This section of the FEDERAL REGISTER

contains regulatory documents having general

applicability and legal effect, most of which

are keyed to and codified in the Code of

Federal Regulations, which is published under

50 titles pursuant to 44 U.S.C. 1510.

The Code of Federal Regulations is sold by

the Superintendent of Documents.

Rules and Regulations Federal Register

10687 

Vol. 87, No. 38 

Friday, February 25, 2022 

DEPARTMENT OF TRANSPORTATION 

Federal Aviation Administration 

14 CFR Part 21 

[Docket No. FAA–2020–1084] 

Airworthiness Criteria: Special Class 

Airworthiness Criteria for the Zipline 

International Inc. Zip UAS Sparrow 

Unmanned Aircraft 

AGENCY: Federal Aviation 

Administration (FAA), DOT 

ACTION: Issuance of final airworthiness 

criteria. 

SUMMARY: The FAA announces the 

special class airworthiness criteria for 

the Zipline International Inc. Model Zip 

UAS Sparrow unmanned aircraft (UA). 

This document sets forth the 

airworthiness criteria the FAA finds to 

be appropriate and applicable for the 

UA design. 

DATES: These airworthiness criteria are 

effective March 28, 2022. 

FOR FURTHER INFORMATION CONTACT: 

Christopher J. Richards, Emerging 

Aircraft Strategic Policy Section, AIR– 

618, Strategic Policy Management 

Branch, Policy and Innovation Division, 

Aircraft Certification Service, Federal 

Aviation Administration, 6020 28th 

Avenue South, Room 103, Minneapolis, 

MN 55450, telephone (612) 253–4559. 

SUPPLEMENTARY INFORMATION: 

Background 

Zipline International Inc. (Zipline) 

applied to the FAA on March 25, 2019, 

for a special class type certificate under 

Title 14, Code of Federal Regulations 

(14 CFR) 21.17(b) for the Model Zip 

UAS Sparrow (Zip) unmanned aircraft 

system (UAS). 

The Model Zip consists of an airplane 

UA and its associated elements (AE) 

including communication links and 

components that control the UA. The 

Model Zip UA has a maximum gross 

takeoff weight of 50 pounds. It has a 

wingspan of approximately 11 feet, is 

approximately 6 feet in length, and 2 

feet in height. The Model Zip UA uses 

battery-powered electric motors for 

takeoff, landing, and forward flight. The 

UAS operations would rely on high 

levels of automation and may include 

multiple UA operated by a single pilot, 

up to a ratio of 20 UA to 1 pilot. Zipline 

anticipates operators will use the Model 

Zip for transporting medical materials. 

The proposed concept of operations 

(CONOPS) for the Model Zip identifies 

a maximum operating altitude of 400 

feet above ground level (AGL), a 

maximum cruise speed of 56 knots, 

operations beyond visual line of sight 

(BVLOS) of the pilot, and operations 

over human beings. Zipline has not 

requested type certification for flight 

into known icing for the Model Zip. 

The FAA issued a notice of proposed 

airworthiness criteria for the Zipline 

Model Zip, which published in the 

Federal Register on November 20, 2020 

(85 FR 74285). 

Summary of Changes From the 

Proposed Airworthiness Criteria 

Based on the comments received, 

these final airworthiness criteria reflect 

the following changes, as explained in 

more detail under Discussion of 

Comments: A new section containing 

definitions; revisions to the CONOPS 

requirement; changing the term ‘‘critical 

part’’ to ‘‘flight essential part’’ in 

D&R.135; changing the basis of the 

durability and reliability testing from 

population density to limitations 

prescribed for the operating 

environment identified in the 

applicant’s CONOPS per D&R.001; and, 

for the demonstration of certain 

required capabilities and functions as 

required by D&R.310. 

Additionally, the FAA re-evaluated its 

approach to type certification of lowrisk UA using durability and reliability 

testing. Safe UAS operations depend 

and rely on both the UA and the AE. As 

explained in FAA Memorandum 

AIR600–21–AIR–600–PM01, dated July 

13, 2021, the FAA has revised the 

airworthiness criteria to define a 

boundary between the UA type 

certification and subsequent operational 

evaluations and approval processes for 

the UAS (i.e., waivers, exemptions, and/ 

or operating certificates). 

To reflect that these airworthiness 

criteria rely on durability and reliability 

(D&R) testing for certification, the FAA 

changed the prefix of each section from 

‘‘UAS’’ to ‘‘D&R.’’ 

Lastly, the FAA revised D&R.001(g) to 

clarify that the operational parameters 

listed in that paragraph are examples 

and not an all-inclusive list. 

Discussion of Comments 

The FAA received responses from 19 

commenters. The majority of 

commenters were individuals. In 

addition to the individuals’ comments, 

the FAA also received comments from 

the European Union Aviation Safety 

Agency (EASA), unmanned aircraft 

manufacturers, a helicopter operator, 

and organizations such as the Air Line 

Pilots Association (ALPA), the 

Commercial Drone Alliance (CDA), 

Droneport Texas, LLC, the National 

Agricultural Aviation Association 

(NAAA), Northeast UAS Airspace 

Integration Research Alliance, Inc. 

(NUAIR), and the Small UAV Coalition. 

Support 

Comment Summary: ALPA, CDA, 

Novant Health, NUAIR, and the Small 

UAV Coalition expressed support for 

type certification as a special class of 

aircraft and establishing airworthiness 

criteria under § 21.17(b). The Small 

UAV Coalition also supported the 

FAA’s proposed use of performancebased standards. 

Terminology: Loss of flight 

Comment Summary: An individual 

commenter requested the FAA define 

the term ‘‘loss of flight’’ and clarify how 

it is different from ‘‘loss of control.’’ The 

commenter questioned whether loss of 

flight meant the UA could not continue 

its intended flight plan but could safely 

land or terminate the flight. 

FAA Response: The FAA has added a 

new section, D&R.005, to define the 

terms ‘‘loss of flight’’ and ‘‘loss of 

control’’ for the purposes of these 

airworthiness criteria. ‘‘Loss of flight’’ 

refers to a UA’s inability to complete its 

flight as planned, up to and through its 

originally planned landing. ‘‘Loss of 

flight’’ includes scenarios where the UA 

experiences controlled flight into terrain 

or obstacles, or any other collision, or a 

loss of altitude that is severe or nonrecoverable. ‘‘Loss of flight’’ includes 

deploying a parachute or ballistic 

recovery system that leads to an 

unplanned landing outside the 

operator’s designated recovery zone. 


lotter on DSK11XQN23PROD with RULES1
10688 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations 

1See 49 U.S.C. 44801(11). 

2See 49 U.S.C. 44801(12). 

‘‘Loss of control’’ means an 

unintended departure of an aircraft from 

controlled flight. It includes control 

reversal or an undue loss of 

longitudinal, lateral, and directional 

stability and control. It also includes an 

upset or entry into an unscheduled or 

uncommanded attitude with high 

potential for uncontrolled impact with 

terrain. ‘‘Loss of control’’ means a spin, 

loss of control authority, loss of 

aerodynamic stability, divergent flight 

characteristic, or similar occurrence, 

which could generally lead to a crash. 

Terminology: Skill and Alertness of 

Pilot 

Comment Summary: Two 

commenters requested the FAA clarify 

terminology with respect to piloting 

skill and alertness. Droneport Texas LLC 

stated that the average pilot skill and 

alertness is currently undefined, as 

remote pilots do not undergo oral or 

practical examinations to obtain 

certification. NUAIR noted that, despite 

the definition of ‘‘exceptional piloting 

skill and alertness’’ in Advisory Circular 

(AC) 23–8C, Flight Test Guide for 

Certification of Part 23 Airplanes, there 

is a significant difference between the 

average skill and alertness of a remote 

pilot certified under 14 CFR part 107 

and a pilot certified under 14 CFR part 

61. The commenter requested the FAA 

clarify the minimum qualifications and 

ratings to perform as a remote pilot of 

a UAS with a type certificate. 

FAA Response: These airworthiness 

criteria do not require exceptional 

piloting skill and alertness for testing. 

The FAA included this as a requirement 

to ensure the applicant passes testing by 

using pilots of average skill who have 

been certificated under part 61, as 

opposed to highly trained pilots with 

thousands of hours of flight experience. 

Concept of Operations 

The FAA proposed a requirement for 

the applicant to submit a CONOPS 

describing the UAS and identifying the 

intended operational concepts. The 

FAA explained in the preamble of the 

notice of proposed airworthiness criteria 

that the information in the CONOPS 

would determine parameters for testing 

and flight manual operating limitations. 

Comment Summary: One commenter 

stated that the airworthiness criteria are 

generic and requested the FAA add 

language to proposed UAS.001 to clarify 

that some of the criteria may not be 

relevant or necessary. 

FAA Response: Including the 

language requested by the commenter 

would be inappropriate, as these 

airworthiness criteria are projectspecific. Thus, in this case, each 

element of these airworthiness criteria is 

a requirement specific to the type 

certification of Zipline’s proposed UA 

design. 

Comment Summary: ALPA requested 

the criteria specify that the applicant’s 

CONOPS contain sufficient detail to 

determine the parameters and extent of 

testing, as well as operating limitations 

placed on the UAS for its operational 

uses. 

FAA Response: The FAA agrees and 

has updated D&R.001 to clarify that the 

information required for inclusion in 

the CONOPS proposal (D&R.001(a) 

through (g)) must be described in 

sufficient detail to determine the 

parameters and extent of testing and 

operating limitations. 

Comment Summary: ALPA requested 

the CONOPS include a description of a 

means to ensure separation from other 

aircraft and perform collision avoidance 

maneuvers. ALPA stated that its 

requested addition to the CONOPS is 

critical to the safety of other airspace 

users, as manned aircraft do not easily 

see most UAs. 

