1

Final Report

for the

Task A11 -

Part 107 Waiver Request Case Study

Revision 1 (10/21/2016)

Rotorcraft Systems Engineering and Simulation Center

Contract Number: 15-C-UAS-UAH-02

PoP: 8/4/2015 to 9/30/2016

Mr. David Arterburn, Principal Investigator

UAH Contract Title: F/FAA/Part 107 Waiver Request Case Study

UAH Org: 675418

2

Contents List of Figures ................................................................................................................................. 3

List of Tables .................................................................................................................................. 4

Executive Summary ........................................................................................................................ 5

1. Introduction ............................................................................................................................. 6

1.1. Background ..................................................................................................................... 6

1.2. Scope ............................................................................................................................... 6

1.3. Relationship to Research conducted by ASSURE Project A4........................................ 7

1.4. Final Report Organization............................................................................................... 7

2. Details of Testing and Analysis Conducted to Develop Height-Velocity Limits ................... 8

2.1. Overview of Approach for Developing Height-Velocity Limits .................................... 8

2.2. Vehicle Modeling, Testing, and Operational Configurations ......................................... 8

2.3. Ballistic Modeling and CFD Analysis .......................................................................... 12

2.4. Flight Testing ................................................................................................................ 12

2.5. NIAR Drop Testing....................................................................................................... 15

2.6. Energy Transfer Analysis ............................................................................................. 25

2.7. Pendulum Testing of Blade Guards as a Laceration Mitigation ................................... 33

3. Proposed Standards................................................................................................................ 38

4. Conclusion and Recommendations ....................................................................................... 39

5. Future Research Proposed to Address Research Gaps .......................................................... 40

5.1. Dynamic Modeling of UAS for a Wider Variety of Failure Modes. ............................ 40

5.2. Blade Guard Development and Standards .................................................................... 40

5.3. Parachute Standards to Reduce Impact KEs ................................................................. 40

5.4. Probability of Ground Collision with People................................................................ 41

5.5. Additional sUAS Collision Tests and Development of an FMVSS 208 Like Analytical

Standard ..................................................................................................................................... 41

Appendix A – UAH Part 107 Waiver Submission for Flight Over People ................................ A-1

Appendix B - NIAR Test Article Damage .................................................................................. B-1

Appendix C - Proposed Standard with Impact KE Assessment Only ...................................... C-1

Appendix D - Proposed Standard with Evaluation of Potential Injury Severity ...................... D-1

3

List of Figures

Figure 1 – Vehicle Configurations used during the Task A11 Research ........................................ 9

Figure 2 - Pixhawk Flight Controller/Data Logger Integrated with UAH's Modified

Phantom 2 Flight Test Aircraft ..................................................................................................... 11

Figure 3- Comparison of Simulation and Flight Test Results ...................................................... 14

Figure 4 - Top View of Sled Setup for UAS Drop ....................................................................... 16

Figure 5 - Front Left View of Sled Setup (upper left), Vertical Drop Position of Dummy and

UAS (upper right), Pendulum Setup for Horizontal Impact Test (lower left), and Dummy and

UAS Setup for Angle Impact Test (lower right) ........................................................................... 17

Figure 6 - Example NIAR Test Summary for an Individual Test................................................. 18

Figure 7 - Example NIAR Time History for an Individual Test................................................... 19

Figure 8 - Probability of Fatality from Debris Impacts for Various Body Parts from

RCC 321-00 .................................................................................................................................. 21

Figure 9 - Probability of Fatality from Debris Impacts for Various Body Positions .................... 22

Figure 10 - Average Probability of Fatality from Debris Impacts ................................................ 22

Figure 11 - Analysis of Resultant Impact for Skull Fractures versus Impact KE ......................... 22

Figure 12 - Probability of Neck Injury Trends from NIAR Test Data ......................................... 23

Figure 13 - Phantom 3 Advanced Waiver Request Envelope....................................................... 24

Figure 14 Time History of Upper Neck Z-direction Force During a NIAR Drop Test ............... 27

Figure 15 - Modified blade guard link (highlighted with red oval) .............................................. 34

Figure 16 - Blade guard impact test .............................................................................................. 35

Figure 17 - Visual Marker Configuration During Tests 8 and 9................................................... 35

Figure 18 - Guard Damage during test 8 (left) and test 9 (right) .................................................. 36

Figure 19 - Force Components on Blade Guard at 55 deg Impact Angle ..................................... 37

Figure 20 - Static Load Testing Showing Blade Guard Contact with the Blade Under 1kg

Loading (contact is show in red oval) ........................................................................................... 38

Figure B - 1 - Buckling on Test Article UA17A-05 ................................................................... B-2

Figure B - 2 - Internal Fuselage Cracking on Test Article UA17A-24 ..................................... B-3

Figure B - 3 - Significant Buckling and Cracking on Fuselage of Test Article UA17A-11 ....... B-3

Figure B - 4 - Bent propeller on the Test Article UA17A-13 ..................................................... B-4

Figure B - 5 - Damage on Payload Base Plate on Test Article UA17A-11 ................................ B-4

Figure B - 6 - Camera Separation from Gimbal at the Elevation Motor on

Test Article UA17A-10............................................................................................................... B-5

Figure B - 7 - Complete Payload Separation in Test Article UA17A-22 ................................... B-5

Figure C-1 - Testing and Analysis Standard Block Diagram ..................................................... C-2

Figure D-1 - Testing and Analysis Flow Chart and Data Input Requirements ........................... D-2

4

List of Tables

Table 1 - COTS Phantom 3, CFD Model, Flight Test, Pendulum Blade Guard Test and

Operational Phantom 3 Standard and Advanced Flight Over People Configurations .................... 9

Table 2 - UAS Drop Testing Summary ........................................................................................ 16

Table 3 - NIAR Instrumentation for UAS Drop Tests .................................................................. 18

Table 4 - NIAR Summary Test Results and Injury Metrics ......................................................... 20

Table 5 - Difference in Injury Metrics Between FMVSS 208 and RCC Standards ....................... 1

Table 6 - Injury Characteristics for Some Common Objects ........................................................ 17

Table 7 - Resultant Head Forces from NIAR Tests ...................................................................... 18

Table 8 –Biomechanical Data for All Skull Fractures from Gurdjian .......................................... 20

Table 9 –Biomechanical Data of Skull Fracture Tests using a 48mm radius Hydraulic Anvil .... 20

Table 10 - Comparison of RCC Standards vs. Modified Impact Energy Thresholds for Various

Aircraft Weights when Descending under Parachute. .................................................................. 25

Table 11 - Differences in Impact KE and Energy Transferred to ATD Head .............................. 29

Table 12 - Impact Energy Absorption by the ATD Dummy Head and Injury Metrics ................ 31

Table 13 - UAS Impact KE and Post-Impact KE from Photometric Data ................................... 33

Table 14 - Pendulum Test Results ................................................................................................ 36

Table B-1 Summary of Test Article Damage ............................................................................. B-1

Table C-1 - SSL Properties for CFD Analysis ............................................................................ C-5

Table C-2 - Flight Test Instrumentation Requirements .............................................................. C-7

Table D-1 - SSL Air Properties for CFD Analysis ..................................................................... D-5

Table D-2 - Flight Test Instrumentation Requirements .............................................................. D-7

5

Executive Summary

The FAA requested research to explore the data requirements and analysis needed to submit a

Part 107 waiver for flight over people. The submission of the waiver in conjunction with the

research allowed the team to exercise the approval process and define standards that might be

used to improve the waiver process for more challenging waivers such as operations meeting the

Category 3 and 4 Performance Standards defined by the Micro-ARC Final Report. The research

led to successful submission of a Part 107 waiver for flight over people for the Phantom 3

Standard and Advanced, including substantiation data to meet the Category 4 Performance

Standards defined by the Micro-ARC Final Report1. The waiver and this final report include

new methodologies for determining safety thresholds other than those used by the Range

Commanders Council (RCC). The new 98% confidence level resultant load factor threshold in

Appendix D is based upon test data from aircraft drops onto a crash test dummy, skull fracture

testing, and other references used to establish similar collision metrics. The new standard applies

to multi-rotors in this Phantom 3 class of vehicles since their collision dynamics and collision

geometries are dramatically different than small mass, large volume, metallic debris fragments

that served as the basis for Probability of Fatality (PoF) charts developed as part of the RCC’s

assessment of range safety for hypervelocity projectiles and missiles. Flexible, plastic vehicle

structures and frangible payloads do not transfer energy during collisions in the same manner as

the smaller metal debris used as the basis for RCC standards. The structure, landing gear and

blade guards serve as flexible, compliant barriers that minimize the absorption of energy by the

body, reduce the possibility of collision with the center of mass of the vehicle and minimize

collision impacts with smaller areas of the body such as the thorax. The focus of the analysis

addresses skull fractures and injury to the neck area since these are the most vulnerable areas

when operating over people, especially under the operating conditions required to meet the

Category 4 Performance Standards. The modification of impact energy standards from the RCC

standards is a new approach and provides better insight into the injury mechanisms associated

with sUAS ground collisions with humans. Safe operation can be conducted when operating

these sUAS platforms over people, and the application of the KE standards in this report extends

the capabilities of safety mechanisms such as parachutes for larger platforms up to 25.4 lbs for

flight over people under Category 4 Performance Standards.

