3.5 Communication and control

3.5.1 Architecture of the command and communication system

The following diagram illustrates the communication between the various subsystems.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 12/31 Figure 5 : Architecture of the command and communication system

The spectrum used for the communication between the ground control station and the aircraft is the ISM 2.4 GHz band. A unique, random ID is used to pair the ground modem and the air modem. No encryption is used. All ISM-based equipment (Wi-Fi, etc.) may interfere with the radio link. Thanks to the spread-spectrum technology, these interferences have only a limited effect (one packet). Nothing in particular is made to mitigate these interferences.

The modem estimates link strength based on RSSI and displays it on the ground datalink modem with 3 LEDs (all LEDs switched on for the maxim um signal strength). The ground station software displays a link strength percentage based on the rate of successfully transmitted packets.

The only redundant link is the manual override RC link.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 13/31 A working area radius and flight ceiling are defined. The eBee flight will be bounded by these parameters and the aircraft will return to the Home waypoint if the flight plan leads it beyond the working zone. It prevents the eBee from going beyond the communication range.

The eBee will then not even start its mission (go to the first waypoint) if one of the pre-programmed waypoints is outside of the working area.

However the eBee doesn’t rely on the ground station to operate. If the operator chooses so (this is enabled by default), the eBee will fly to the Home waypoint after 30s of not receiving any packet from the ground, in order to re-establish the communication link.

Antenna masking during turns and pitch angles has not been detected. Communications are also unaffected by atmospheric attenuation including precipitations.

3.5.2 Lost Link and Flight Recovery

In order to determine if the aircraft is experiencing a lost link situation, t he autopilot checks that no packets have been received during a certain period of time. The ground control station displays then a red warning indicating that the communication link is lost.

In case of a lost link situation, the flight conti nues as planned. But the operator can also program the eBee (in eMotion 2) to automatically return to the Home Point if that scenario happens. The Home waypoint is defined by the user during flight planning using eMotion. When the eBee reaches this point, it will loiter at this location until the battery is low – at which point it will land according to the planned procedure.

No flight recovery mechanism is implemented beyond adequate flight/navigation behaviour in response of detected problem.

3.5.3 Control Station

The control station consists of a laptop or tablet and the datalink USB modem. The laptop/tablet is used to run eMotion 2, the flight management software developed by SenseFly.

On the main screen of eMotion 2, there is a Flight Monitoring tab displaying the flight information (User Manual section 5.5).CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 14/31 Figure 6 : Display of flight parameters in eMotion 2

On the main screen, the pilot can accurately determine the position of the aircraft, based on the GPS information (1 - 3 meters) for the (x, y) coordinates and barometer (10 cm accurate) for the altitude. For the attitude, the inertial measurement unit has a precision of 3-5 degrees.

Several commands are safeguarded from inadvertent activation, like LAND NOW (3 clicks are required). Some other commands require acknowledgment of a warning message.

Any inadvertent manipulation of the ground station software may cause an undesirable outcome. For example, an inadvertent waypoint displacement may cause the eBee to fly to an undesirable

location.

The ground control station software runs on Windows only. The operator is responsible for providing primary and backup power to the ground control station. The datalink modem is powered by the laptop or tablet via a USB connection.

3.5.4 Control frequencies

The bi-directional telemetry link used to connect the ground station and the eBee is based on modem which implements a custom 2.4 GHz FHSS, 100 mW datalink (FCC Part 15.247, IC RSS210, CE).CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 15/31



### 3.6 Ground Support Equipment

No equipment is used but the laptop computer or tablet and the USB ground datalink modem.



## 4 Processes and Procedures

4.1 Configuration Management

All changes in the hardware configuration are notified by a change in the version of the eBee (EB 01-xxx-xxx ..... EB 03 - xxx-xxx). These changes are obviously logged internally with a tracking file for each unit produced. Quality of each manufact ured eBee is ensured by one or more test flights with post-analysis of the flight data recorded by the different sensors.