FAA Response: The FAA agrees and 

has updated D&R.001 to require that the 

applicant identify collision avoidance 

equipment (whether onboard the UA or 

part of the AE), if the applicant requests 

to include that equipment. 

Comment Summary: ALPA requested 

the FAA add security-related (other than 

cyber-security) requirements to the 

CONOPS criteria, including mandatory 

reporting of security occurrences, 

security training and awareness 

programs for all personnel involved in 

UAS operations, and security standards 

for the transportation of goods, similar 

to those for manned aviation. 

FAA Response: The type certificate 

only establishes the approved design of 

the UA. Operations and operational 

requirements, including those regarding 

security occurrences, security training, 

and package delivery security standards 

(other than cybersecurity airworthiness 

design requirements) are beyond the 

scope of the airworthiness criteria 

established by this document and are 

not required for type certification. 

Comment Summary: UAS.001(c) 

proposed to require that the applicant’s 

CONOPS include a description of 

meteorological conditions. ALPA 

requested the FAA change UAS.001(c) 

to require a description of 

meteorological and environmental 

conditions and their operational limits. 

ALPA stated the CONOPS should 

include maximum wind speeds, 

maximum or minimum temperatures, 

maximum density altitudes, and other 

relevant phenomena that will limit 

operations or cause operations to 

terminate. 

FAA Response: D&R.001(c) and 

D&R.125 address meteorological 

conditions, while D&R.001(g) addresses 

environmental considerations. The FAA 

determined that these criteria are 

sufficient to cover the weather 

phenomena mentioned by the 

commenter without specifically 

requiring identification of related 

operational limits. 

Control Station 

To address the risks associated with 

loss of control of the UA, the FAA 

proposed that the applicant design the 

control station to provide the pilot with 

all information necessary for continued 

safe flight and operation. 

Comment Summary: ALPA and two 

individual commenters requested the 

FAA revise the proposed criteria to add 

requirements for the control station. 

Specifically, these commenters 

requested the FAA include the display 

of data and alert conditions to the pilot, 

physical security requirements for both 

the control station and the UAS storage 

area, design requirements that minimize 

negative impact of extended periods of 

low pilot workload, transfer of control 

between pilots, and human factors/ 

human machine interface 

considerations for handheld controls. 

NUAIR requested the FAA designate the 

control station as a flight critical 

component for operations. 

EASA and an individual commenter 

requested the FAA consider flexibility 

in some of the proposed criteria. EASA 

stated that the list of information in 

proposed UAS.100 is too prescriptive 

and contains information that may not 

be relevant for highly automated 

systems. The individual commenter 

requested that the FAA allow part-time 

or non-continuous displays of required 

information that do not influence the 

safety of the flight. 

FAA Response: Although the scope of 

the proposed airworthiness criteria 

applied to the entire UAS, the FAA has 

re-evaluated its approach to type 

certification of low-risk unmanned 

aircraft using durability and reliability 

testing. A UA is an aircraft that is 

operated without the possibility of 

direct human intervention from within 

or on the aircraft.1 A UAS is defined as 

a UA and its AE, including 

communication links and the 

components that control the UA, that 

are required to operate the UAS safely 

and efficiently in the national airspace 

system.2 As explained in FAA 


lotter on DSK11XQN23PROD with RULES1
Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations 10689 

Memorandum AIR600–21–AIR–600– 

PM01, dated July 13, 2021, the FAA 

determined it will apply the regulations 

for type design approval, production 

approval, conformity, certificates of 

airworthiness, and maintenance to only 

the UA and not to the AE. However, 

because safe UAS operations depend 

and rely on both the UA and the AE, the 

FAA will consider the AE in assessing 

whether the UA meets the airworthiness 

criteria that comprise the certification 

basis. 

While the AE items themselves will 

be outside the scope of the UA type 

design, the applicant will provide 

sufficient specifications for any aspect 

of the AE, including the control station, 

which could affect airworthiness. The 

FAA will approve either the specific AE 

or minimum specifications for the AE, 

as identified by the applicant, as part of 

the type certificate by including them as 

an operating limitation in the type 

certificate data sheet and flight manual. 

The FAA may impose additional 

operating limitations specific to the AE 

through conditions and limitations for 

inclusion in the operational approval 

(i.e., waivers, exemptions, or a 

combination of these). In accordance 

with this approach, the FAA will 

consider the entirety of the UAS for 

operational approval and oversight. 

Accordingly, the FAA has revised the 

criteria by replacing proposed section 

UAS.100, applicable to the control 

station design, with D&R.100, UA Signal 

Monitoring and Transmission, with 

substantively similar criteria that apply 

to the UA design. The FAA has also 

added a new section, D&R.105, UAS AE 

Required for Safe UA Operations, which 

requires the applicant to provide 

information concerning the 

specifications of the AE. The FAA has 

moved the alert function requirement 

proposed in UAS.100(a) to new section 

D&R.105(a)(1)(i). As part of the 

clarification of the testing of the 

interaction between the UA and AE, the 

FAA has added a requirement to 

D&R.300(h) for D&R testing to use 

minimum specification AE. This 

addition requires the applicant to 

demonstrate that the limits proposed for 

those AE will allow the UA to operate 

as expected throughout its service life. 

Finally, the FAA has revised references 

throughout the airworthiness criteria 

from ‘‘UAS’’ to ‘‘UA,’’ as appropriate, to 

reflect the FAA determination that the 

regulations for type design approval, 

production approval, conformity, 

certificates of airworthiness, and 

maintenance apply to only the UA. 

Software 

The FAA proposed criteria on 

verification, configuration management, 

and problem reporting to minimize the 

existence of errors associated with UAS 

software. 

Comment Summary: ALPA requested 

the FAA add language to the proposed 

criteria to ensure that some level of 

software engineering principles are used 

without being too prescriptive. 

FAA Response: By combining the 

software testing requirement of 

D&R.110(a) with successful completion 

of the requirements in the entire 

‘‘Testing’’ subpart, the acceptable level 

of software assurance will be identified 

and demonstrated. The configuration 

management system required by 

D&R.110(b) will ensure that the software 

is adequately documented and traceable 

both during and after the initial type 

certification activities. 

Comment Summary: EASA suggested 

the criteria require that the applicant 

establish and correctly implement 

system requirements or a structured 

software development process for 

critical software. 

FAA Response: Direct and specific 

evaluation of the software development 

process is more detailed than what the 

FAA intended with the proposed 

criteria, which use D&R testing to 

evaluate the UAS as a whole system, 

rather than evaluating individual 

components within the UA. Successful 

completion of the testing requirements 

provides confidence that the 

components that make up the UA 

provide an acceptable level of safety, 

commensurate to the low-risk nature of 

this aircraft. The FAA finds no change 

to the airworthiness criteria is needed. 

Comment Summary: Two individual 

commenters requested the FAA require 

the manned aircraft software 

certification methodology in RTCA DO– 

178C, Software Considerations in 

Airborne Systems and Equipment 

Certification, for critical UA software. 

FAA Response: Under these 

airworthiness criteria, only software that 

may affect the safe operation of the UA 

must be verified by test. To verify by 

test, the applicant will need to provide 

an assessment showing that other 

software is not subject to testing because 

it has no impact on the safe operation 

of the UA. For software that is subject 

to testing, the FAA may accept multiple 

options for software qualification, 

including DO–178C. Further, specifying 

that applicants must comply with DO– 

178 would be inconsistent with the 

FAA’s intent to issue performance-based 

airworthiness criteria. 

Comment Summary: NAAA stated 

that an overreliance of software in 

aircraft has been and continues to be a 

source of accidents and requested the 

FAA include criteria to prevent a midair 

collision. 

FAA Response: The proper 

functioning of software is an important 

element of type certification, 

particularly with respect to flight 

controls and navigation. The 

airworthiness criteria in D&R.110 are 

meant to provide an acceptable level of 

safety commensurate with the risk 

posed by this UA. Additionally, the 

airworthiness criteria require 

contingency planning per D&R.120 and 

the demonstration of the UA’s ability to 

detect and avoid other aircraft in 

D&R.310, if requested by the applicant. 

The risk of a midair collision will be 

minimized by the operating limitations 

that result from testing based on the 

operational parameters identified by the 

applicant in its CONOPS (such as 

geographic operating boundaries, 

airspace classes, and congestion of the 

proposed operating area), rather than by 

specific mitigations built into the 

aircraft design itself. These criteria are 

sufficient due to the low-risk nature of 

the Model Zip. 

Cybersecurity 

Because the UA requires a continuous 

wireless connection, the FAA proposed 

criteria to address the risks to the UAS 

from cybersecurity threats. 

Comment Summary: ALPA requested 

adding a requirement for cybersecurity 

protection for navigation and position 

reporting systems such as Global 

Navigation Satellite System (GNSS). 

ALPA further requested the FAA 

include criteria to address specific 

cybersecurity vulnerabilities, such as 

jamming (denial of signal) and spoofing 

(false position data is inserted). ALPA 

stated that, for navigation, UAS 

primarily use GNSS—an unencrypted, 

open-source, low power transmission 

that can be jammed, spoofed, or 

otherwise manipulated. 

FAA Response: The FAA will assess 

elements directly influencing the UA for 

cybersecurity under D&R.115 and will 

assess the AE as part of any operational 

approvals an operator may seek. 

D&R.115 (proposed as UAS.115) 

addresses intentional unauthorized 

electronic interactions, which includes, 

but is not limited to, hacking, jamming, 

and spoofing. These airworthiness 

criteria require the high-level outcome 

the UA must meet, rather than 

discretely identifying every aspect of 

cybersecurity the applicant will address. 

Contingency Planning 

The FAA proposed criteria requiring 

that the UAS be designed to 


lotter on DSK11XQN23PROD with RULES1
10690 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations 

automatically execute a predetermined 

action in the event of a loss of 

communication between the pilot and 

the UA. The FAA further proposed that 

the predetermined action be identified 

in the Flight Manual and that the UA be 

precluded from taking off when the 

quality of service is inadequate. 