Many of these approaches are new for UAS applications, but they originate from well-

established research areas. The methods proposed in this research provide an initial framework

for clear standards for evaluating commercial platforms for future waivers required for flight

over people as outlined in Appendix C and D. Laceration injuries due to blades and penetration

injuries must always be addressed by the applicant, and an operational risk assessment must be

completed to evaluate all the hazards and impacts that may affect safe operations when flying

over people. The waiver request submitted in Appendix A provides a framework for such an

assessment for flight over people.

6

1. Introduction

1.1. Background

This research seeks to develop and validate a technical approach for Concept of Operations

(CONOPS) analysis, risk mitigation, and experimental validation of hazard controls for successful

submission of a waiver to Part 107 restrictions on sUAS operations over people. The safety case

and subsequent waiver language included mitigations necessary for the waiver depending on the

level of safety required by the FAA for flight over people. Per the Micro Unmanned Aircraft

Systems (UAS) Aviation Rulemaking Committee (ARC) Recommendations and Final Report1,

flight “over people” is defined as UAS flight directly above one or more persons.

This research included three parallel efforts. The first was a modeling effort underpinned by

developing risk and scenario-based area weighted, impact kinetic energy (KE) thresholds by way

of CONOPS analysis, determination of operationally appropriate technical data requirements, test

and analysis requirements, and the development of suitable operational envelopes developed

around injury potential and the associated impact KE. These thresholds, in conjunction with

vehicle parameters (weight, effective areas, drag coefficients, and impact energy absorption) and

ballistic models, were used to calculate an operating height-velocity diagram to ensure that

vehicles do not exceed the impact KE thresholds. The second effort is verification of model inputs

and outputs by way of flight and drop tests. The final effort is to develop a set of mitigations to

keep the aircraft within the impact KE thresholds and/or to limit the potential of laceration and

penetration injuries following blade or UAS body impacts and submit a request for waiver for a

single sUAS.

1.2. Scope

The following research questions were addressed by this research:

1. What are the technical data requirements, test and analysis requirements, and suitable

operational envelopes necessary or suitable for small unmanned aircraft operations over people

based on operational missions/areas covered by the waiver request?

2. What are suitable impact KE thresholds based on the Micro ARC Report's recommendations

and what operational limitations and other mitigations are required based upon the impact

energy thresholds to achieve the operational requirement?

3. What percentage of vehicle impact KE is absorbed by a person on impact?

4. What are the vehicle height-velocity combinations that ensure vehicles remain below impact

KE limits with and without mitigations?

1 Micro Unmanned Aircraft Systems Aviation Rulemaking Committee (ARC), ARC Recommendations Final

Report, April 1, 2016

7

5. What are effective mitigations to reduce the severity of penetration injuries and laceration

injuries to reduce collision severity for sUAS operations over people for the proposed

scenarios?

1.3. Relationship to Research conducted by ASSURE Project A4.

This research is being conducted in parallel with A4, “Ground Collision Severity Evaluation”,

but with a later starting date for the period of performance. The requested start date for this

proposal, July 20, 2016, allows research results from A4 to support this proposed research.

Research performers from A3 and A4 also support this proposed work to enhance coordination.

The methods and tools being utilized for this research build upon those established in the UAS

Characteristics White Paper submitted as part of the A4 Ground Collision Severity Project and

impact testing methods employed by the A3 Air Collision Severity Evaluation Project.

This report informs changes in methodologies and results from those developed in Task A4 based

upon test results, and it provides an evolution of knowledge developed during the A4 work prior

to the execution of this task. The Task A4 Final Report will leverage data collected under the A11

Task and utilize the knowledge that has been gained, in particular the relationship of Abbreviated

Injury Scale (AIS) injury metrics and impact KE. This work provides information that is more

relevant to sUAS impacts than the RCC Probability of Fatality (PoF) metrics derived from debris

and non-lethal munition research that informed much of the Task A4 work to this point.

1.4. Final Report Organization

Appendix A – UAH Part 107 Waiver Submission for Flight Over People contains the Part 107

Waiver Request2 for flight over people with a Phantom 3 Standard and a Phantom 3 Advanced

submitted to the FAA that was prepared under this task. Data included in Appendix A, B and C

of the Part 107 Waiver Request will be referenced in this final report but will not explicitly be

replicated. Paragraph 2 will address technical details of the analysis and testing that was not

included in the waiver request, Paragraph 3 will address a proposed standard for testing future

vehicles to meet the Category 4 Performance Standards outlined in the Micro Unmanned Aircraft

Systems Aviation Rulemaking Committee (Micro-ARC) Recommendations Final Report dated

1 April 2016. Paragraph 5 will address research gaps identified during this research effort.

2 Part 107 Waiver request to § 107.39 Operation Over Human Beings for the Phantom 3 Standard and Phantom 3

Advanced by the University of Alabama in Huntsville to support research activities as well as collect video images

for use in documenting university events. The waiver request includes data and technical evaluations to substantiate

safe limits for the Phantom 3 Standard and Advanced aircraft operating over people that meet the Category 4

Performance Standards outlined in the Micro Unmanned Aircraft Systems Aviation Rulemaking Committee (Micro-

ARC) ARC Recommendations Final Report dated 1 April 2016.

8

2. Details of Testing and Analysis Conducted to Develop Height-Velocity Limits

2.1. Overview of Approach for Developing Height-Velocity Limits

The Waiver Request shown in Appendix A of this report outlines the development of operating

Height-Velocity limits for the Phantom 3 variants. These limits defined the safe operating

envelope required to mitigate the risk of blunt trauma injuries following an aircraft failure when

operating over people. This method includes initial ballistic analysis, estimation of drag

coefficients for the ballistic models using CFD, refinement of the ballistic analysis based on

CFD-generated flat plate drag areas, and ballistic model validation through flight test. The initial

ballistic analysis was used to define test points to conduct UAS impact drop testing at the

National Institute for Aviation Research (NIAR) at Wichita State University. The drop testing

served to correlate injury potential for the recorded impact KE-levels with the abbreviated injury

scale using automotive crash standards for injury. An extension of the NIAR drop testing is to

determine energy absorption that could be used to correlate data with other KE standards such as

the RCC. This section of the report does not intend to repeat all of the detailed data in the

Waiver Request, but to highlight specifics of the tests not included in the request and summarize

the results.

Additionally, the waiver request included design modifications implemented to limit the risk of

laceration injuries due to blade strike. These were evaluated using a pendulum test to evaluate

the limitations of these mitigations. The waiver request included analysis of critical contact

points and operating considerations associated with the risk of penetration injuries following

vehicle failure when operating over people. The details of the testing and analysis of these areas

is included in this report along with a summary of the results.

2.2. Vehicle Modeling, Testing, and Operational Configurations

Table 1 provides a comparison of a Commercial-off-the Shelf (COTS) Phantom 3 aircraft, the

Phantom 3 CFD model, the modified Phantom 2 used during flight test, the modified Phantom 2

used for blade guard and guard link testing, and the operational configuration for flight over

people. Pictures of the COTS Phantom 3, CFD model, flight test, and blade guard test

configurations are shown in Figure 1. The COTS Phantom 3 is a point of reference for the

configuration changes used for simulation and testing purposes, and the configuration that was

proposed for flight operations over people.

9

Table 1 - COTS Phantom 3, CFD Model, Flight Test, Pendulum Blade Guard Test and Operational Phantom 3 Standard and

Advanced Flight Over People Configurations

Figure 1 – Vehicle Configurations used during the Task A11 Research

COTS Phantom 3 Aircraft (upper left), UAH's STAR-CCM CFD Model of the Phantom 3 (upper right), and UAH's Modified

Phantom 2 Flight Test Aircraft (lower left), and the Modified Phantom 2 Blade Guard Link Pendulum Test Aircraft (lower right)

COTS Phantom 3. The COTS Phantom 3 Standard or Advanced aircraft, comes with optional

blade guards, which can be installed at the user’s discretion.

Commercial-

of-the Shelf

(COTS)

CFD/Ballistic

Model Flight Test

Blade

Guard Test

Operational for

Flight Over

People

Model Phantom 3

Advanced Phantom 3

Modified

Phantom 2

Phantom 2

with Ballast

Phantom 3

Standard/

Advanced

Payload YES YES Wooden Mockup YES YES

Weight 2.82 lbs 3.01 lbs 3.01 lbs 3.01 lbs 3.01 lbs

Vision Position

System YES YES Foam Mockup

NO YES

Propellers YES YES, Parallel

to Arms YES YES YES

Flight Controller DJI Main

Controller N/A Pixhawk N/A

DJI Main

Controller

Data Logger DJI Main

Controller N/A Pixhawk N/A

DJI Main

Controller

Blade Guards Optional YES YES YES YES

Blade Guard link NO NO NO YES YES

Parachute NO NO MARS Mini V2 NO NO

10

CFD Models of the Phantom 3. The CFD model includes blade guards. During simulations,

the propellers on the CFD model were aligned with the vehicle arms to reduce flat plate drag

area and represent a worst case/minimum drag configuration, per FAA guidance. CFD was

conducted with the Phantom 3 with blade guards on and off as well as with blades installed and

removed. Per FAA guidance, the final CFD was conducted with the blades parallel to the arms.