### 4.2 Software Management

Users are automatically notified to the availabilit y of software updates when the ground control

software is launched.

The ground station software verifies the embedded firmware upon connection to the eBee in order to ensure embedded software/ground software compatibility.

Most embedded software is written in C. Ground c ontrol station software is written in C++ and is
based on the Qt framework.



### 4.3 Continuing airworthiness

Reliability is asserted by extensive test flight during all phases of the development. Each drone assembled at senseFly goes through several quality and inspection tests (ground and in-flight tests) to ensure conformity of the product as defined in the specifications. Each drone is tied with a "quality control" document that follows the drone during it s manufacturing process. This document is then archived at senseFly. SenseFly has also a servicing structure (after sales support team), which provides support to clients and monitors product quality control. In case a default is found, the support team backs the problem so that the Production & Industrialization department takes the necessary action in terms of quality or design (continued airworthiness). It is possible to do that internally because SenseFly masters all aspects of the design, from hardware to software. The end-users are notified directly when they use the flight management software or by email.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 16/31 

## 5 Operations

5.1 National Airspace System ( NAS) Integration and Interaction

The eBee has a high-visibility paint scheme on the blisters (yellow colour) that enables other pilots to see and avoid the eBee and enables the observer(s) to visually acquire and track the UA. No specific support for ATC communication is impl emented since the eBee stays usually in Class G Airspace.

No specific support for pilot-to-pilot communication is implemented.

No automatic method is implemented for sense-and-avoid of airborne objects. A working area radius can be defined in order to make sure that the eBee will not go beyond the line of sight of the operator. The eBee is also equipped with a ground proximity sensor that will detect ground proximity and initiate ground avoidance when reaching a height over ground of 30m or less. This feature can be disabled by the operator.



### 5.2 Flight Phases

5.2.1 Pre-flight / taxi operations

1. Weather check

2. Flight planning with eMotion2 (see Part 1 and 4 of the User Manual) on the field.

For cached map data (OpenStreet Map, Bing, Ovi), the operator has to load the background map manually. For online maps (Google Map), the map is always displayed based on the latest mapping

data available online.

3. Programming of the linear landing according to the wind direction

4. Aircraft inspection

Each operator shall inspect (where applicable) the following components of the UAV:

(a) Body: Fabric and skin - for deterioration, distortion, and other evidence of failure; (b) Flight controls - for deterioration or improper installation; (c) Batteries - for improper installation or deformation; (d) Engine section - for deterioration; (e) Propeller section (blades and rubber bands) - for cracks, nicks, binds or deterioration; (f) All components of the wings, body-section assembly and flight surfaces for poor general condition, fabric or skin deterioration, distortion, evidence of failure, and insecurity of attachment; (g) Camera system for improper installation, p oor general condition, defects, and insecure attachment;CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 17/31 (h) Radio modem and electronic equipment, sensors (Pitot) - for improper installation and/or cracks.

5.2.2 Take-off

The motor is started by a specific shaking procedu re (User Manual section 2.4). The motor is first started at very low power and current draw is monitored to detect if the propeller is free from any object. If this is the case, the motor is slowly rampe d up to full power. At th is point, the operator may

launch the eBee.

Step 1: Orient horizontally and against the wind. Orient yourself against the direction of the wind,

and confirm that the take-off direction in front of you is free of obstacles. Firmly grasp the eBee with both hands, one hand on the front of each wing as shown in the figure. Hold the eBee horizontally with the nose pointed against the wind and level wings

Step 2: Switch the motor on Shake the eBee back and forth 3 times longitudinally (within approx. 3 seconds) to begin the motor power-up sequence. The status LED will pulse blue until the motor is at full power and ready for

take-off.