Comment Summary: ALPA requested 

the criteria encompass more than loss or 

degradation of the command and 

control (C2) link, as numerous types of 

critical part or systems failures can 

occur that include degraded 

capabilities, whether intermittent or 

sustained. ALPA requested the FAA add 

language to the proposed criteria to 

address specific failures such as loss of 

a primary navigation sensor, 

degradation or loss of navigation 

capability, and simultaneous impact of 

C2 and navigation links. 

FAA Response: The airworthiness 

criteria address the issues raised by the 

commenter. Specifically, D&R.120(a) 

addresses actions the UA will 

automatically and immediately take 

when the operator no longer has control 

of the UA. Should the specific failures 

identified by ALPA result in the 

operator’s loss of control, then the 

criteria require the UA to execute a 

predetermined action. Degraded 

navigation performance does not raise 

the same level of concern as a degraded 

or lost C2 link. For example, a UA may 

experience interference with a GPS 

signal on the ground, but then find 

acceptable signal strength when above a 

tree line or other obstruction. The 

airworthiness criteria require that 

neither degradation nor complete loss of 

GPS or C2, as either condition would be 

a failure of that system, result in unsafe 

loss of control or containment. The 

applicant must demonstrate this by test 

to meet the requirements of 

D&R.305(a)(3). 

Under the airworthiness criteria, the 

minimum performance requirements for 

the C2 link, defining when the link is 

degraded to an unacceptable level, may 

vary among different UAS designs. The 

level of degradation that triggers a loss 

is dependent upon the specific UA 

characteristics; this level will be defined 

by the applicant and demonstrated to be 

acceptable by testing as required by 

D&R.305(a)(2) and D&R.310(a)(1). 

Comment Summary: An individual 

commenter requested the FAA use 

distinct terminology for 

‘‘communication,’’ used for 

communications with air traffic control, 

and ‘‘C2 link,’’ used for command and 

control between the remote pilot station 

and UA. The commenter questioned 

whether, in the proposed criteria, the 

FAA stated ‘‘loss of communication 

between the pilot and the UA’’ when it 

intended to state ‘‘loss of C2 link.’’ 

FAA Response: Communication 

extends beyond the C2 link and specific 

control inputs. This is why D&R.001 

requires the applicant’s CONOPS to 

include a description of the command, 

control, and communications functions. 

As long as the UA operates safely and 

predictably per its lost link contingency 

programming logic, a C2 interruption 

does not constitute a loss of control. 

Lightning 

The FAA proposed criteria to address 

the risks that would result from a 

lightning strike, accounting for the size 

and physical limitations of a UAS that 

could preclude traditional lightning 

protection features. The FAA further 

proposed that without lightning 

protection for the UA, the Flight Manual 

must include an operating limitation to 

prohibit flight into weather conditions 

with potential lightning. 

Comment Summary: An individual 

requested the FAA revise the criteria to 

include a similar design mitigation or 

operating limitation for High Intensity 

Radiated Fields (HIRF). The commenter 

noted that HIRF is included in proposed 

UAS.300(e) as part of the expected 

environmental conditions that must be 

replicated in testing. 

FAA Response: The airworthiness 

criteria, which are adopted as proposed, 

address the issue raised by the 

commenter. The applicant must identify 

tested HIRF exposure capabilities, if 

any, in the Flight Manual to comply 

with the criteria in D&R.200(a)(5). 

Information regarding HIRF capabilities 

is necessary for safe operation because 

proper communication and software 

execution may be impeded by HIRFgenerated interference, which could 

result in loss of control of the UA. It is 

not feasible to measure HIRF at every 

potential location where the UA will 

operate; thus, requiring operating 

limitations for HIRF as requested by the 

commenter would be impractical. 

Adverse Weather Conditions 

The FAA proposed criteria either 

requiring that design characteristics 

protect the UAS from adverse weather 

conditions or prohibiting flight into 

known adverse weather conditions. The 

criteria proposed to define adverse 

weather conditions as rain, snow, and 

icing. 

Comment Summary: ALPA and two 

individual commenters requested the 

FAA expand the proposed definition of 

adverse weather conditions. These 

commenters noted that because of the 

size and physical limitations of the 

Model Zip, adverse weather should also 

include wind, downdraft, low-level 

wind shear (LLWS), microburst, and 

extreme mechanical turbulence. 

FAA Response: No additional 

language needs to be added to the 

airworthiness criteria to address wind 

effects. The wind conditions specified 

by the commenters are part of normal 

UA flight operations. The applicant 

must demonstrate by flight test that the 

UA can withstand wind without failure 

to meet the requirements of 

D&R.300(b)(9). The FAA developed the 

criteria in D&R.130 to address adverse 

weather conditions (rain, snow, and 

icing) that would require additional 

design characteristics for safe operation. 

Any operating limitations necessary for 

operation in adverse weather or wind 

conditions will be included in the Flight 

Manual as required by D&R.200. 

Comment Summary: One commenter 

questioned whether the criteria 

proposed in UAS.130(c)(2), requiring a 

means to detect adverse weather 

conditions for which the UAS is not 

certificated to operate, is a prescriptive 

requirement to install an onboard 

detection system. The commenter 

requested, if that was the case, that the 

FAA allow alternative procedures to 

avoid flying in adverse weather 

conditions. 

FAA Response: The language referred 

to by the commenter is not a 

prescriptive design requirement for an 

onboard detection system. The 

applicant may use any acceptable 

source to monitor weather in the area, 

whether onboard the UA or from an 

external source. 

Critical Parts 

The FAA proposed criteria for critical 

parts that were substantively the same 

as those in the existing standards for 

normal category rotorcraft under 

§ 27.602, with changes to reflect UAS 

terminology and failure conditions. The 

criteria proposed to define a critical part 

as a part, the failure of which could 

result in a loss of flight or unrecoverable 

loss of control of the aircraft. 

Comment Summary: EASA requested 

the FAA avoid using the term ‘‘critical 

part,’’ as it is a well-established term for 

complex manned aircraft categories and 

may create incorrect expectations on the 

oversight process for parts. 

FAA Response: For purposes of the 

airworthiness criteria established for the 

Zipline Model Zip, the FAA has 

changed the term ‘‘critical part’’ to 

‘‘flight essential part.’’ 

Comment Summary: An individual 

commenter requested the FAA revise 

the proposed criteria such that a failure 

of a flight essential part would only 

occur if there is risk to third parties. 


lotter on DSK11XQN23PROD with RULES1
Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations 10691 

FAA Response: The definition of 

‘‘flight essential’’ does not change 

regardless of whether on-board systems 

are capable of safely landing the UA 

when it is unable to continue its flight 

plan. Tying the definition of a flight 

essential part to the risk to third parties 

would result in different definitions for 

the part depending on where and how 

the UA is operated. These criteria for 

the Model Zip UA apply the same 

approach as for manned aircraft. 

Comment Summary: An individual 

commenter requested the FAA add a 

requirement to D&R.135 (proposed as 

UAS.135) for the applicant to define all 

elements of type design, including the 

vehicle, control station, C2 link, and 

launch and recovery equipment. The 

commenter stated that an approved type 

design will be necessary for inspection 

and conformity by the FAA, as well as 

for continued airworthiness. 

FAA Response: These airworthiness 

criteria do not change the requirements 

under part 21 for the information an 

applicant must include in its 

application for a type certificate. As the 

FAA explained in the notice of 

proposed airworthiness criteria, the 

FAA has developed these criteria to 

establish safety outcomes that must be 

achieved, rather than prescriptive 

design requirements that must be met. 

The type certificate will include any 

necessary operating limitations, such as 

those prohibiting conditions under 

which the UA is not approved to 

operate (e.g., lightning, adverse 

weather). Similarly, while the AE items 

(such as the control station, C2 link, and 

launch and recovery equipment) will be 

outside the scope of the UA type design, 

the AE will be included as an operating 

limitation in the type certificate data 

sheet and flight manual, and therefore 

approved as part of the type certificate. 

Responsibilities for continued 

operational safety will apply to the UA 

as provided in 14 CFR part 21. 

Flight Manual 

The FAA proposed criteria for the 

Flight Manual that were substantively 

the same as the existing standards for 

normal category airplanes, with minor 

changes to reflect UAS terminology. 

Comment Summary: ALPA requested 

the FAA revise the criteria to include 

normal, abnormal, and emergency 

operating procedures along with their 

respective checklist. ALPA further 

requested the checklist be contained in 

a quick reference handbook (QRH). 

FAA Response: The FAA did not 

intend for the airworthiness criteria to 

exclude abnormal procedures from the 

flight manual. In these final 

airworthiness criteria, the FAA has 

changed ‘‘normal and emergency 

operating procedures’’ to ‘‘operating 

procedures’’ to encompass all operating 

conditions and align with 14 CFR 

23.2620, which includes the airplane 

flight manual requirements for normal 

category airplanes. The FAA has not 

made any changes to add language that 

would require the checklists to be 

included in a QRH. FAA regulations do 

not require manned aircraft to have a 

QRH for type certification. Therefore, it 

would be inconsistent for the FAA to 

require a QRH for the Zipline Model Zip 

UA. 

Comment Summary: ALPA requested 

the FAA revise the airworthiness 

criteria to require that the Flight Manual 

and QRH be readily available to the 

pilot at the control station. 

FAA Response: ALPA’s request 

regarding the Flight manual addresses 

an operational requirement, similar to 

14 CFR 91.9 and is therefore not 

appropriate for type certification 

airworthiness criteria. Also, as 

previously discussed, FAA regulations 

do not require a QRH. Therefore, it 

would be inappropriate to require it to 

be readily available to the pilot at the 

control station. 