Based on CFD analysis, the addition of the blade guards resulted in a 42% increase in vertical

flat plate drag area and a 19.6% increase in horizontal flat plate drag area.

Modified Phantom 2 Used for Flight Test. The modified Phantom 2 was used as the flight test

aircraft because it had damaged electronics, which made it ideal for replacement controller/data

logger integration. UAH modified the Phantom 2 with a wood empennage to replicate the

Phantom 3 payload and a foam plug to replicate the Vision Position System (VPS) module,

COTS blade guards without strings installed, and ballast weight to serve reach the operating

weight for the Phantom 3 Standard and Advanced Models. The flight test aircraft weighed

3.01 lbs, which was the vehicle weight used during ballistic simulations for model validation.

The flight test aircraft was equipped with a Pixhawk flight controller in lieu of the standard

controller to save additional weight by simultaneously acting as the flight controller and data

logger (Figure 2).3 DJI’s Main Controller produces flight logs, but the logs aren’t compatible

with APM Flight Planner, which is the standard software used by UAH for log file download and

initial post-processing. The Pixhawk was also used, because it has a motor stop command that

can be associated with a controller switch that enables rapid cutting of motor power and

power-on recovery of the aircraft during free-fall testing. Lastly, the flight test aircraft was

equipped with a MARS mini V2 parachute recovery system as a backup aircraft recovery method

(Figure 1).4 This was installed as a top-mounted parachute in order to avoid altering the

vehicle’s vertical planform area and to project the parachute further away from the aircraft.

There was an impact to the horizontal flat plate drag area, which has not been estimated or

included in the CFD or ballistic models. It was assumed that that the impact KE is less sensitive

to changes in horizontal flat plate drag area and that the flight test results would be minimally

impacted by this difference in configuration. A backup Phantom 3 Standard was also prepared

for flight testing in case the first flight test aircraft was damaged.

3 https://store.3dr.com/products/3dr-pixhawk, accessed 08/20/2016 4 http://www.marsparachutes.com/mars-mini/, accessed 08/20/2016

11

Figure 2 - Pixhawk Flight Controller/Data Logger Integrated with UAH's Modified Phantom 2 Flight Test Aircraft

Blade Guard Modifications. Blade guard links replaced the string used in the COTS blade

guard installation to better mitigate the risk of serious laceration injuries for the operational

configuration. These links were not included in the flight test or CFD analysis, because this

design modification was completed after CFD analysis and flight tests were complete. The

addition of the links in the operational configuration will add a small increase in flat plate drag

area to the model, similar to the blade guards, and further slow the vehicle’s descent in

comparison to the COTS aircraft and CFD/flight test configurations. As such, the ballistic

characterization of the vehicle is conservative when compared to flight test, because operational

configuration will have greater flat plate drag area.

Modified Phantom 2 Blade Guard Link Pendulum Test Aircraft. The blade guard link

impact testing was completed with a modified Phantom 2. This aircraft had a full set of blade

guards installed, carbon-fiber and steel links between the blade guards (Figure 1), and additional

weight to match the weight of a COTS Phantom 3 Advanced with blade guards and links

installed for flight over people.

Operational Configuration for Flight Over People. The operational configuration for flight

over people is a COTS Phantom 3 Standard or Advanced with blade guards including linkages

installed. The blade guards with linkages provide a buffer to blunt force injury and mitigate

numerous crash geometries for sensitive areas such as the throat. The blade guards with linkages

eliminate capture of body limbs to prevent serious lacerations that can occur when the strings

between the blade guards are not installed or are ineffective at higher speeds.

12

2.3. Ballistic Modeling and CFD Analysis

Aerodynamic modeling and analysis of the vehicle was conducted to determine impact KE levels

based on failure flight condition and vehicle attributes. The impact KE level is determined by

the vehicle mass, flat plate drag areas (vertical and lateral). The second area of vehicle analysis

is the estimated energy transfer to an impacted person. The energy transfer level is determined

by the impact orientation, vehicle construction, and vehicle materials. The energy transfer levels

are estimated based on conservation of momentum analysis of the vehicle’s rebound trajectory

and ATD Hybrid III dummy movement after impact. The CFD analysis is covered in the waiver

request and will not be addressed in detail in this report. The CFD simulations reached

converged solutions for all cases and yielded estimated drag coefficients for velocity sweeps in

both orientations. The average coefficient of drag values for the Phantom 3 without guards is

Cd,vert = 0.9313 and Cd,lat = 1.077. The average coefficient of drag values for the Phantom 3 with

guards is Cd,vert = 1.124 and Cd,lat = 1.122. There is a 42% increase in the vertical flat plate drag

area, and a 19.6% increase in the lateral flat plate drag area when the guards are added. This data

was used to update the aerodynamic model and create initial height-velocity diagrams based

upon the results of flight testing.

2.4. Flight Testing

The purpose of performing flight tests was to collect data to validate the CFD and aerodynamic

ballistic models. Two types of flight tests were performed, free fall from a hover and free fall

following failure in translating flight, to characterize the ballistic trajectory of the aircraft in the

event of an in-flight failure. Both types of tests required the aircraft to be unpowered, level in

attitude, and at known initial velocities to capture accurate data. During the UAH flight testing,

the aircraft was flown to the desired failure state and the operator performed a synchronized

motor shut down. Three initial states were selected: 5 ft/s initial velocity, 10 ft/s initial velocity,

and 20 ft/s initial velocity. All motor shut-offs were completed at approximately 400 ft AGL.

Several iterations of each test profile were performed to account for winds and variability in the

aircraft horizontal velocity at motor shutoff. The NIAR drop tests were used to validate ballistic

model predictions for impact KE during a pure vertical descent.

These type of flight tests have a high risk of ground impact. For that reason, researchers modified

a DJI Phantom 2 Standard airframe that had a damaged flight controller and GPS unit from

previous flight tests instead of an off-the-shelf stock DJI Phantom 3 Advanced. The DJI Phantom

2 and 3 aircraft have the same external airframe shape and dimensions with the only differences

being external payload options. A dummy camera was constructed from wood to replicate the

mass and shape of the DJI Phantom 3 Advanced camera. A foam plug was constructed to

replicate the mass and shape of the Vision Position System on the Phantom 3 Advanced.

The damaged Phantom 2 flight controller and GPS unit was replaced with a 3D Robotics

Pixhawk flight controller which also served the role as the onboard data logger. The stock

13

Phantom 2 battery, motors, and electronic speed controllers (ESC) were re-used. A power

distribution board was added to distribute the power from the Phantom main battery to each of

the motors and the Pixhawk flight controller. The Pixhawk’s motor stop feature significantly

reduced the pilot workload in recovering the aircraft from an unknown attitude. Alternatively, a

radio controlled mechanical relay can be used on the ESC signal ground wire to disable the

motors outputs for an aircraft that does not use the Pixhawk as a flight controller. A servo-

release, spring launched parachute was installed on top of the aircraft to provide an alternate

method of recovery in the event the aircraft could not be successfully re-armed from the free fall

condition. A secondary battery was installed to keep the Pixhawk powered in the event of a

motor re-arm and parachute failure to prevent the loss of flight data if the main battery was

ejected during a ground impact.

The 3DR Robotics Pixhawk flight controller is an open-source flight controller allowing custom

vehicle integration, non-standard aircraft configurations, autonomous control, and full parameter

data logging. Data from sensors on the Pixhawk main board is sampled and logged at 50 Hz,

while the sample rate of external sensors is governed by the limitations of the sensor hardware.

The externally connected 3DR GPS and magnetometer unit has a sample rate of 5 Hz. Pixhawk

hardware configuration and flight data monitoring is managed through Mission Planner ground

station software. Mission Planner has the ability to log flight data from the telemetry data

received from the aircraft, however the sample rate is limited to the quality of the received

telemetry data. Mission Planner also provides the utility to export log files for post processing.

Optionally, individual flight data parameters can be reviewed and plotted within Mission

Planner.

Flight tests were performed at locations that provide a controlled environment and airspace for

operations, such as an AMA RC field or closed set flight area in Class G airspace. The minimum

flight crew consisted of a pilot-in-command/pilot and a ground station operator (GSO). The role

of the GSO is to provide the pilot with altitude and speed information during different segments

of the flight and provide additional surveillance for hazards. The aircraft was flown manually in

a stabilized, altitude-hold flight mode during all stages of the flight. Each test began at the

maximum allowable altitude to increase the chances of a successful recovery.

For the static free fall tests conducted as part of the Task A4 effort, the GSO provided the pilot

with altitude callouts until the target altitude was achieved. With the aircraft in a stable hover, the

pilot toggled the transmitter switch to initiate the motor stop command. After allowing the

aircraft to free fall without power for two seconds, the pilot toggled the transmitter switch to re-

arm the motors. If the aircraft did not respond immediately and return to a stable attitude, the

switch was toggled again to the disarm state at the same time the switch for the parachute

deployment was activated. It was important to return the switch to a motor disarm state prior to

deploying the parachute to prevent the parachute from becoming entangled in the propellers if

the motors were to suddenly be re-armed.

14

For the tests simulating failure in translating flight, the GSO began reporting aircraft speed

information upon the pilot’s command after reaching the target altitude. The aircraft was slowly

accelerated forward until the target initial velocity was achieved. The pilot would then toggle the

switch to disarm the motors and allow the aircraft to fall for two seconds prior to beginning the

recovery process.