Step 3: Launch the eBee Once the motor is at full power the status LED w ill blink green. Orient the eBee with approximately 10 degrees nose up and level wings. When the angle is correct the status LED will turn solid green, indicating that the eBee is ready for take-off. Launch the eBee with a gentle push by walking 1-2 steps forward while releasing it with both hands in a purely forward motion. After take-off, the eBeetries to maintain its initial direction by keeping its wings level with full thrust until reaching the takeoff transition height, by default 20 meters.

At this point, it will switch into waypoint naviga tion mode and fly towards the Start waypoint. Once it reaches the Start waypoint location and height the eBee will circle around the waypoint 1-2 times to estimate the wind and calibrate its sensors before starting the mapping mission

5.2.3 Flight

A laptop and the USB datalink modem are needed to connect to the eBee, check its status and modify its flight plan. The drag-and-drop interface offered by the ground control station software (eMotion 2) allows the operator to modify the trajectory of the eBee in real-time.

By default, the eBee flies autonomously and doe s not need the provided remote controller to be operated. However, by using the remote control, it is possible to override the eBee autopilot by switching to one of two available manual modes: Full Manual or Assisted Manual.

In Full Manual mode the sticks of the remote controller directly se t the motor power and the angle of

the ailerons of the eBee.

In Assisted Manual mode the sticks of the remote control are used to set the speed, turn rate and

climb or sink rate.

Turning on the remote controller will cause the eBee to change to either Assisted Manual or FullCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 18/31 Manual mode, depending on the mode set on the Ground Control Station in the Flight Parameters tab. To warn the operator that the eBee is operated in Manual / Assisted Manual mode, a continuous sound is emitted by the GCS. A visual yellow warning indicates that the aircraft is in

manual mode.

2. Turning off the remote control will cause the eBee to return to the last autonomous operation mode it was in before Manual mode was enabled, or a safe flight phase (if manual control was enabled during a critical flight phase).

Note: Ensure that the "Ignore RC signals" option in the Flight Parameters tab is unchecked; otherwise the eBee will ignore the commands from the remote control and remain in autonomous operation mode

5.2.4 Landing/recovery

No equipment is required. The eBee offers two type of landing procedure: circular landing (based on GPS and barometer) and linear landing with a 20-degree slope. An optical ground sensor technology allows to flare when approaching the ground and to improve landing precision for the linear landing.

5.2.5 Post flight

Cleaning and after-flight maintenance operations (see document “Maintenance and procedures”)



### 5.3 Emergencies and procedures

5.3.1 Complete loss of control link

If the option is enabled, the eBee flies towards the Home waypoint at an altitude defined by the Home waypoint's "Change altitude parameter" (by default, set to "Highest"). User action: Try to improve radio signal quality by following the instructions in section "Improving radio signal communication" of the user manual.

5.3.2 Engine Failure

The eBee attempts to re-start the electric moto r. If the first attempt fails a “Critical Failure: Motor malfunction” warning is announced and the eBee starts an emergency landing procedure.

User action: If the error disappears, land as so on as possible and perform Check 1 in section "Full airframe and sensor inspection". Otherwise, the aircraft will land automatically.

If the motor is not working even after an attempted re-start commanded by a "Motor malfunction" Inflight warning, the eBee orients itself in the direction of the Home waypoint and glides towards the ground while continuously trying to re-start the motor. If the eBee reaches the Home waypoint withCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 19/31 sufficient altitude, it will enter the landing circuit without power and will re-adapt the base waypoint's position depending on its current altitude. If motor re-start is successful the eBee cancels the landing and flies towards the Home waypoint at an altitude defined by the Home waypoint's Change altitude parameter (by default, set to "Highest").

5.3.3 Propeller Loss

In case of a propeller loss, the eBee will detect a motor failure and start the same procedure as the engine failure.

5.3.4 Loss of GPS

The GPS position is no longer available, which makes it impossible for the eBee to know where it is and to navigate. The eBee will turn off its motor, sets a constant bank angle and glide in a large circle towards the ground. If there is a strong wind the eBee may be pushed far from its current position. If a GPS fix is re-acquired the eBee will abort the landing procedure and go to the Home waypoint.