Comment Summary: Droneport Texas 

LLC requested the FAA revise the 

airworthiness criteria to add required 

Flight Manual sections for routine 

maintenance and mission-specific 

equipment and procedures. The 

commenter stated that the remote pilot 

or personnel on the remote pilot-incommand’s flight team accomplish most 

routine maintenance, and that the flight 

team usually does UA rigging with 

mission equipment. 

FAA Response: The requested change 

is appropriate for a maintenance 

document rather than a flight manual 

because it addresses maintenance 

procedures rather than the piloting 

functions. The FAA also notes that, 

similar to the criteria for certain manned 

aircraft, the airworthiness criteria 

require that the applicant prepare 

instructions for continued airworthiness 

(ICA) in accordance with Appendix A to 

Part 23. As the applicant must provide 

any maintenance instructions and 

mission-specific information necessary 

for safe operation and continued 

operational safety of the UA, in 

accordance with D&R.205, no changes to 

the airworthiness criteria are necessary. 

Comment Summary: An individual 

commenter requested the FAA revise 

the criteria in proposed UAS.200(b) to 

require that ‘‘other information’’ 

referred to in proposed UAS.200(a)(5) be 

approved by the FAA. The commenter 

noted that, as proposed, only the 

information listed in UAS.200(a)(1) 

through (4) must be FAA approved. 

FAA Response: The change requested 

by the commenter would be 

inconsistent with the FAA’s 

airworthiness standards for flight 

manuals for manned aircraft. Sections 

23.2620(b), 25.1581(b), 27.1581(b), and 

29.1581(b) include requirements for 

flight manuals to include operating 

limitations, operating procedures, 

performance information, loading 

information, and other information that 

is necessary safe operation because of 

design, operating, or handling 

characteristics, but limit FAA approval 

to operating limitations, operating 

procedures, performance information, 

and loading information. 

Under § 23.2620(b)(1), for low-speed 

level 1 and level 2 airplanes, the FAA 

only approves the operating limitations. 

In applying a risk-based approach, the 

FAA has determined it would not be 

appropriate to hold the lowest risk UA 

to a higher standard than what is 

required for low speed level 1 and level 

2 manned aircraft. Accordingly, the 

FAA has revised the airworthiness 

criteria to only require FAA approval of 

the operating limitations. 

Comment Summary: NUAIR 

requested the FAA recognize that 

§ 23.2620 is only applicable to the 

aircraft and does not address off-aircraft 

components such as the control station, 

control and non-payload 

communications (CNPC) data link, and 

launch and recovery equipment. The 

commenter noted that this is also true 

of industry consensus-based standards 

designed to comply with § 23.2620. 

FAA Response: As explained in more 

detail in the Control Station section of 

this document, the FAA has revised the 

airworthiness criteria for the AE. The 

FAA will approve AE or minimum 

specifications for the AE that could 

affect airworthiness as an operating 

limitation in the UA flight manual. The 

FAA will establish the approved AE or 

minimum specifications as operating 

limitations and include them in the UA 

type certificate data sheet and Flight 

Manual in accordance with D&R.105(c). 

The establishment of requirements for, 

and the approval of AE will be in 

accordance with FAA Memorandum 

AIR600–21–AIR–600–PM01, dated July 

13, 2021. 

Durability and Reliability 

The FAA proposed durability and 

reliability testing that would require the 

applicant to demonstrate safe flight of 

the UAS across the entire operational 

envelope and up to all operational 

limitations, for all phases of flight and 

all aircraft configurations described in 


lotter on DSK11XQN23PROD with RULES1
10692 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations 

the applicant’s CONOPS, with no 

failures that result in a loss of flight, loss 

of control, loss of containment, or 

emergency landing outside the 

operator’s recovery area. The FAA 

further proposed that the unmanned 

aircraft would only be certificated for 

operations within the limitations, and 

for flight over areas no greater than the 

maximum population density, as 

described in the applicant’s CONOPS 

and demonstrated by test. 

Comment Summary: ALPA requested 

that the proposed certification criteria 

require all flights during testing be 

completed in both normal and nonnormal or off-nominal scenarios with no 

failures that result in a loss of flight, loss 

of control, loss of containment, or 

emergency landing outside of the 

operator’s recovery zone. Specifically, 

ALPA stated that testing must not 

require exceptional piloting skill or 

alertness and include, at a minimum: 

All phases of the flight envelope, 

including the highest UA to pilot ratios; 

the most adverse combinations of the 

conditions and configuration; the 

environmental conditions identified in 

the CONOPS; the different flight profiles 

and routes identified in the CONOPS; 

and exposure to EMI and HIRF. 

FAA Response: No change is 

necessary because the introductory text 

and paragraphs (b)(7), (b)(9), (b)(10), 

(b)(13), (c), (d), (e), and (f) of D&R.300, 

which are adopted as proposed, contain 

the specific testing requirements 

requested by ALPA. 

Comment Summary: Droneport Texas 

LLC requested the FAA revise the 

testing criteria to include, for operation 

at night, testing both with and without 

night vision aids. The commenter stated 

that because small UAS operation at 

night is waivable under 14 CFR part 

107, manufacturers will likely make 

assumptions concerning a pilot’s 

familiarity with night vision deviceaided and unaided operations. 

FAA Response: Under 

D&R.300(b)(11), the applicant must 

demonstrate by flight test that the UA 

can operate at night without failure 

using whatever equipment is onboard 

the UA itself. The pilot’s familiarity, or 

lack thereof, with night vision 

equipment does not impact whether the 

UA is reliable and durable to complete 

testing without any failures. 

Comment Summary: EASA requested 

the FAA clarify how testing durability 

and reliability commensurate to the 

maximum population density, as 

proposed, aligns with the Specific 

Operations Risk Assessment (SORA) 

approach that is open to operational 

mitigation, reducing the initial ground 

risk. An individual commenter 

requested the FAA provide more details 

about the correlation between the 

number of flight hours tested and the 

CONOPS environment (e.g., population 

density). The commenter stated that this 

is one of the most fundamental 

requirements, and the FAA should 

ensure equal treatment to all current 

and future applicants. 

FAA Response: In developing these 

testing criteria, the FAA sought to align 

the risk of UAS operations with the 

appropriate level of protection for 

human beings on the ground. The FAA 

proposed establishing the maximum 

population density demonstrated by 

durability and reliability testing as an 

operating limitation on the type 

certificate. However, the FAA has reevaluated its approach and determined 

it to be more appropriate to connect the 

durability and reliability demonstrated 

during certification testing with the 

operating environment defined in the 

CONOPS. 

Basing testing on maximum 

population density may result in 

limitations not commensurate with 

many actual operations. As population 

density broadly refers to the number of 

people living in a given area per square 

mile, it does not allow for evaluating 

variation in a local operating 

environment. For example, an operator 

may have a route in an urban 

environment with the actual flight path 

along a greenway; the number of human 

beings exposed to risk from the UA 

operating overhead would be 

significantly lower than the population 

density for the area. Conversely, an 

operator may have a route over an 

industrial area where few people live, 

but where, during business hours, there 

may be highly dense groups of people. 

Specific performance characteristics 

such as altitude and airspeed also factor 

into defining the boundaries for safe 

operation of the UA. 

Accordingly, the FAA has revised 

D&R.300 to require the UA design to be 

durable and reliable when operated 

under the limitations prescribed for its 

operating environment. The information 

in the applicant’s CONOPS will 

determine the operating environment 

for testing. For example, the minimum 

hours of reliability testing will be less 

for a UA conducting agricultural 

operations in a rural environment than 

if the same aircraft will be conducting 

package deliveries in an urban 

environment. The FAA will include the 

limitations that result from testing as 

operating limitations on the type 

certificate data sheet and in the UA 

Flight Manual. The FAA intends for this 

process to be similar to the process for 

establishing limitations prescribed for 

special purpose operations for restricted 

category aircraft. This allows for added 

flexibility in determining appropriate 

operating limitations, which will more 

closely reflect the operating 

environment. 

Finally, a comparison of these criteria 

with EASA’s SORA approach is beyond 

the scope of this document because the 

SORA is intended to result in an 

operational approval rather than a type 

certificate. 

Comment Summary: EASA requested 

the FAA clarify how reliability at the 

aircraft level to ensure high-level safety 

objectives would enable validation of 

products under applicable bilateral 

agreements. 

FAA Response: As the FAA and 

international aviation authorities are 

still developing general airworthiness 

standards for UA, it would be 

speculative for the FAA to comment on 

the validation process for any specific 

UA. 

Comment Summary: EASA requested 

the FAA revise the testing criteria to 

include a compliance demonstration 

related to adverse combinations of the 

conditions and configurations and with 

respect to weather conditions and 

average pilot qualification. 

FAA Response: No change is 

necessary because D&R.300(b)(7), (b)(9), 

(b)(10), (c), and (f), which are adopted 

as proposed, contain the specific testing 

requirements requested by EASA. 

Comment Summary: EASA noted 

that, under the proposed criteria, testing 

involving a large number of flight hours 

will limit changes to the configuration. 

FAA Response: Like manned aircraft, 

the requirements of 14 CFR part 21, 

subpart D, apply to UA for changes to 

type certificates. The FAA is developing 

procedures for processing type design 

changes for UA type certificated using 

durability and reliability testing. 

Comment Summary: EASA requested 

the FAA clarify whether the proposed 

testing criteria would require the 

applicant to demonstrate aspects that do 

not occur during a successful flight, 

such as the deployment of emergency 

recovery systems and fire protection/ 

post-crash fire. EASA asked if these 

aspects are addressed by other means 

and what would be the applicable 

airworthiness criteria. 