Figure 3 shows good correlation between predicted falling flight trajectories from CFD

developed flat plate drag area and the flight test data for the Phantom 3 with blade guards.

Cross-winds during the test flight led to some discrepancies, but the comparison of a flight test

drop with an initial velocity of 27 ft/s corresponds well with the simulated drop with an initial

velocity of 30 ft/s. The two drops with initial velocities of 6 ft/s and 7 ft/s are close to the

simulation; however, the drop with light green markers appears to have experienced gusts during

the drop. Overall, the ballistic model, driven by CFD flow field simulation, produces accurate

data outputs that are validated by both vertical drops and forward flight failure test flights.

Figure 3- Comparison of Simulation and Flight Test Results

15

2.5. NIAR Drop Testing

Test Setup

Wichita State University’s (WSU) National Institute for Aviation Research (NIAR) conducted a

series of vehicle drop tests on the head of an ATD Hybrid III 50th Percentile Male Crash Test

Dummy.5 The testing consisted of 24 complete tests using a DJI Phantom 3 Standard striking

the test dummy to simulate a vehicle collision with a person based on a range of failure flight

conditions. NIAR conducted two tests that were considered no tests, for a 30-foot vertical drop

and a 62° impact angle drop. These two tests yielded dummy instrument readings, but did not

produce any high-speed video or photometric data and as such were deemed as no tests. Table 2

summarizes all of the completed testing. The dummy’s instrumentation and data outputs, along

with additional collision sequence photometric data are summarized in Appendix A – UAH Part

107 Waiver Submission for Flight Over People. In addition to the photometric data of the UAS

collision sequences and test reports that include dummy head and neck impact loading, force vs.

time, and angular rate vs. time data, NIAR provided high speed videos of each collision.

Figure 4 shows a diagram of the drop test equipment setup at NIAR. The sled is a large metal

slab that serves as the mounting point for the drop rail uprights, seat and dummy (the dummy is

annotated as “ATD” in the diagram). The cameras provided the photometric tracking data to

give instantaneous translational and angular velocities of the UAS for a short duration before and

after each impact. Figure 5 shows the basic setup from the front right. This figure also shows

the impact orientation of the Phantom 3 with respect to the dummy’s head for the vertical,

horizontal, and angled impact testing. The UAS impacted directly on top of the head with the

payload during all vertical drop testing. The vertical drop testing replicated a UAS failure in

hover with the aircraft falling in a level attitude. The angled drop testing replicated a UAS

failure in forward flight. For the angle impact tests, the dummy seat was tilted back by either

58° or 62º. The UAS was dropped vertically with an attitude of 58º or 62°. In this way, it

replicated an impact with level attitude while descending with the desired impact trajectory

angle. This type of impact is characteristic of the Phantom 3, which tends to fall with a level

attitude after a complete loss of power.6 During the horizontal impact tests, the UAS struck the

dummy on the forehead, with area between the vehicle arms as the point of contact. A pendulum

was used to accelerate the UAS to impact speed prior to horizontal impact with the dummy’s

head. The UAS was resting on low friction rails so that it would continue moving toward the

dummy’s head after the pendulum swing was arrested in the horizontal impact tests.

5 Humanetics Innovative Solutions. (08/30/2016) Hybrid III 50th Male Dummy. Retrieved from

http://www.humaneticsatd.com/crash-test-dummies/frontal-impact/hybrid-iii-50th, 6 FAA A4 Project Team, White Paper on UAS Characteristics for the FAA UAS Center of Excellence Task A4:

Ground Collision Severity Evaluation, June 3, 2016

16

Table 2 - UAS Drop Testing Summary

Figure 4 - Top View of Sled Setup for UAS Drop

17

NIAR Report Content

NIAR provided comprehensive reports on all 26 tests of which two tests were considered no

tests. NIAR summarized all test findings into a 480 page, final report7 that is not included in this

document, but will be submitted to the FAA at the time this report is submitted. Instrumentation

and data collected during each test is shown in Table 3 below. Analysis of the data for each test

report is provided as a summary table and time histories as shown in Figure 6 and Figure 7,

respectively.

7 Huculak, R., NIAR UAS Drop Testing Report, Doc. CDL-TR-17-2163-UA01, 19 August 2016.

Figure 5 - Front Left View of Sled Setup (upper left), Vertical Drop Position of Dummy

and UAS (upper right), Pendulum Setup for Horizontal Impact Test (lower left), and

Dummy and UAS Setup for Angle Impact Test (lower right)

18

Table 3 - NIAR Instrumentation for UAS Drop Tests

Figure 6 - Example NIAR Test Summary for an Individual Test

19

Figure 7 - Example NIAR Time History for an Individual Test

Correlation of Impact Loads and Accelerations with Injury Metrics

The injury potential for specific impact KEs and impact angles was evaluated using injury

metrics established by the National Highway Traffic Safety Administration (NHTSA), National

Transportation Biomechanics Research Center (NTBRC) in November 1999.8 The NHTSA

study was conducted to upgrade the Federal Motor Vehicle Safety Standard (FMVSS) No. 2089

frontal crash protection safety standard. “Based on the agency’s analysis of comments received

in response to the publication of the NPRM and the accompanying technical reports, the agency

has made modifications to the recommended injury criteria and their associated performance

limits…. This report, which is a supplement to the previous report, “Development of Improved

Injury Criteria for the Assessment of Advanced Automotive Restraint Systems”, (Kleinberger, et.

al, NHTSA Docket 98-4405-9) documents these modifications and the rationale.”8

The NHTSA report utilizes the Abbreviated Injury Scale (AIS)10 called out in the Micro-ARC

Final Report1 to establish the injury potential of forces caused by the impact KE of the UAS

striking the 50th percentile ATD crash dummy5 placed in the seated position. While automotive

crashes are systematically different in their causation, the impact forces to the crash dummy have

formed the basis for these injury assessments, versus the causation that created the forces. The

8 Eppinger, R., Sun, E., Bandak, F., Haffner, M., Khaewpong, N., Maltese, M., Kuppa, S., Nguyen, T., Takhounts,

E., Tannous, R., Zhang, A., Saul, R., Development of Improved Injury Criteria for the Assessment of Advanced

Automotive Restraint Systems – II, November 1999. 9 http://www.nhtsa.gov/cars/rules/import/FMVSS/#SN208 10 Association for the Advancement of Automotive Medicine Website,

http://www.aaam.org/about-ais.html

20

automotive standards were utilized because of their well-established injury metrics correlated

with the AIS since UAS injuries have no substantial database for tracking such injury potential

based upon the forces applied to the body. Furthermore, the Micro-ARC Category 3 and

Category 4 Performance Standards1 recommended an injury metric that included no greater than

a 30% chance of AIS Level 3 injury or greater following impact with a non-participant. The

drop tests and the use of the automotive injury metrics provided the first basis for correlating

UAS impact KE with the AIS to address these performance standards.

Table 4 - NIAR Summary Test Results and Injury Metrics

A summary of the NIAR test results and injury metrics are shown in Table 4. The observed

impact KE values in the NIAR testing correlate to no greater than 12.5% probability of an AIS

Level 3 injury or greater based on the NHTSA standards. The probability of skull fracture, based

on these impact KE-levels, was substantially lower at a probability less than 1.5%. The injury

metrics from the NIAR tests for both skull fracture and neck injuries provide substantial margin

21

to the Micro-ARC injury thresholds established for Category 3 and 4 operations with the most

likely injury potential being AIS Level 2 or less injury.

The results of the tests showed significant discrepancy with the levels of safety assessed utilizing

the impact KE values extracted from the PoF charts in RCC 321-0012 shown in Figure 8, the

levels of safety derived using the RCC Area Weighted Approach shown in Figure 9 and Figure

10, and those derived using a modified Area Weighted impact KE Approach in the UAS

Characteristics White Paper.6 The discrepancies are shown in Table 5.

Figure 8 - Probability of Fatality from Debris Impacts for Various Body Parts from RCC 321-0011

22

Figure 9 - Probability of Fatality from Debris Impacts for Various Body Positions11

Figure 10 - Average Probability of Fatality from Debris Impacts

1

Table 5 - Difference in Injury Metrics Between FMVSS 208 and RCC Standards

14

It is important to recognize that the FMVSS 208 standards were developed to analyze impacts to

the ATD crash dummies for the range of vehicle crash tests (minor to severe). The ATD data

collected during crash testing is correlated with injury data contained in the AIS database as

reported by medical professionals who have experience with injury severity and, most

importantly, the mortality resulting from such injuries. While automotive crashes are not the

same as those of the a UAS ground collision, the impact forces and physics as it relates to the

ATD crash dummy are the same and, justifiably, can be analytically evaluated against similar

injury metrics associated with automobile accidents until sufficient UAS data becomes available.

Consider that the RCC11,12 PoF metrics established for various impact KE were established from

debris analysis with little or no correlation to significant databases associated with injury metrics

similar to AIS. To clarify the basis for the establishment of the RCC standards in comparison to

the FMVSS 208 standards, it is important to understand how the RCC Standards were developed.

Evolution of RCC Standards and Their Applicability to UAS Ground Collisions.