5.3.5 Loss of heading information

The eBee navigation is degraded and will likely resu lt in a turn in the direction of the wind (back wind) to regain a ground speed and thus a GPS course information. However, the eBee automatically adapt its airspeed command to avoid having a low or null ground speed. This only happens if the wind is much stronger than the maximum wind allowed (> 18 m/s), or if the eBee is already in Critical failure state where the motor does not output thrust (motor failure, empty battery, GPS loss).

5.3.6 Pitot system malfunction

The aircraft will use GPS altitude only.

5.3.7 Servo malfunction or loss

In case of servo failure, the autopilot tries to keep the roll angle by using the other servo. If the servo fails in 'down' position, it is likely that the eBee will start to dive and accelerate. If reaching 30 m/s of airspeed, over-speed condition is detected and the motor is put into reverse mode to slow down the aircraft. The reverse mode is also noisy which can alert any potential people on the ground. If the servo fails in 'level' or 'up' position, the airc raft will possibly be able to continue to fly but with a degraded behaviour, including loss of altitude in curves and inhibited turning ability. If the aircraft cannot turn enough and leaves the working area, the motor is turned off to minimize impact energy and the aircraft glides toward the ground.

Moreover, there is also a detection of servo malfunction. The autopilot correlates the output commands to the ailerons (expected positions) with the measured rotation rates (real positions found from simple model). When a servo fails, this error becomes huge and the autopilot is able to tell which servo is more likely to have failed.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 20/31 5.3.8 Payload malfunction

If the payload stops working, a warning appears on the ground control station and if set so, the aircraft will return to the Home waypoint.

5.3.9 Loss of Autopilot

- Partial: If the autopilot experiences a hard-fault due to external factors (electrical discharge) or due to a code issue, it will enter a special section of the code: Everything is stopped except direct manual

control of the ailerons wi th the remote controller. The motor is switched off.

- Total: If the autopilot shuts down (electrical failure), the eBee will stop controlling the ailerons. The motor will turn off and the aircraft will start an uncontrolled descent or spin.



### 5.4 Manuals

 User manual which includes:

- 1 section with all of the aircraft limitations - 1 section with all failures that can occur during the pre-flight tests and flights



### 5.5 Organizational Considerations

5.5.1 Training

See document “training”

5.5.2 Maintenance

See document “Maintenance and procedures”CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 21/31 

## 6 Annexes

6.1 Annex 1: 3-View Dr awings of the eBeeCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 22/31



### 6.2 Annex 2: In-Flight safety actions

In order to guarantee the safety of a mission, SenseFly has integrated safety actions as part of the autopilot and software pre-flight tests, as well as specific in-flight procedures. These fully automatic procedures are undertaken either by the operator (by clicking the matching button) or the autopilot (when sensors measure critical values of different parameters).

6.2.1 In-flight manual safety actions

During a flight, the operator can undertake the following actions by clicking the matching button:

1. Hold : the UAV stops its mission and flies around its current position

2. Resume : the UAV resumes its flight from the point where it stopped

3. Go to Home/Start waypoint : the mission ends and the UAV goes back to its Home position (or the start position)

4. Emergency landing : the aircraft gently lands at the current position, with the minimum possible vertical speed (circular landing).

6.2.2 In-flight automatic safety actions

The autopilot is continuously monitoring the status of its sensors and will activate emergency procedures as soon as any anomaly is detected. In the event of a failure that makes it impossible to reach the home location, an emergency landing procedure is initiated using a low-velocity gliding mode with engine off.

- Empty battery: When the battery is empty (<5%), the eBee turns off its motor and glides towards the ground in the direction of the Home waypoint.

This critical failure is always preceded by a low battery warning, which leads the aircraft to the Home waypoint. Thus, if the aircraft is not too far away, it is able to land safely on the Home waypoint.