FAA Response: Equipment not 

required for normal operation of the UA 

do not require an evaluation for their 

specific functionality. D&R testing will 

show that the inclusion of any such 

equipment does not prevent normal 

operation. Therefore, the airworthiness 

criteria would not require functional 

testing of the systems described by 

EASA. 


lotter on DSK11XQN23PROD with RULES1
Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations 10693 

Comment Summary: An individual 

commenter requested the FAA specify 

the acceptable percentage of failures in 

the testing that would result in a ‘‘loss 

of flight.’’ The Small UAV Coalition 

requested the FAA clarify what 

constitutes an emergency landing 

outside an operator’s landing area, as 

some UAS designs could include an 

onboard health system that initiates a 

landing to lessen the potential of a loss 

of control event. The commenter 

suggested that, in those cases, a landing 

in a safe location should not invalidate 

the test. 

FAA Response: The airworthiness 

criteria require that all test points and 

flight hours occur with no failures result 

in a loss of flight, control, containment, 

or emergency landing outside the 

operator’s recovery zone. The FAA has 

determined that there is no acceptable 

percentage of failures in testing. In 

addition, while the recovery zone may 

differ for each UAS design, an 

emergency or unplanned landing 

outside of a designated landing area 

would result in a test failure. 

Comment Summary: The Small UAV 

Coalition requested that a single failure 

during testing not automatically restart 

counting the number of flight test 

operations set for a particular 

population density; rather, the applicant 

should have the option to identify the 

failure through root-cause and fault-tree 

analysis and provide a validated 

mitigation to ensure it will not recur. An 

individual commenter requested the 

FAA to clarify whether the purpose of 

the tests is to show compliance with a 

quantitative safety objective. The 

commenter further requested the FAA 

allow the applicant to reduce the 

number of flight testing hours if the 

applicant can present a predicted safety 

and reliability analysis. 

FAA Response: The intent of the 

testing criteria is for the applicant to 

demonstrate the aircraft’s durability and 

reliability through a successful 

accumulation of flight testing hours. 

The FAA does not intend to require 

analytical evaluation to be part of this 

process. However, the applicant will 

comply with these testing criteria using 

a means of compliance, accepted by the 

FAA, through the issue paper process. 

The means of compliance will be 

dependent on the CONOPS the 

applicant has proposed to meet. 

Probable Failures 

The FAA proposed criteria to evaluate 

how the UAS functions after probable 

failures, including failures related to 

propulsion systems, C2 link, GPS, 

critical flight control components with a 

single point of failure, control station, 

and any other equipment identified by 

the applicant. 

Comment Summary: Droneport Texas 

LLC requested the FAA add a bird strike 

to the list of probable failures. The 

commenter stated that despite sense and 

avoid technologies, flocks of birds can 

overcome the maneuver capabilities of a 

UA and result in multiple, unintended 

failures. 

FAA Response: Unlike manned 

aircraft, where aircraft size, design, and 

construct are critical to safe control of 

the aircraft after encountering a bird 

strike, the FAA determined testing for 

bird strike capabilities is not necessary 

for the Model Zip UA. The FAA has 

determined that a bird strike 

requirement is not necessary because 

the smaller size and lower operational 

speed of the Zip reduce the likelihood 

of a bird strike, combined with the 

reduced consequences of failure due to 

no persons onboard. Instead, the FAA is 

using a risk-based approach to tailor 

airworthiness requirements 

commensurate to the low-risk nature of 

the Model Zip UA. 

Comment Summary: ALPA requested 

the FAA require that all probable failure 

tests occur at the critical phase and 

mode of flight and at the highest 

aircraft-to-pilot ratio. ALPA stated the 

proposed criteria are critically 

important for systems that rely on a 

single source to perform multi-label 

functions, such as GNSS, because 

failure or interruption of GNSS will lead 

to loss of positioning, navigation, and 

timing (PNT) and functions solely 

dependent on PNT, such as geo-fencing 

and contingency planning. 

FAA Response: No change is 

necessary because D&R.300(c) requires 

that the testing occur at the critical 

phase and mode of flight and at the 

highest UA-to-pilot ratio. 

Comment Summary: Droneport Texas 

LLC requested the FAA add recovery 

from vortex ring state (VRS) to the list 

of probable failures. The commenter 

stated the UA uses multiple rotors for 

lift and is therefore susceptible to VRS. 

The commenter further stated that 

because recovery from settling with 

power is beyond a pilot’s average skill 

for purposes of airworthiness testing, 

the aircraft must be able to sense and 

recover from this condition without 

pilot assistance. 

FAA Response: D&R.305 addresses 

probable failures related to specific 

components of the UAS. VRS is an 

aerodynamic condition a UA may 

encounter during flight testing; it is not 

a component subject to failure. 

Comment Summary: Droneport Texas 

LLC also requested the FAA add a 

response to the Air Traffic Control-Zero 

(ATC-Zero) command to the list of 

probable failures. The commenter 

stated, based on lessons learned after 

the attacks on September 11, 2001, 

aircraft that can fly BVLOS should be 

able to respond to an ATC-Zero 

condition. 

FAA Response: The commenter’s 

request is more appropriate for the 

capabilities and functions testing 

criteria in D&R.310 than probable 

failures testing in D&R.305. 

D&R.310(a)(3) requires the applicant to 

demonstrate by test that the pilot has 

the ability to safely discontinue a flight. 

A pilot may discontinue a flight for a 

wide variety of reasons, including 

responding to an ATC-zero command. 

Comment Summary: EASA stated the 

proposed language seems to require an 

additional analysis and safety 

assessment, which would be 

appropriate for the objective 

requirement of ensuring a probable 

failure does not result in a loss of 

containment or control. EASA further 

stated that an applicant’s basic 

understanding of the systems 

architecture and effects of failures is 

essential. 

FAA Response: The FAA agrees with 

the expectation that applicants 

understand the system architecture and 

effects of failures of a proposed design, 

which is why the criteria include a 

requirement for the applicant to test the 

specific equipment identified in 

D&R.305 and identify any other 

equipment that is not specifically 

identified in D&R.305 for testing. As the 

intent of the criteria is for the applicant 

to demonstrate compliance through 

testing, some analysis may be necessary 

to properly identify the appropriate 

equipment to be evaluated for probable 

failures. 

Comment Summary: An individual 

requested that probable failure testing 

apply not only to critical flight control 

components with a single point of 

failure, but also to any critical part with 

a single point of failure. 

FAA Response: The purpose of 

probable failure testing in D&R.305 is to 

demonstrate that if certain equipment 

fails, it will fail safely. Adding probable 

failure testing for critical (now flight 

essential) parts would not add value to 

testing. If a part is essential for flight, its 

failure by definition in D&R.135(a) 

could result in a loss of flight or 

unrecoverable loss of control. For 

example, on a traditional airplane 

design, failure of a wing spar in flight 

would lead to loss of the aircraft. 

Because there is no way to show that a 

wing spar can fail safely, the applicant 

must provide its mandatory replacement 

time if applicable, structural inspection 


lotter on DSK11XQN23PROD with RULES1
10694 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations 

interval, and related structural 

inspection procedure in the 

Airworthiness Limitations section of the 

ICA. Similarly, under these 

airworthiness criteria, parts whose 

failure would inherently result in loss of 

flight or unrecoverable loss of control 

are not subjected to probable failure 

testing. Instead, they must be identified 

as flight essential components and 

included in the ICA. 

To avoid confusion pertaining to 

probable failure testing, the FAA has 

removed the word ‘‘critical’’ from 

D&R.305(a)(5). In the final airworthiness 

criteria, probable failure testing required 

by D&R.305(a)(5) applies to ‘‘Flight 

control components with a single point 

of failure.’’ 

Capabilities and Functions 

The FAA proposed criteria to require 

the applicant to demonstrate by test the 

minimum capabilities and functions 

necessary for the design. UAS.310(a) 

proposed to require the applicant to 

demonstrate, by test, the capability of 

the UAS to regain command and control 

of the UA after a C2 link loss, the 

sufficiency of the electrical system to 

carry all anticipated loads, and the 

ability of the pilot to override any preprogramming in order to resolve a 

potential unsafe operating condition in 

any phase of flight. UAS.310(b) 

proposed to require the applicant to 

demonstrate by test certain features if 

the applicant requests approval of those 

features (geo-fencing, external cargo, 

etc.). UAS.310(c) proposed to require 

the design of the UAS to safeguard 

against an unintended discontinuation 

of flight or release of cargo, whether by 

human action or malfunction. 

Comment Summary: ALPA stated the 

pilot-in-command must always have the 

capability to input control changes to 

the UA and override any preprogramming without delay as needed 

for the safe management of the flight. 

The commenter requested that the FAA 

retain the proposed criteria that would 

allow the pilot to command to: Regain 

command and control of the UA after 

loss of the C2 link; safely discontinue 

the flight; and dynamically re-route the 

UA. In support, ALPA stated the ability 

of the pilot to continually command (reroute) the UA, including termination of 

the flight if necessary, is critical for safe 

operations and should always be 

available to the pilot. 

Honeywell requested the FAA revise 

paragraphs (a)(3) and (a)(4) of the 

criteria (UAS.310) to allow for either the 

pilot or an augmenting system to safely 

discontinue the flight and re-route the 

UA. The commenter stated that a system 

comprised of detect and avoid, onboard 

autonomy, and ground system can be 

used for these functions. Therefore, the 

criteria should not require that only the 

pilot can do them. 

An individual commenter requested 

the FAA remove UAS.310(a)(4) of the 

proposed criteria because requiring the 

ability for the pilot to dynamically reroute the UA is too prescriptive and 

redundant with the proposed 

requirement in UAS.310(a)(3), the 

ability of the pilot to discontinue the 

flight safely. 