Most other KE values found in the literature trace back to one of two studies – either Feinstein13

or Janser14. Both of these studies developed a quantitative assessment of PoF of injuries based

on fragment velocity and mass associated with debris studies from explosions to assist in safety

assessments. These studies compare the various probabilities of fatality based on the body

region (head, thorax, abdomen, or limbs) that is impacted by the debris. While it is not explicitly

stated, the more conservative numbers from Feinstein’s work13 may be why they were selected

for use in RCC standards. Of note, the Feinstein values13 were the basis for developing the 10%,

50%, and 90% PoF values in RCC documents. Feinstein’s data was developed by analyzing data

produced by other researchers who conducted projectile impact testing on live animals and

animal carcasses, whereas the source of Janser’s data is not laid out as clearly. It is much harder

to qualify the accuracy of Janser’s content14 because of this fact.

RCC 321-0011,12 published common risk standards for the National Test Ranges and utilized the

PoF for various impact KEs as shown in Figure 8. These curves were combined with an area

weighting from the Janser Standard Man14 to develop a S-curve for each body position since

each body part alone does not have an equal probability of being hit by debris based upon a

person’s position; sitting, standing and prone, as shown in Figure 9. The weighted approach

allows for a better assessment of fatalities by accounting for the probability of the debris hitting

different body areas as well as accounting for different impact angles that can be assessed

through the impact KE values shown in Figure 9.11 The RCC further modified the curve by

11 Range Commander’s Council, Supplement to Standard 321-00 “Common Risk Criteria for National Test Ranges;

Inert Debris”, April 2000 12 Range Commander’s Council, Standard 321-00 “Common Risk Criteria for National Test Ranges; Inert Debris”,

April 2000 13 Feinstein, D. L., Heugel, W.F., Kardatzke, M.L. Weinstock, A. Personnel Casualty Study, IITRI Project No.

J6067 Final Report 14 Janser, P.W. Lethality of Unprotected Persons Due to Debris and Fragments, Twentieth Explosives Safety

Seminar, August 1982

15

averaging the probability for each body position into a composite curve as shown in Figure 10.

Figure 10 was specifically developed by the RCC because of the uncertainty associated with

which body positions might be encountered in any given impact scenario. Figure 10 represents

an equal weighting of the standing, sitting and prone positions based upon Figure 9 and was

deemed by Sandia and the RCC to represent conservative values for PoF since most situations

involving collision in populated areas has a mixed distribution of people in different orientations

and standing and sitting can also represent differences in impact angles.15 The development of

these curves from Feinstein’s original work was conducted by Sandia Labs15 and these curves

remain part of the RCC standards today. The limitations of the RCC standards are rooted in the

fundamental assumptions made to generate the curves and the basis for PoF data.

Sandia Labs was part of the Risk and Lethality Commonality Team (RALCT) that was formed in

1996 to address safety concerns related to the generation of inert debris by flight tests at national

ranges.15 The debris analysis required by the national test ranges, “…can vary from hardware

shed during normal missile operation to fragments generated by explosion, hypervelocity

collision, aerothermal breakup, or a flight termination system.”15 The RCC plots were developed

from Feinstein’s data and employed weightings for hypervelocity type collisions where the

debris contained a larger number of low mass fragments. Figure 8, Figure 9, and Figure 10

represent the weighted KE values for these more numerous, smaller mass fragments.

Furthermore, the analysis conducted by the RCC and Sandia Labs shows that the inert debris

impacts were largely vertical since it was assumed that the breakup or collisions would occur at

very high altitudes. Sandia Labs recommended that the data set and analysis which culminated

in Figure 8, Figure 9, and Figure 10 be utilized by range safety personnel until more accurate

data and predictive tools for evaluating large mass (> 2lbs) impact on people is developed.15 The

testing and analysis of the UAS impacts with the ATD dummy against the FMVSS standards

forms the initial basis for a better approach to understanding injuries associated with UAS

impacts then utilizing fragment analysis from in-flight breakup of hypervelocity missiles.

Differences Between UAS Collisions and Low Mass, High Volume Debris

Following In-flight Breakup

Small UAS (sUAS) ground collisions do not occur due to an inflight breakup at high altitudes

with a large quantity of small mass fragments, but rather sUAS platforms tend to have collisions

at lower speeds where the whole platform strikes an individual somewhere on the exposed

portions of the individual’s body. Two fundamental UAS characteristics are addressed to show

how the RCC PoF metrics may be excessively conservative, as shown by the NIAR results; 1) a

sUAS has larger contact area than that of small debris fragments resulting in less severe injuries

for a given impact KE and 2) crash geometries and the elasticity of sUAS cause collisions to be

dramatically different than solid, small mass fragments. Crash geometries are defined as the

15 Cole, J.K., L.W. Young, and T. Jordan-Culler. "Hazards of Falling Debris to People, Aircraft, and Watercraft."

Sandia National Laboratory. 1997. doi:10.2172/468556.

16

orientation, impact angle and multiple contact areas that define how energy is transferred to the

individual during the collision

Larger Contact Area of UAS vs. Fragments.

The physiological data upon which Feinstein based his analyses were obtained from experiments

that had been performed for the Department of Defense on live animals, human cadavers, and

skin and gelatin models to determine the injury potential of various blast fragments associated

with explosions or blast effects due to an explosion or nuclear blast wave. Tests with animals,

human cadavers/skulls were conducted using small ball type projectiles, glass fragments shot

from Styrofoam sabots16 and dropping subjects/test articles from various heights to create

sufficient impact energy necessary for the test. The effect of the larger contact area of the sUAS,

when compared to small mass projectiles and glass fragments, is illustrated by way of data

published by Fugelso.17 The data in Table 6 compares various projectiles falling at terminal

velocity or propelled to higher velocities are based on their ability to penetrate skin and cause

blunt trauma resulting in liver fractures. The baseball and golf ball have substantially higher KE

when falling at terminal velocity; however, the larger contact area and curved surfaces have

extremely low probability of penetrating bare skin and no likelihood of liver fractures when

compared with smaller particles such as a penny and nut & bolt that have much lower KE values

at terminal velocities, but have a 100% chance of penetrating bare skin and some chance of

causing liver fractures. Furthermore, the larger contact areas of small mass fragments versus a

full size sUAS prevents the vehicle from striking specific body parts, which is especially true

when impact angles are steep. The sUAS physical geometry results in numerous contact points

during a collision when descending at impact angles above horizontal, making impacts on single

body parts such as the thorax implausible. For example, the use of blade guards on arms

extending away from the main body of the sUAS and landing gear extending down from the

sUAS creates barriers to striking small contact areas such as the throat area such that bilateral

hemorrhage of carotid arteries is highly unlikely to occur. Bilateral hemorrhage of the thorax

was one of the injuries used in the creation of the Feinstein data for the thorax.13 Injuries to the

thorax become increasingly less plausible when the sUAS is descending at angles greater than

45 degrees. For the waiver submitted for the Phantom 3 Standard and Advanced, the descent

angles were greater than 58 degrees, which further reduces the likelihood of any significant

impact to the thorax when compared to small fragment projectiles moving horizontally at similar

kinetic energies. The use of the thorax impact KE as the sole means of defining regulatory

thresholds is excessively conservative in the context of credible impact scenarios and their

resulting injury potential for blunt force trauma. The regulatory framework should consider that

16 White, C. S., Bowen, G. I. and Richmond, D. R., Biological Tolerance to Air Blast and Related Biomedical

Criteria, Lovelace Foundation, April 1965, U. S. Atomic Energy Commission CEX-65.4. 17 Fugelso, L. M., Weiner, L. M., and Schiffman, T. H., Explosive E#ects Computation Aids,

Final Report GARD Project No. 1540, General American Research Division, General

American Transportation Corp, Niles, IL.

17

the potential of laceration injuries to the thorax has a greater likelihood of creating bilateral

hemorrhage than blunt force trauma injuries caused by impact KE. The waiver process standards

included in this document address appropriate methods for mitigating laceration injuries.

Comparing injury potential of sUAS to data developed from blast fragments with penetration

potential and small contact areas does not result in similar contact or collision scenarios that are

appropriate for evaluating sUAS. The NIAR tests are actual sUAS collisions that provide actual

impact data which is correlated to automotive injury data similar in injury type and forces on the

ATD dummy that are more similar to sUAS impacts with a human.

Table 6 - Injury Characteristics for Some Common Objects15

Crash Geometries and the Elasticity of UAS

sUAS platforms are predominantly made of various forms of plastic and foam materials as

characterized by the various categories of UAS described in the A4 UAS Characteristics White

Paper.6 Multi-rotor sUAS are dominated by this type of design and are characterized by

significant flexibility in their structures and frangibility of their payloads during ground

collisions. Many fixed wing platforms are made of foam material and break-away wings that

further reduce impact forces over those characterized by solid, metal debris fragment masses

used to develop the PoF metrics in the RCC standards. sUAS fuselages are not fabricated from

large amounts tungsten, aluminum or steel as might be observed from an in-flight breakup of a

18

missile on one of the national test ranges. While the motors of sUAS are made of these types of

materials, the motors are rarely the surface or material that is in contact with a human during a

ground collision event. Furthermore, the motors are attached to flexible structures especially in

monocoque fuselage multi-rotor UAS, like the Phantom 3, resulting in less impact energy if they

do contact the human as part of the impact event. A review of the resultant loads from the NIAR

tests can also be used to show how these characteristics of a sUAS are substantially different

than those of low mass, metallic fragment impact as they relate to skull fracture. Table 7 and

Figure 11 shows the resultant head loads as calculated for the 10 lbs head of the ATD Hybrid III

50th Percentile test dummy.