- Low battery: When the battery is low (<20%), a warning appears in eMotion 2 and the eBee flies back to the Home waypoint.

- Loss of GPS signal : When the GPS position (or ‘fix’) is no longer available, which makes it impossible for the eBee to know where it is and thus to navigate, an emergency action is taken: the eBee turns off its motor, sets a bank angle and glides in a large circle around its current position. Ifthere is a strong wind the eBee may be pushed far from its current position. If a GPS ‘fix’ is reacquired the eBee will abort the landing procedure and resume the mission.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 23/31 - Barometer error : The barometer gives abnormal values. The eBee is programmed to go to the Home point using the altitude given by the GPS to control its approach.

- Battery error : The measurement of the current voltage gives an abnormal value. The eBee is programmed to go to the Home point.

- Airspeed error: The measurement of the air speed gives an unexpected value. The eBee is programmed to go to the Home point.

- Out of working area : the eBee is out of the flight zone (Working area radius defined in eMotion 2). The eBee is programmed to go to the Home point.

- Above working area : The aircraft exceeded the maximum flight ceiling of the flight zone. The eBee is programmed to go to the Home point

- Far out of working area : The aircraft is out of the flight zone (defined in eMotion 2), due to strong wind conditions. The eBee is programmed to start its descent phase toward the Home Waypoint.

- Poor GPS coverage: GPS signal is low (risk of signal loss). The eBee is programmed to go to the Home point.

- Wind too strong : the measurement of the wind indicates that it is too strong. The eBee is programmed to go to the Home point.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 24/31



### 6.3 Annex 3: Areas of operations

UK Flight approval for VLOS operations

Switzerland Flight approval for VLOS operations

Australia Flight approval for VLOS operations

Canada Flight approval for VLOS operations

USA NMSU COA AWR certificate (Army Corps of Engineers)

France Flight approval for E-VLOS operations

Ireland Flight approval for VLOS operations

Denmark Flight approval for VLOS operations

Norway Flight approval for VLOS operations

Germany Flight approval for VLOS operations

Italy Flight approval for VLOS operations

Netherlands Flight approval for VLOS operations

Sweden Flight approval for VLOS operationsCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 25/31



### 6.4 Annex 4: Safety analysis

6.4.1 Considerations about risk related to ground impacts

Early-flight termination

Early flight termination, either controlled or uncontrolled, will result in ground or water impact. The diagram below summarizes the different failures that entail flight termination and related actions taken by the autopilot.

Figure 4 : Management of critical situations by the autopilot

Under controlled emergency landing the autopilot will control the speed and orientation of the aircraft, thus reducing the probability of injuring people on the ground as well as damages to property and the aircraft itself. In case of a controlled emergency landing, the airspeed of the aircraft is close to 10 m/s and the kinetic energy will amount to 38 Joule at MTOW, which can be consideredCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 26/31 harmless. In case of an uncontrolled emergency landing (e.g. loss of battery power or servo-motor lock), the vertical speed should never exceed 28 m/s, which corresponds to 180 J at MTOW. As a comparison, a soccer ball weighs about 450 g and can be kicked at up to 50 m/s, which corresponds to approximately 560 J.

Calculation of the ELOS
A standard way of quantifying the risk level in the aviation industry is through the Expected Level Of Safety (ELOS). In the commercial aviation a level of 3.7 · 10 -7 fatalities on ground per hour of flight has been reached on average in the USA between 1989 and 2008 [5,6]. The 1309 AMC section of EASA CS 25 [2] refers to the same order of magnitude (10 -7 per flight hour) as a maximum acceptable rate for hazardous events.