FAA Response: Because the pilot in 

command is directly responsible for the 

operation of the UA, the pilot must have 

the capability to command actions 

necessary for continued safety. This 

includes commanding a change to the 

flight path or, when appropriate, safely 

terminating a flight. The FAA notes that 

the ability for the pilot to safely 

discontinue a flight means the pilot has 

the means to terminate the flight and 

immediately and safely return the UA to 

the ground. This is different from the 

pilot having the means to dynamically 

re-route the UA, without terminating the 

flight, to avoid a conflict. 

Therefore, the final airworthiness 

criteria include D&R.310(a) as proposed 

(UAS.310(a)). 

Comment Summary: ALPA requested 

the FAA revise the criteria to require 

that all equipment, systems, and 

installations conform, at a minimum, to 

the standards of § 25.1309. 

FAA Response: The FAA determined 

that traditional methodologies for 

manned aircraft, including the system 

safety analysis required by §§ 23.2510, 

25.1309, 27.1309, or 29.1309, would be 

inappropriate to require for the Zipline 

Model Zip due to its smaller size and 

reduced level of complexity. Instead, 

the FAA finds that system reliability 

through testing will ensure the safety of 

this design. 

Comment Summary: ALPA requested 

the FAA revise the criteria to add a 

requirement to demonstrate the ability 

of the UA and pilot to perform all of the 

contingency plans identified in 

proposed UAS.120. 

FAA Response: No change is 

necessary because D&R.120 and 

D&R.305(a)(2), together, require what 

ALPA requests in its comment. Under 

D&R.120, the applicant must design the 

UA to execute a predetermined action in 

the event of a loss of the C2 link. 

D&R.305(a)(2) requires the applicant to 

demonstrate by test that a lost C2 link 

will not result in a loss of containment 

or control of the UA. Thus, if the 

applicant does not demonstrate the 

predetermined contingency plan 

resulting from a loss of the C2 link when 

conducting D&R.305 testing, the test 

would be a failure due to loss of 

containment. 

Comment Summary: ALPA and an 

individual commenter requested the 

FAA revise the criteria so that geofencing is a required feature and not 

optional due to the safety concerns that 

could result from a UA exiting its 

operating area. 

FAA Response: To ensure safe flight, 

the applicant must test the proposed 

safety functions, such as geo-fencing, 

that are part of the type design of the 

Model Zip UA. The FAA determined 

that geo-fencing is an optional feature 

because it is one way, but not the only 

way, to ensure a safely contained 

operation. 

Comment Summary: ALPA requested 

the FAA revise the criteria so that 

capability to detect and avoid other 

aircraft and obstacles is a required 

feature and not optional. 

FAA Response: D&R.310(a)(4) requires 

the applicant demonstrate the ability for 

the pilot to safely re-route the UA in 

flight to avoid a dynamic hazard. The 

FAA did not prescribe specific design 

features such as a collision avoidance 

system to meet D&R.310(a)(4) because 

there are multiple means to minimize 

the risk of collision. 

Comment Summary: McMahon 

Helicopter Services requested that the 

airworthiness criteria require a 

demonstration of sense-and-avoid 

technology that will automatically steer 

the UA away from manned aircraft, 

regardless of whether the manned 

aircraft has a transponder. NAAA and 

an individual commenter requested that 

the FAA require ADS–B in/out and 

traffic avoidance software on all UAS. 

The Small UAV Coalition requested the 

FAA establish standards for collision 

avoidance technology, as the proposed 

criteria are not sufficient for compliance 

with the operational requirement to see 

and avoid other aircraft (§ 91.113). The 

commenters stated that these 

technologies are necessary to avoid a 

mid-air collision between UA and 

manned aircraft. 

FAA Response: D&R.310(a)(4) requires 

the applicant demonstrate the ability for 

the UA to be safely re-routed in flight to 

avoid a dynamic hazard. The FAA did 

not prescribe specific design features, 

such as the technologies suggested by 

the commenters, to meet D&R.310(a)(4) 

because they are not the only means for 

complying with the operational 

requirement to see and avoid other 

aircraft. If an applicant chooses to equip 

their UA with onboard collision 

avoidance technology, those capabilities 

and functions must be demonstrated by 

test per D&R.310(b)(5). 


lotter on DSK11XQN23PROD with RULES1
Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations 10695 

3 In the FAA’s aircraft airworthiness standards 

(parts 23, 25, 27 and 29), subpart B of each is titled 

Flight. 

Verification of Limits 

The FAA proposed to require an 

evaluation of the UA’s performance, 

maneuverability, stability, and control 

with a factor of safety. 

Comment Summary: EASA requested 

that the FAA revise its approach to 

require a similar compliance 

demonstration as EASA’s for ‘‘light 

UAS.’’ EASA stated the FAA’s proposed 

criteria for verification of limits, 

combined with the proposed Flight 

Manual requirements, seem to replace a 

traditional Subpart Flight.3 EASA 

further stated the FAA’s approach in the 

proposed airworthiness criteria might 

necessitate more guidance and means of 

compliance than the traditional 

structure. 

FAA Response: The FAA’s 

airworthiness criteria will vary from 

EASA’s light UAS certification 

requirements, resulting in associated 

differences in compliance 

demonstrations. At this time, comment 

on means of compliance and related 

guidance material, which are still under 

development with the FAA and with 

EASA, would be speculative. 

Propulsion 

Comment Summary: ALPA requested 

the FAA conduct an analysis to 

determine battery reliability and safety, 

taking into account wind and weather 

conditions and their effect on battery 

life. ALPA expressed concern with 

batteries as the only source of power for 

an aircraft in the NAS. ALPA further 

requested the FAA not grant exemptions 

for battery reserve requirements. 

FAA Response: Because batteries are 

a flight essential part, the applicant 

must establish mandatory instructions 

or life limits for batteries under the 

requirements of D&R.135. In addition, 

when the applicant conducts its D&R 

testing, D&R.300(i) prevents the 

applicant from exceeding the 

maintenance intervals or life limits for 

those batteries. To the extent the 

commenter’s request addresses fuel 

reserves, that is an operational 

requirement, not a certification 

requirement, and therefore beyond the 

scope of this document. 

Additional Airworthiness Criteria 

Identified by Commenters 

Comment Summary: McMahon 

Helicopter Services requested that the 

criteria require anti-collision and 

navigation lighting certified to existing 

FAA standards for brightness and size. 

The commenter stated that these 

standards were based on human factors 

for nighttime and daytime recognition 

and are not simply a lighting 

requirement. An individual commenter 

requested that the criteria include a 

requirement for position lighting and 

anti-collision beacons meeting TSO–30c 

Level III. NAAA requested the criteria 

require a strobe light and high visibility 

paint scheme to aid in visual detection 

of the UA by other aircraft. 

FAA Response: The FAA determined 

it is unnecessary for these airworthiness 

criteria to prescribe specific design 

features for anti-collision or navigation 

lighting. The FAA will address anticollision lighting as part of any 

operational approval, similar to the 

rules in 14 CFR 107.29(a)(2) and (b) for 

small UAS. 

Comment Summary: ALPA requested 

the FAA add a new section with 

minimum standards for Global 

Navigation Satellite System (GNSS), as 

the UAS will likely rely heavily upon 

GNSS for navigation and to ensure that 

the UA does not stray outside of its 

approved airspace. ALPA stated that 

technological advances have made such 

devices available at an appropriate size, 

weight, and power for UAs. 

FAA Response: The airworthiness 

criteria in D&R.100 (UA Signal 

Monitoring and Transmission), D&R.110 

(Software), D&R.115 (Cybersecurity), 

and D&R.305(a)(3) (probable failures 

related to GPS) sufficiently address 

design requirements and testing of 

navigation systems. Even if the 

applicant uses a TSO-approved GNSS, 

these airworthiness criteria require a 

demonstration that the UA operates 

successfully without loss of 

containment. Successful completion of 

these tests demonstrates that the 

navigation subsystems are acceptable. 

Comment Summary: ALPA requested 

the FAA revise the criteria to add a new 

section requiring equipage to comply 

with the FAA’s new rules on Remote 

Identification of Unmanned Aircraft (86 

FR 4390, Jan. 15, 2021). An individual 

commenter questioned the need for 

public tracking and identification of 

drones in the event of a crash or 

violation of FAA flight rules. 

FAA Response: The FAA issued the 

final rule, Remote Identification of 

Unmanned Aircraft, after providing an 

opportunity for public notice and 

comment. The final rule is codified at 

14 CFR part 89. Part 89 contains the 

remote identification requirements for 

unmanned aircraft certificated and 

produced under part 21 after September 

16, 2022. 

Pilot Ratio 

Comment Summary: ALPA and one 

individual questioned the safety of 

multiple Model Zip UA operated by a 

single pilot, up to a ratio of 20 UA to 

1 pilot. ALPA stated that even with high 

levels of automation, the pilot must still 

manage the safe operation and maintain 

situational awareness of multiple 

aircraft in their flight path, aircraft 

systems, integration with traffic, 

obstacles, and other hazards during 

normal, abnormal, and emergency 

conditions. As a result, ALPA 

recommended the FAA conduct 

additional studies to better understand 

the feasibility of a single pilot operating 

multiple UA before developing 

airworthiness criteria. The Small UAV 

Coalition requested the FAA provide 

criteria for an aircraft-to-pilot ratio 

higher than 20:1. 

FAA Response: These airworthiness 

criteria are specific to the Model Zip UA 

and, as discussed previously in this 

preamble, operations of the Model Zip 

UA may include multiple UA operated 

by a single pilot, up to a ratio of 20 UA 

to 1 pilot. Additionally, these 

airworthiness criteria require the 

applicant to demonstrate the durability 

and reliability of the UA design by flight 

test, at the highest aircraft-to-pilot ratio, 

without exceptional piloting skill or 

alertness. In addition, D&R.305(c) 

requires the applicant to demonstrate 

probable failures by test at the highest 

aircraft-to-pilot ratio. Should the pilot 

ratio cause a loss of containment or 

control of the UA, then the applicant 

will fail this testing. 