Table 7 - Resultant Head Forces from NIAR Tests

Note: Colors in the table represent the magnitude of the individual entry with green being the lowest values and red

being the highest values within a column.

Dr. Narayan Yoganandan18 studied numerous tests of skull fractures from 1949-2004. The study

looked at the peak forces resulting in skull fractures and how testing had led to HIC standards

based upon cadaver testing. Table 8 shows the results of the Gurdjian tests that were conducted

by dropping cadaver skulls onto steel plates. The Gurdjian data show that skull fractures at

various locations on the skull resulted from impact KE values ranging from 948.3 J±120.1 to

652.6 J±67.6 J (699 ft-lbs±88.6 ft-lbs to 481.3 ft-lbs±49.9 ft-lbs). While the contact areas of the

Gurdjian tests were not precisely documented, the contact areas are certainly higher than those of

small debris fragments, which leads to dramatically different energy results then those shown in

the RCC standards. The sUAS collision tests conducted at NIAR shown in Table 7 resulted in

18 Yoganandan, N, Pintar, F., Biomechanics of temporo-parietal skull fracture, Clin Biomech (Bristol, Avon). 2004

Mar;19(3):225-39.

19

impact KEs substantially lower than those impact KEs required to obtain skull fractures during

the Gurdjian tests even at the low end of the standard deviation of the mean. Furthermore,

Yoganandan reported that the type and shape of the contactor significantly affected the peak

force required to cause a skull fracture.18 “For the rectangular impactor, the parietal region was

selected as the impact site. The mean fracture for rectangular plate impacts was 12390 N

(±3654). The average fracture force for both impact sites with the circular impactor was 5195 N

(±1010). Stiffness was computed as the average slope of the force–displacement curve between

4 and 12 kN for the rectangular plate impactor and 2–6 kN for the circular plate impactor…. The

contact area of the impactor significantly affected peak forces. Hodgson and Thomas (1971) and

Yoganandan et al. (1993, 1991a, 1989, 1991b) advanced similar conclusions on facial bone

structures in experimental studies in 1970s and 1980s.”18 A similar result can be found in a later

report by Yoganandan19 that used a 48 mm (1.9 in) radius hemispherical anvil impactor to study

skull fracture. Yoganandan found dramatically lower energy levels than those reported by

Gurdjian as shown in Table 8 using the hydraulic anvil with a small, radial contact area. While

these tests give more credence to the RCC standards in terms of impact KE, the results are likely

due to the stiffness and size of the steel hydraulic ram that imparts contact loads more like falling

projectiles than those of a flexible and frangible sUAS with breakaway camera structures and

plastic airframe structures or foam. The mean forces for the static and dynamic forces shown in

the Yoganandan tests19 resulting in skull fracture shown in Table 9 are higher than the largest

resultant force recorded during the NIAR drop tests with a flexible Phantom 3. The smallest

dynamic force for all regions tested resulting in a skull fracture was 8,809 N (1,980 lbf). This

gives credibility to the assessment that the Phantom 3 impacts would not have resulted in skull

fractures and the subsequent low HIC and AIS results shown in the study are valid despite the

higher impact KEs of the Phantom 3. The Yoganandan results give credence to the high PoF if

one solely looks at impact KEs shown in Table 9. However, the resultant forces ultimately lead

to a different conclusion due to the difference in character of a steel hydraulic ram contactor

when compared to a flexible plastic Phantom 3.

19 Yoganandan, N, Pintar, F., Sances Jr., A., Walsh, P., Ewing, C., Thomas, D., Snyder, R., Biomechanics of Skull

Fracture, Journal of Neurotrauma, 1995, Volume 12, Number 4, 659-668.

20

Table 8 –Biomechanical Data for All Skull Fractures from Gurdjian18

Table 9 –Biomechanical Data of Skull Fracture Tests using a 48mm radius Hydraulic Anvil

As an extension of this analysis, the team looked at simple ways to develop a new impact KE

threshold based upon the resultant force methodology introduced in this analysis. If one were to

use the lowest resultant force threshold for skull fractures based upon Dr. Yoganandan’s work

and the NIAR drop tests data, how could this resultant force be translated into an upper bound

for a Phantom 3 in terms of impact KE that is easily testable using ballistic analysis. To this end,

the team reviewed data for KE and the resultant load data to look for consistency across the set

of data and the variability of the data as shown in Table 7. The table shows that the variability of

the resultant load data and the corresponding 98% confidence (3 sigma) resultant load data for

21

the NIAR test points conducted with the Phantom 3. The trend line for the 98% confidence data

points is compared with a linear trend line of the NIAR data as well as the trend line developed

from the calculation of impulse force developed for bird strikes by McNaughton.20 McNaughton

developed a relationship for impulse force (Pi) as a function of mass of the bird (m) and velocity

(V) of the aircraft as shown below where mass is in kilograms and velocity is in knots.

𝑃𝑖 = 1.18 × 𝑚2 3⁄ × 𝑉2 Equation 1

Load factors are calculated by taking the calculated impulse for the Phantom 3 using the

equation above and dividing by the weight of the head (10 lbs) to determine the load factor in

g’s. The comparison of the trend lines for the impact KE and the resultant load factor at the head

correlates well with the exception of the horizontal impact tests. Since these values fall below

the maximum resultant impact load from the Yoganandan work, these values are seen as

acceptable within the trend of the analysis. It is likely that a horizontal power flight curve must

be segregated from the power off ballistic curves when more horizontal impact data becomes

available. This trend correlates with the terminal velocity data vs. propelled data shown in Table

6. It is realistic that flight over people will not involve horizontal powered flight at the same

height as non-participants, but rather more vertical impacts whether powered or unpowered.

The results of the analysis of resultant load factor versus impact KE is shown in Figure 11. The

98% confidence level (three ) trend line is used to extrapolate the maximum impact energy for

skull fractures as a function of impact KE and the intersection of the maximum load factor based

upon Yoganandan shows the maximum KE value of 128 ft-lbs. The 98% confidence level

threshold uses the equation for the three s linear fit of the data to calculate the resultant load

factor and the load factor must always remain less than 198 g. The equation is as follows:

𝑅𝑒𝑠𝑢𝑙𝑡𝑎𝑛𝑡 𝐿𝑜𝑎𝑑 𝐹𝑎𝑐𝑡𝑜𝑟 (𝑔) = 1.5441 ∗ 𝑖𝑚𝑝𝑎𝑐𝑡 𝐾𝐸 (𝑓𝑡 − 𝑙𝑏𝑠) Equation 2

The impact KE is derived from the ballistic analysis for the vehicle configuration under

evaluation and the resultant load factor is calculated.

20 McNaughtan, I. I.: The Design of Leading Edge and Intake Wall Structure to Resist Bird Impact. Royal Aircraft

Establishment Technical Report 72056, 1972.

22

Figure 11 - Analysis of Resultant Impact for Skull Fractures versus Impact KE

To extend this analysis, the skull fracture resultant load must be applied to the metrics for neck

injury and AIS3 injuries to verify that this level of resultant does not cause a neck injury that

would exceed the 30% chance of an AIS3 or greater injury. The trends in the data from the

NIAR drop tests shown in Table 4 and Figure 12 indicate that the impact KE required to cause

head injury may not be the limiting factor in terms of impact KE relative to less than a 30%

probability of an AIS3 or greater injury. Neck injury values shown in the limited NIAR tests

indicate that neck injuries may be of greater concern than skull fracture. The limits imposed by

the slope of the trend line for the three sigma values up to the lower bound of the Yoganandan

skull fracture loads of 8,809 N or 1980 lbf resulting from 128 ft-lbs of impact KE will remain

below the 30% probability of an AIS3 or greater neck injury based upon the limited data

collected during these test as shown in Figure 12.

23

Figure 12 - Probability of Neck Injury Trends from NIAR Test Data

The trend lines shown in Figure 11 and Figure 12 indicate the neck injury data and head injury

trends for the flexible Phantom 3 Standard and Advanced aircraft would not result in skull

fractures or neck injuries for the proposed flight envelope provided in the Appendix A Part 107

waiver. The envelopes are shown in Figure 13. Using the RCC standards for impact KEs of

106 ft-lbs for the envelope proposed in the waiver and the 128 ft-lbs maximum impact KE

threshold for the 98% confidence level resultant load would have resulted in a 98-100% PoF

value using the RCC standards for head or thorax injury as shown in Figure 8 and 75-80% PoF

values if using the area weighted and average human orientation chart shown in Figure 10 from

the RCC standards. This significant gap in perceived level of safety between the RCC standards

and the substantially different injury metrics observed during the drop tests suggests the RCC

data does not represent the collision dynamics and injury mechanics representative of collisions

with flexible, plastic sUAS platforms.

As long as the resultant load factor remains below 196 g, then there is a 98% confidence that no

skull fractures will occur and there will be less than 30% probability of having a neck injury

exceed AIS3 or greater. The limit of this analysis is for multi-rotor vehicles made with plastic,

24

flexible structures. The analysis applies to blunt force trauma type injuries. Laceration and

penetration injuries must be addressed separately.