The ICAT-2005-1 report by the MIT International Center for Air Transportation [9] proposes a method to evaluate the ELOS of UAS in terms of fatalities per hours of operation:

ELOS = (1 / MTBF) · A exp ·  · P Penetration

With:

ELOS: Equivalent Level of Safety (fatalities / hours of operation)

MTBF: Mean time between failures (hours); e.g. an MTBF of 50 is certainly a worst case scenario for the eBee;

A exp : Lethal area; for the eBee, A exp ≈ 0.04 m 2 based on [9];

 : Local population density (average value in the US: ρ = 113 inhabitant/km 2 );

P Penetration : probability of fatality per impact, should be set close to 5% for the eBee according to [9].

Here is the numerical application using the suggested values above:

ELOS = (1 / 50 h) · 0.04 m 2 · 113 · 10 -6 m -2 · 5%

= 4.5 · 10 -9

The resulting value is typically lower than the one achieved by the commercial aviation, which denotes a lower risk, even though the MTBF of UAS is known to be smaller than with commercial

aircraft.

6.4.2 Considerations about the pr obability of mid-air collisions

Airspace

In general, the operator is responsible for avoiding any collision with other sky users. The risk of encountering other sky users can be lowered by fl ying at low altitude (generally <120m orCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 27/31 150m/AGL) and far from airports. It is also recommended to contact the local aviation authorities to be aware of the prevailing rules.

To ensure that the eBee stays in a given area while flying, it is possible to define a working area radius and a flight ceiling in ground control software, eMotion. Furthermore, the eBee operator can

take manual actions in case an other aircraft enters the zone: e.g. Go to the Home Waypoint, Go the Start Waypoint, Go Land, Initiate an emergency landing, Hold the mission (and loiter around its current position).

Analogy with Birds

It is interesting to note that the Airframe Bird Strike Airworthiness Standards (FAR 25) stipulates that any transport aircraft should be able to withstand a bird impact corresponding to two to three times the weight of the eBee.

6.4.3 Pre-flight testsCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 28/31 6.4.4 Take-Off vetos

There are several conditions that need to be fulfilled before the aircraft can accept a take-off order. The conditions are calculated continuously when in Idle and when the pre-flight checks are successful. The list of conditions is the following: - Low battery. - Security issue not acknowledged. - Wings not detected (eBee only). - USB cable plugged. - Pitch angle not horizontal. - Roll angle not horizontal.

- Motor blocked.CONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 29/31 6.4.5 References

1. Joint JAA / Eurocontrol Initiative on UAVs (2004) A concept for European regulations for civil unmanned aerial vehicles (UAV). Final Report

2. European Aviation Safety Agency (EASA) (2007) Certification specification 25 (CS25).

Amendment 3

3. European Aviation Safety Agency (EASA) (2 005) A-NPA, No. 16/2005, policy for unmanned aerial vehicle (UAV) certification

4. Joint Capability Group on Unmanned Aerial Vehi cles (2007) STANAG 4671 – Unmanned Aerial Vehicle Systems Airworthiness Requirements (USAR). draft, NATO Naval Armaments Group

5. National Transportation Safety Board (NTSB) (2008) Accident database and synopses. http://www.ntsb.gov/ntsb/query.aspCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 30/31 6. National Transportation Safety Board (NTSB) (2008) Aviation accident statistics. http://www.ntsb.gov/aviation/Stats.htm

7. Range Safety Group, Range Commanders Council (1999) Range safety criteria for unmanned air vehicles – rationale and methodology supplement. Supplement to document 323-99

8. Range Safety Group, Range Commanders Council (2007) Common risk criteria standards for national test ranges: Supplement. Supplement to document 321-07

9. Weibel RE, Hansman RJ (2005) Safety considerations for operation of small unmanned aerial vehicles in civil airspace. MIT Report No. ICAT-2005-1 March 2005.



### 6.5 Annex 5: Comma nd and controlCONFIDENTIAL DOCUMENT

Author Document Title SenseFly eBee: justification of airworthiness and safety assessment

Date Version 04.04.14 V02

Proprietary Information Submitted under 14 C.F.R. 11.35(b) Page 31/31