Comment Summary: ALPA stated that 

to allow a UAS-pilot ratio of up to 20:1 

safely, the possibility that the pilot will 

need to intervene with multiple UA 

simultaneously must be ‘‘extremely 

remote.’’ ALPA questioned whether this 

is feasible given the threat of GNSS 

interference or unanticipated wind gusts 

exceeding operational limits. 

FAA Response: The FAA’s guidance 

in AC 23.1309–1E, System Safety 

Analysis and Assessment for Part 23 

Airplanes defines ‘‘extremely remote 

failure conditions’’ as failure conditions 

not anticipated to occur during the total 

life of an airplane, but which may occur 

a few times when considering the total 

operational life of all airplanes of the 

same type. When assessing the 

likelihood of a pilot needing to 

intervene with multiple UA 

simultaneously, the minimum reliability 

requirements will be determined based 

on the applicant’s proposed CONOPS. 


lotter on DSK11XQN23PROD with RULES1
10696 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations 

Noise 

Comment Summary: An individual 

commenter expressed concern about 

noise pollution. 

FAA Response: The Model Zip will 

need to comply with FAA noise 

certification standards. If the FAA 

determines that 14 CFR part 36 does not 

contain adequate standards for this 

design, the agency will propose and 

seek public comment on a rule of 

particular applicability for noise 

requirements under a separate 

rulemaking docket. 

Operating Altitude 

Comment Summary: ALPA, 

McMahon Helicopter Services, and 

NAAA commented on the operation of 

UAS at or below 400 feet AGL. ALPA, 

McMahon Helicopter Services, and 

NAAA requested the airworthiness 

criteria contain measures for safe 

operation at low altitudes so that UAS 

are not a hazard to manned aircraft, 

especially operations involving 

helicopters; air tours; agricultural 

applications; emergency medical 

services; air tanker firefighting; power 

line and pipeline patrol and 

maintenance; fish and wildlife service; 

animal control; military and law 

enforcement; seismic operations; 

ranching and livestock relocation; and 

mapping. 

FAA Response: The type certificate 

only establishes the approved design of 

the UA. These airworthiness criteria 

require the applicant show compliance 

for the UA altitude sought for type 

certification. While this may result in 

operating limitations in the flight 

manual, the type certificate is not an 

approval for operations. Operations and 

operational requirements are beyond the 

scope of this document. 

Guidance Material 

Comment Summary: NUAIR 

requested the FAA complete and 

publish its draft AC 21.17–XX, Type 

Certification Basis for Unmanned 

Aircraft Systems (UAS), to provide 

additional guidance, including 

templates, to those who seek a type 

design approval for UAS. NUAIR also 

requested the FAA recognize the 

industry consensus-based standards 

applicable to UAS, as Transport Canada 

has by publishing its AC 922–001, 

Remotely Piloted Aircraft Systems 

Safety Assurance. 

FAA Response: The FAA will 

continue to develop policy and 

guidance for UA type certification and 

will publish guidance as soon as 

practicable. The FAA encourages 

consensus standards bodies to develop 

means of compliance and submit them 

to the FAA for acceptance. Regarding 

Transport Canada AC 922–001, that AC 

addresses operational approval rather 

than type certification. 

Safety Management 

Comment Summary: ALPA requested 

the FAA ensure that operations, 

including UA integrity, fall under the 

safety management system. ALPA 

further requested the FAA convene a 

Safety Risk Management Panel before 

allowing operators to commence 

operations and that the FAA require 

operators to have an active safety 

management system, including a nonpunitive safety culture, where incident 

and continuing airworthiness issues can 

be reported. 

FAA Response: The type certificate 

only establishes the approved design of 

the UA, including the Flight Manual 

and ICA. Operations and operational 

requirements, including safety 

management and oversight of operations 

and maintenance, are beyond the scope 

of this document. 

Process 

Comment Summary: ALPA supported 

the FAA’s type certification of UAS as 

a ‘‘special class’’ of aircraft under 

§ 21.17(b) but requested that it be 

temporary. 

FAA Response: As the FAA stated in 

its notice of policy issued August 11, 

2020 (85 FR 58251, September 18, 

2020), the FAA will use the type 

certification process under § 21.17(b) for 

some unmanned aircraft with no 

occupants onboard. The FAA further 

stated in its policy that it may also issue 

type certificates under § 21.17(a) for 

airplane and rotorcraft UAS designs 

where the airworthiness standards in 

part 23, 25, 27, or 29, respectively, are 

appropriate. The FAA, in the future, 

may consider establishing appropriate 

generally applicable airworthiness 

standards for UA that are not 

certificated under the existing standards 

in parts 23, 25, 27, or 29. 

Out of Scope Comments 

The FAA received and reviewed 

several comments that were general, 

stated the commenter’s viewpoint or 

opposition without a suggestion specific 

to the proposed criteria, or did not make 

a request the FAA can act on. These 

comments are beyond the scope of this 

document. 

Applicability 

These airworthiness criteria, 

established under the provisions of 

§ 21.17(b), are applicable to the Zipline 

Model Zip UA. Should Zipline wish to 

apply these airworthiness criteria to 

other UA models, it must submit a new 

type certification application. 

Conclusion 

This action affects only certain 

airworthiness criteria for the Zipline 

Model Zip UA. It is not a standard of 

general applicability. 

Authority Citation 

The authority citation for these 

airworthiness criteria is as follows: 

Authority: 49 U.S.C. 106(g), 40113, and 

44701–44702, 44704. 

Airworthiness Criteria 

Pursuant to the authority delegated to 

me by the Administrator, the following 

airworthiness criteria are issued as part 

of the type certification basis for the 

Zipline Model Zip unmanned aircraft. 

The FAA finds that compliance with 

these criteria appropriately mitigates the 

risks associated with the design and 

concept of operations and provides an 

equivalent level of safety to existing 

rules. 

General 

D&R.001 Concept of Operations 

The applicant must define and submit 

to the FAA a concept of operations 

(CONOPS) proposal describing the 

unmanned aircraft system (UAS) 

operation in the national airspace 

system for which unmanned aircraft 

(UA) type certification is requested. The 

CONOPS proposal must include, at a 

minimum, a description of the following 

information in sufficient detail to 

determine the parameters and extent of 

testing and operating limitations: 

(a) The intended type of operations; 

(b) UA specifications; 

(c) Meteorological conditions; 

(d) Operators, pilots, and personnel 

responsibilities; 

(e) Control station, support 

equipment, and other associated 

elements (AE) necessary to meet the 

airworthiness criteria; 

(f) Command, control, and 

communication functions; 

(g) Operational parameters (such as 

population density, geographic 

operating boundaries, airspace classes, 

launch and recovery area, congestion of 

proposed operating area, 

communications with air traffic control, 

line of sight, and aircraft separation); 

and 

(h) Collision avoidance equipment, 

whether onboard the UA or part of the 

AE, if requested. 

D&R.005 Definitions 

For purposes of these airworthiness 

criteria, the following definitions apply. 


lotter on DSK11XQN23PROD with RULES1
Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations 10697 

(a) Loss of Control: Loss of control 

means an unintended departure of an 

aircraft from controlled flight. It 

includes control reversal or an undue 

loss of longitudinal, lateral, and 

directional stability and control. It also 

includes an upset or entry into an 

unscheduled or uncommanded attitude 

with high potential for uncontrolled 

impact with terrain. A loss of control 

means a spin, loss of control authority, 

loss of aerodynamic stability, divergent 

flight characteristics, or similar 

occurrence, which could generally lead 

to crash. 

(b) Loss of Flight: Loss of flight means 

a UA’s inability to complete its flight as 

planned, up to and through its 

originally planned landing. It includes 

scenarios where the UA experiences 

controlled flight into terrain, obstacles, 

or any other collision, or a loss of 

altitude that is severe or non-reversible. 

Loss of flight also includes deploying a 

parachute or ballistic recovery system 

that leads to an unplanned landing 

outside the operator’s designated 

recovery zone. 

Design and Construction 

D&R.100 UA Signal Monitoring and 

Transmission 

The UA must be designed to monitor 

and transmit to the AE all information 

required for continued safe flight and 

operation. This information includes, at 

a minimum, the following: 

(a) Status of all critical parameters for 

all energy storage systems; 

(b) Status of all critical parameters for 

all propulsion systems; 

(c) Flight and navigation information 

as appropriate, such as airspeed, 

heading, altitude, and location; and 

(d) Communication and navigation 

signal strength and quality, including 

contingency information or status. 

D&R.105 UAS AE Required for Safe 

UA Operations 

(a) The applicant must identify and 

submit to the FAA all AE and interface 

conditions of the UAS that affect the 

airworthiness of the UA or are otherwise 

necessary for the UA to meet these 

airworthiness criteria. As part of this 

requirement— 

(1) The applicant may identify either 

specific AE or minimum specifications 

for the AE. 

(i) If minimum specifications are 

identified, they must include the critical 

requirements of the AE, including 

performance, compatibility, function, 

reliability, interface, pilot alerting, and 

environmental requirements. 

(ii) Critical requirements are those 

that if not met would impact the ability 

to operate the UA safely and efficiently. 

(2) The applicant may use an interface 

control drawing, a requirements 

document, or other reference, titled so 

that it is clearly designated as AE 

interfaces to the UA. 

(b) The applicant must show the FAA 

the AE or minimum specifications 

identified in paragraph (a) of this 

section meet the following: 

(1) The AE provide the functionality, 

performance, reliability, and 

information to assure UA airworthiness 

in conjunction with the rest of the 

design; 

(2) The AE are compatible with the 

UA capabilities and interfaces; 

(3) The AE must monitor and transmit 

to the pilot all information required for 

safe flight and operation, including but 

not limited to those identified in 

D&R.100; and 

(4) The minimum specifications, if 

identified, are correct, complete, 

consistent, and verifiable to assure UA 

airworthiness. 