These standards are extremely conservative. The NIAR drop tests were worse case collision

scenarios with no blade guards and near center of mass collisions. During a few of the tests, the

impacts were slightly offset by no more than an inch, yet the offset collision caused the vehicle

to roll away from the ATD dummy quickly, which resulted in a significant reduction in impact

KE over other tests at the same condition. This condition was very evident in the horizontal

impact tests. The three horizontal impact tests were all conducted at 12.3 ft/s; however, the

resultant load at the head of the ATD dummy for the three tests was 25.05g, 60.65g and 43.18g,

respectively. The variation in the first two tests can be seen in the video of the first test that had

a slight offset and resulted in the Phantom 3 rotating across the head as one arm struck the head

before the other and started the vehicle rotating away from the head. The other two tests had a

more center of mass impact between the arms of the vehicle resulting in more energy transfer.

The likelihood of less severe offset collisions is increased with the additional of blade guards,

landing gear and the breakaway features of the payload for the Phantom 3.

Figure 13 - Phantom 3 Advanced Waiver Request Envelope

Increasing the threshold of impact KE to 128 lbs for sUAS platforms for flight over people has

the additional effect of dramatically increasing the operational envelope for unmanned platforms

other than multi-rotors when using parachutes as safety mitigations for flight over people and

25

flight over heavily populated areas. Task A4 looked at the impact of parachutes with various

levels of safety defined by RCC standards. While the Phantom 3 envelope shown in Figure 13

does not require a parachute to meet the 98% confidence level KE threshold of 128 ft-lbs, the use

of parachutes as mitigations for blunt force trauma injuries while flying over people is critical to

opening up the envelope for more robust commercial vehicles during flight over populated areas.

The parachute standards reviewed in Task A4 are reevaluated in comparison to the 98%

confidence level impact KE threshold of 128 ft-lbs based upon the injury metrics in this report

for skull fracture and less than a 30% chance of a neck injury resulting in an AIS or greater

injury. The 28 ft-lbs impact KE value from the RCC standards represents the 1% PoF of head

injury and 10% probability of a thorax injury as shown in Figure 8. The use of the new metrics

not only makes it possible for the Phantom 3 to be safe during Category 4 Performance

Standards as defined by the Micro-ARC Final Report, but many other platforms could meet these

standards at substantially higher takeoff weights using parachutes and automatic deployment

mechanisms as mitigations for Category 3 and Category 4 Performance Standards. Parachutes

used as safety devices in this manner must meet specific standards and provide sufficient altitude

to decelerate to the speeds shown in Table 10. It is important to note that 18.0 ft/s is assumed to

be the lowest reliable rate of descent that can be achieved with a parachute recovery system.

Below this rate of descent, it is questionable whether there is sufficient dynamic pressure to

maintain a fully inflated canopy to support deceleration of the vehicle.

Table 10 - Comparison of RCC Standards vs. Modified Impact Energy Thresholds

for Various Aircraft Weights when Descending under Parachute.

2.6. Energy Transfer Analysis

The planned technical approach for the analysis of energy transfer from the Phantom 3 to the

ATD dummy was initially based on the Conservation of Angular Momentum (COAM);

however, the test data from NIAR was not complete enough for conducting this analysis. In lieu

26

of COAM analysis, the NIAR test data was used to calculate energy transfer to the dummy by

way of the measured impulse (lbf-s) at the base of the head and measurement of the rotational

energy of the dummy head after impact. The trends in calculated energy absorption data are

logical; however, the area requires additional work, in the form of finite element analysis (FEA)

simulations to fully understand the mechanics of energy transfer and dissipation through non-

conservative mechanisms like loses in deformation and the differences between the results of

high energy vertical and angled impacts.

The energy transfer analysis centered on evaluating the energy transfer to the ATD dummy’s

head during impact through the ATD’s load cells and accelerometers. Before discussing this

analysis in a detailed manner, it’s necessary to provide an overview of the energy loss

mechanisms that dissipate UAS impact KE. First, the UAS fuselage and payload deform by

flexing and, in some cases, breaking. Appendix B - NIAR Test Article Damage contains a

discussion of the impact damage found on each vehicle after testing. The deformation energy

cannot be calculated from the available test data. The vehicle also rebounds off the ATD head

and has linear and rotational velocities after impact. The energy of the rebounding aircraft is

referred to as Post-Impact UAS KE. The Post-Impact UAS KE in this analysis is estimated by

analyzing photometric data to determine the Phantom 3’s resultant velocity and rates of rotation

immediately after the vehicle breaks contact with the ATD head after impact has occurred. The

impact of the UAS on the ATD head results in impulse, which is measured at the upper neck

load cell. In this analysis, the energy that creates that impulse is called Transferred Energy

(Etransferred). The impact, which is characterized by the impulse, results in a change in the KE of

the dummy’s head. The KE of the dummy’s head, after the impact, is denoted as KEhead. The

last way in which the UAS impact energy is dissipated is through direct absorption by the ATD

head material, or in the case of an impact with a human head, the skull, brain, and other tissues

of the head. Eabsorb is the key parameter that relates directly to the injury potential of an impact.

The upper neck load cell measurements were used to calculated the impulse experienced by the

dummy’s head. Impulse, J, is the integral of a force, F, over the time interval, t, that the force

acts on a mass.

𝐽 = ∫ 𝐹𝑡2

𝑡1𝑑𝑡 Equation 3

In turn, the energy transfer that yielded that impulse can be calculated by the expression:

𝐸𝑡𝑟𝑎𝑛𝑠𝑓𝑒𝑟𝑟𝑒𝑑 =𝐽2

2𝑚 Equation 4

where the mass value is based upon the weight of the ATD Dummy head of 10 lbs. The NIAR

data included upper neck load cell measurements of force in the dummy head x, y, and

z-directions as a function of time during the tests (Figure 14). The ATD dummy load cells

measure force at 20kHz. Based on this, the time history of forces in the three principle directions

were integrated over the time period of each test using a MATLAB© script. The integration

calculates the area between the force curve and the x-axis (time) for the duration of the test. The

27

calculated impulse values are vector quantities, because they have a magnitude in terms of lbf-s

and a direction based on the axis to which the force values are correlated. The total impulse

measured at the upper next load cell is the vector sum or magnitude of the impulse in the x, y,

and z-directions.

The KEhead values used in this analysis only account for the change in head rotational energy

during the collision, as the data set didn’t contain enough information to determine the head’s

KE due to linear translation independent of rotation. The ATD head KE is given by:

𝐾𝐸ℎ𝑒𝑎𝑑 =1

2𝐼(𝜔2

2 − 𝜔12) Equation 5

where I is the mass moment of inertia of the dummy head and ω is the rotational rate of the

head. Total rotational energy was taken as the sum of rotation energy about the x, y, and z axes

during the impact. Based on a CAD model of the ATD Hybrid III 50th percentile male crash

dummy, the mass moments of inertia used in these calculations were 0.0183, 0.0231, and

0.0107 kg/m2 about the x, y, and z axes, respectively.21 These are the mass moments of inertia

about the CG of the ATD dummy head.

The energy absorbed by the head is determined by the relationship:

𝐸𝑎𝑏𝑠𝑜𝑟𝑏 = 𝐸 𝑡𝑟𝑎𝑛𝑠𝑓𝑒𝑟𝑟𝑒𝑑 − 𝐾𝐸ℎ𝑒𝑎𝑑 Equation 6

In this analysis, the absorbed energy calculations are conservative in nature, because they only

include the rotational KE of the head. The estimated energy absorption values would decrease

21 Correspondence from Xianping Du, Ph.D. Student under Dr. Feng Zhu at Embry-Riddle Aeronautical University,

dated 16 August 2016

Figure 14 Time History of Upper Neck Z-direction Force During a NIAR Drop Test

28

with the inclusion of KE due to linear velocities, for example vertical translation of the head and

body, independent of rotation, in the vertical drop impacts.

Table 11 shows the UAS Impact KE, energy transferred to the head due to impulse load

(Etransferred), and the amount and percentage of the impact KE that was NOT transferred to the

head. This data shows a trend in which an increasing percentage of the impact KE is not

transferred to the head as the drop height and, consequently, impact velocity and KE increase. It

is likely that more of the impact energy is dissipated in the distortion and flexing of the aircraft

as the impact KE increases. This follows damage trends which are detailed in Appendix B -

NIAR Test Article Damage. Physical inspection of thirteen of the twenty-four Phantom 3

Standard test articles showed increasing levels of damage that correlate directly to the drop

height and impact velocities. Assessing the damage to the payloads of the remaining aircraft was

done by viewing the impact videos. Video analysis was also used to assess whether cameras

broke during testing or if they broke off during handling and shipping to UAH. The 20 ft drops

resulted in either no damage to the fuselage at all or slight buckling where the vehicle arms

merge into the body. None of the 20 ft drops resulted in separation of the camera or discernable

damage to the camera. The 50 ft drops are characterized by damage which includes complete

separation of the camera from the fuselage in one test, damage to the camera itself, significant

buckling of the fuselage where the arms merge with the body, and cracking of internal supports

that surround the battery. The drops from 30 and 40 ft resulted in intermediate levels of damage.