(c) The FAA will establish the 

approved AE or minimum specifications 

as operating limitations and include 

them in the UA type certificate data 

sheet and Flight Manual. 

(d) The applicant must develop any 

maintenance instructions necessary to 

address implications from the AE on the 

airworthiness of the UA. Those 

instructions will be included in the 

instructions for continued airworthiness 

(ICA) required by D&R.205. 

D&R.110 Software 

To minimize the existence of software 

errors, the applicant must: 

(a) Verify by test all software that may 

impact the safe operation of the UA; 

(b) Utilize a configuration 

management system that tracks, 

controls, and preserves changes made to 

software throughout the entire life cycle; 

and 

(c) Implement a problem reporting 

system that captures and records defects 

and modifications to the software. 

D&R.115 Cybersecurity 

(a) UA equipment, systems, and 

networks, addressed separately and in 

relation to other systems, must be 

protected from intentional unauthorized 

electronic interactions that may result in 

an adverse effect on the security or 

airworthiness of the UA. Protection 

must be ensured by showing that the 

security risks have been identified, 

assessed, and mitigated as necessary. 

(b) When required by paragraph (a) of 

this section, procedures and 

instructions to ensure security 

protections are maintained must be 

included in the ICA. 

D&R.120 Contingency Planning 

(a) The UA must be designed so that, 

in the event of a loss of the command 

and control (C2) link, the UA will 

automatically and immediately execute 

a safe predetermined flight, loiter, 

landing, or termination. 

(b) The applicant must establish the 

predetermined action in the event of a 

loss of the C2 link and include it in the 

UA Flight Manual. 

(c) The UA Flight Manual must 

include the minimum performance 

requirements for the C2 data link 

defining when the C2 link is degraded 

to a level where remote active control of 

the UA is no longer ensured. Takeoff 

when the C2 link is degraded below the 

minimum link performance 

requirements must be prevented by 

design or prohibited by an operating 

limitation in the UA Flight Manual. 

D&R.125 Lightning 

(a) Except as provided in paragraph 

(b) of this section, the UA must have 

design characteristics that will protect 

the UA from loss of flight or loss of 

control due to lightning. 

(b) If the UA has not been shown to 

protect against lightning, the UA Flight 

Manual must include an operating 

limitation to prohibit flight into weather 

conditions conducive to lightning 

activity. 

D&R.130 Adverse Weather Conditions 

(a) For purposes of this section, 

‘‘adverse weather conditions’’ means 

rain, snow, and icing. 

(b) Except as provided in paragraph 

(c) of this section, the UA must have 

design characteristics that will allow the 

UA to operate within the adverse 

weather conditions specified in the 

CONOPS without loss of flight or loss of 

control. 

(c) For adverse weather conditions for 

which the UA is not approved to 

operate, the applicant must develop 

operating limitations to prohibit flight 

into known adverse weather conditions 

and either: 

(1) Develop operating limitations to 

prevent inadvertent flight into adverse 

weather conditions; or 

(2) Provide a means to detect any 

adverse weather conditions for which 

the UA is not certificated to operate and 

show the UA’s ability to avoid or exit 

those conditions. 

D&R.135 Flight Essential Parts 

(a) A flight essential part is a part, the 

failure of which could result in a loss of 

flight or unrecoverable loss of UA 

control. 

(b) If the type design includes flight 

essential parts, the applicant must 


lotter on DSK11XQN23PROD with RULES1
10698 Federal Register / Vol. 87, No. 38 / Friday, February 25, 2022 / Rules and Regulations 

establish a flight essential parts list. The 

applicant must develop and define 

mandatory maintenance instructions or 

life limits, or a combination of both, to 

prevent failures of flight essential parts. 

Each of these mandatory actions must 

be included in the Airworthiness 

Limitations Section of the ICA. 

Operating Limitations and Information 

D&R.200 Flight Manual 

The applicant must provide a Flight 

Manual with each UA. 

(a) The UA Flight Manual must 

contain the following information: 

(1) UA operating limitations; 

(2) UA operating procedures; 

(3) Performance information; 

(4) Loading information; and 

(5) Other information that is necessary 

for safe operation because of design, 

operating, or handling characteristics. 

(b) Those portions of the UA Flight 

Manual containing the information 

specified in paragraph (a)(1) of this 

section must be approved by the FAA. 

D&R.205 Instructions for Continued 

Airworthiness 

The applicant must prepare ICA for 

the UA in accordance with Appendix A 

to Part 23, as appropriate, that are 

acceptable to the FAA. The ICA may be 

incomplete at type certification if a 

program exists to ensure their 

completion prior to delivery of the first 

UA or issuance of a standard 

airworthiness certificate, whichever 

occurs later. 

Testing 

D&R.300 Durability and Reliability 

The UA must be designed to be 

durable and reliable when operated 

under the limitations prescribed for its 

operating environment, as documented 

in its CONOPS and included as 

operating limitations on the type 

certificate data sheet and in the UA 

Flight Manual. The durability and 

reliability must be demonstrated by 

flight test in accordance with the 

requirements of this section and 

completed with no failures that result in 

a loss of flight, loss of control, loss of 

containment, or emergency landing 

outside the operator’s recovery area. 

(a) Once a UA has begun testing to 

show compliance with this section, all 

flights for that UA must be included in 

the flight test report. 

(b) Tests must include an evaluation 

of the entire flight envelope across all 

phases of operation and must address, at 

a minimum, the following: 

(1) Flight distances; 

(2) Flight durations; 

(3) Route complexity; 

(4) Weight; 

(5) Center of gravity; 

(6) Density altitude; 

(7) Outside air temperature; 

(8) Airspeed; 

(9) Wind; 

(10) Weather; 

(11) Operation at night, if requested; 

(12) Energy storage system capacity; 

and 

(13) Aircraft to pilot ratio. 

(c) Tests must include the most 

adverse combinations of the conditions 

and configurations in paragraph (b) of 

this section. 

(d) Tests must show a distribution of 

the different flight profiles and routes 

representative of the type of operations 

identified in the CONOPS. 

(e) Tests must be conducted in 

conditions consistent with the expected 

environmental conditions identified in 

the CONOPS, including electromagnetic 

interference (EMI) and high intensity 

radiated fields (HIRF). 

(f) Tests must not require exceptional 

piloting skill or alertness. 

(g) Any UAS used for testing must be 

subject to the same worst-case ground 

handling, shipping, and transportation 

loads as those allowed in service. 

(h) Any UA used for testing must use 

AE that meet, but do not exceed, the 

minimum specifications identified 

under D&R.105. If multiple AE are 

identified, the applicant must 

demonstrate each configuration. 

(i) Any UAS used for testing must be 

maintained and operated in accordance 

with the ICA and UA Flight Manual. No 

maintenance beyond the intervals 

established in the ICA will be allowed 

to show compliance with this section. 

(j) If cargo operations or external-load 

operations are requested, tests must 

show, throughout the flight envelope 

and with the cargo or external-load at 

the most critical combinations of weight 

and center of gravity, that— 

(1) The UA is safely controllable and 

maneuverable; and 

(2) The cargo or external-load are 

retainable and transportable. 

D&R.305 Probable Failures 

The UA must be designed such that 

a probable failure will not result in a 

loss of containment or control of the 

UA. This must be demonstrated by test. 

(a) Probable failures related to the 

following equipment, at a minimum, 

must be addressed: 

(1) Propulsion systems; 

(2) C2 link; 

(3) Global Positioning System (GPS); 

(4) Flight control components with a 

single point of failure; 

(5) Control station; and 

(6) Any other AE identified by the 

applicant. 

(b) Any UA used for testing must be 

operated in accordance with the UA 

Flight Manual. 

(c) Each test must occur at the critical 

phase and mode of flight, and at the 

highest aircraft-to-pilot ratio. 

D&R.310 Capabilities and Functions 

(a) All of the following required UAS 

capabilities and functions must be 

demonstrated by test: 

(1) Capability to regain command and 

control of the UA after the C2 link has 

been lost. 

(2) Capability of the electrical system 

to power all UA systems and payloads. 

(3) Ability for the pilot to safely 

discontinue the flight. 

(4) Ability for the pilot to dynamically 

re-route the UA. 

(5) Ability to safely abort a takeoff. 

(6) Ability to safely abort a landing 

and initiate a go-around. 

(b) The following UAS capabilities 

and functions, if requested for approval, 

must be demonstrated by test: 

(1) Continued flight after degradation 

of the propulsion system. 

(2) Geo-fencing that contains the UA 

within a designated area, in all 

operating conditions. 

(3) Positive transfer of the UA 

between control stations that ensures 

only one control station can control the 

UA at a time. 

(4) Capability to release an external 

cargo load to prevent loss of control of 

the UA. 

(5) Capability to detect and avoid 

other aircraft and obstacles. 

(c) The UA must be designed to 

safeguard against inadvertent 

discontinuation of the flight and 

inadvertent release of cargo or external 

load. 

D&R.315 Fatigue 

The structure of the UA must be 

shown to withstand the repeated loads 

expected during its service life without 

failure. A life limit for the airframe must 

be established, demonstrated by test, 

and included in the ICA. 

D&R.320 Verification of Limits 

The performance, maneuverability, 

stability, and control of the UA within 

the flight envelope described in the UA 

Flight Manual must be demonstrated at 

a minimum of 5% over maximum gross 

weight with no loss of control or loss of 

flight. 

Issued in Washington, DC, on February 16, 

2022. 

Ian Lucas, 

Manager, Policy Implementation Section, 

Policy and Innovation Division, Aircraft 

Certification Service. 

[FR Doc. 2022–03864 Filed 2–24–22; 8:45 am] 

BILLING CODE 4910–13–P 


lotter on DSK11XQN23PROD with RULES1