The angle impact drops where characterized by increasing levels of camera damage as the impact

velocity and KE increased. The 36.5 ft, 65° angle impact drops resulted in some camera damage

and only one partial separation of the camera. The 51.7 ft, 58° angle drops all resulted in

separation of the camera and greater degrees of damage to the aircraft. Energy dissipated

through deformation and elastic energy of the Phantom 3 and other sUAS requires further

investigation through FEA simulation to more precisely understand UAS impact KE

loss/conversion with detailed energy absorption analysis.

29

Table 11 - Differences in Impact KE and Energy Transferred to ATD Head

Table 12 shows the UAS Initial KE, Etransferred, KEhead, and Eabsorb values calculated for each test.

The calculated energy transfer shows that impulse increases as drop altitude increases. Because

the impact in the first twelve tests was vertical and aligned closely with the ATD head’s CG and

there is little energy that results in rotational motion of the head. The angle-impact tests are

marked by generally higher KEhead values, in particular the 46.1 ft, 58° and 51.7 ft, 58° drops.

The angled impacts had less energy transferred to the head as the camera and payload struck the

front of the head and slid down the forehead and nose of the ATD dummy as the camera and

camera mount broke away prior to contact of the body of the Phantom 3. Furthermore, the neck

is much more capable of extension than compression and more of the energy transferred to the

head resulted in translation of the head that could not occur during compression of the neck in

the vertical tests. Based on the greater KEhead values in the angled impact tests, the 46.1 ft, 58°

and 51.7 ft, 58° angle impact drops are characterized by lower percentages of energy absorbed

by the head. It can be concluded that the head, while undergoing greater accelerations, will

absorb less of a blunt impact when it is free to move and when the UAS not does not have a

complete center of mass contact due to an offset or interaction of some component of the vehicle

(such as the payload) that results in the breakaway of a frangible component or the interaction of

a portion of the aircraft that deflects the vehicle from creating a direct contact. An average of

50% of the UAS impact KE becomes Eabsorb across all of the vertical drop tests. The magnitude

Test Name UAS Impact KE (ft-lb) Energy Transferred (ft-lbs) Difference (ft-lb) % Impact KE Not Transferred

V(90)-20-1 34.57 24.23 10.34 29.90%

V(90)-20-2 34.96 23.72 11.24 32.14%

V(90)-20-3 34.99 23.73 11.26 32.17%

V(90)-30-1 57.47 31.16 26.31 45.78%

V(90)-30-2 57.98 31.97 26.01 44.86%

V(90)-30-3 58.54 29.06 29.48 50.36%

V(90)-40-1 64.88 33.52 31.36 48.33%

V(90)-40-2 67.31 34.43 32.88 48.85%

V(90)-40-3 78.72 35.18 43.55 55.32%

V(90)-50-1 90.02 40.15 49.87 55.40%

V(90)-50-2 86.62 39.63 46.99 54.25%

V(90)-50-3 84.42 39.33 45.09 53.41%

H(0)-4.5-1 11.90 7.36 4.53 38.11%

H(0)-4.5-2 11.61 4.23 7.38 63.55%

H(0)-4.5-3 10.33 4.17 6.16 59.62%

A(65)-36.5-1 46.06 24.42 21.64 46.98%

A(65)-36.5-2 48.45 24.18 24.28 50.11%

A(65)-36.5-4 50.65 22.24 28.40 56.09%

A(58)-46.1-1 78.64 28.48 50.16 63.79%

A(58)-46.1-2 84.72 28.15 56.57 66.77%

A(58)-46.1-3 77.76 26.96 50.80 65.33%

A(58)-51.7-1 96.33 26.37 69.96 72.63%

A(58)-51.7-2 100.57 27.59 72.98 72.57%

A(58)-51.7-3 99.15 26.78 72.37 72.99%

30

of absorbed energy increases, which follows a trend of increasing HIC15 values calculated by

NIAR. HIC15 is a measure of the likelihood of a head injury arising from an impact. The

maximum tolerable value of HIC15 is 700.8 At worst, the angle impact tests that drop from

51.7 ft only achieve 24% of the maximum tolerable value for HIC15. The fact that this analysis

shows low percentages of the UAS impact KE being absorbed by the head correlates well with

the low likelihood of AIS-3 or greater injuries (Table 4) and the low HIC15 values from the tests.

31

Table 12 - Impact Energy Absorption by the ATD Dummy Head and Injury Metrics

Test Name UAS Impact KE (ft-lb) Transferred Energy (ft-lbs) KE Head (ft-lb) Energy Absorbed by Head (ft-lbs) % Impact Energy Absorbed HIC Value (Max 700)

V(90)-20-1 34.57 24.23 1.91 22.33 64.58% 7.83

V(90)-20-2 34.96 23.72 9.06 14.67 41.95% 29.18

V(90)-20-3 34.99 23.73 0.25 23.48 67.10% 19.94

V(90)-30-1 57.47 31.16 0.17 31.00 53.93% 12.01

V(90)-30-2 57.98 31.97 0.29 31.68 54.64% 14.99

V(90)-30-3 58.54 29.06 0.10 28.96 49.48% 15.64

V(90)-40-1 64.88 33.52 1.14 32.38 49.90% 19.26

V(90)-40-2 67.31 34.43 0.75 33.68 50.04% 23.45

V(90)-40-3 78.72 35.18 0.38 34.80 44.20% 23.02

V(90)-50-1 90.02 40.15 0.36 39.79 44.20% 46.62

V(90)-50-2 86.62 39.63 0.29 39.34 45.42% 34.13

V(90)-50-3 84.42 39.33 0.62 38.72 45.86% 42.79

H(0)-4.5-1 11.90 7.36 0.61 6.75 56.72% 59.54

H(0)-4.5-2 11.61 4.23 0.35 3.89 33.47% 48.04

H(0)-4.5-3 10.33 4.17 0.17 4.00 38.69% 42.24

A(65)-36.5-1 46.06 24.42 1.28 23.14 50.24% 39.55

A(65)-36.5-2 48.45 24.18 0.17 24.00 49.54% 30.25

A(65)-36.5-4 50.65 22.24 0.50 21.74 42.93% 26.25

A(58)-46.1-1 78.64 28.48 6.44 22.04 28.02% 107.94

A(58)-46.1-2 84.72 28.15 10.32 17.83 21.04% 119.7

A(58)-46.1-3 77.76 26.96 8.68 18.28 23.50% 147.82

A(58)-51.7-1 96.33 26.37 13.54 12.83 13.32% 137.17

A(58)-51.7-2 100.57 27.59 16.04 11.55 11.48% 165.07

A(58)-51.7-3 99.15 26.78 15.99 10.79 10.88% 123.64

32

The COAM approach was originally selected because the dummy is a set of masses connected

by hinges. The hip hinge was assumed to be fixed, and therefore angular momentum of all

masses in the collision could be conserved around that point, i.e. the net angular momentum

about the hip hinge is always equal to zero. As such, the angular momentum of the

Phantom 3/dummy system prior to the impact is equal to that of the Phantom 3 dummy system

after the impact. Appendix A explains COAM and its application to this system in greater detail

with diagrams and equations. Strict Conservation of Momentum could not be applied because

the dummy was not free to translate.

After reviewing the NIAR test data and processing the data available to determine energy and

momentum values during each test, it was determined that the data was not capable of fully

supporting the COAM analysis. The dummy head z-axis linear motion was not measured in the

photometric data. The dummy’s torso moved during impacts, but the photometric data did not

include torso linear motion and rates of rotation. During post-processing, it was not possible to

calculate position vectors from the dummy’s hip hinge to the Phantom 3, head CG, and torso CG

from the NIAR dataset. These portions of data are an essential part of calculating angular

momentum contributions based on the motion of masses. Alternatively, researchers attempted to

calculate component velocities and displacements during impacts from head accelerometer data

and time stamps; however, the resulting values were exceedingly low. There were

inconsistencies in the estimated vehicle rotational and translational KE following impact, for

example, during Test UA17A-11 V(90)-50-1. The photometric data from these tests showed that

the vehicle had between 6-12 times the amount of rotational energy than what was observed in

Tests UA17A-12 V(90)-50-1and UA17A-13 V(90)-50-3. This difference was not observed in

the number of complete or partial vehicle rotations after the impact recorded in videos of the

three tests. Impact energy expended during vehicle deformation (elastic and plastic) and payload

damage cannot be accounted for through COAM analysis. Additionally, the evaluated

Phantom 3 total post-impact KE had high outlier values in tests 20-1, 30-2, 50-1, 4.5-1, 36.5-1,

46.1-3, and 51.7-3 (Table 13). Test 20-1 is particularly problematic, because it shows that

32.66% of the UAS Impact KE remains as Post-Impact KE, which conflicts with analysis

showing that 70% of the UAS Impact KE is experienced as impulse at the base of the head. The

inconsistencies in this data served to support the conclusion that the COAM method was

untenable in this application.

33

Table 13 - UAS Impact KE and Post-Impact KE from Photometric Data

2.7. Pendulum Testing of Blade Guards as a Laceration Mitigation

The FAA A4 Project team concluded that the most prevalent type of injuries associated with

sUAS are laceration injuries from propellers through analysis of Academy of Model Aeronautics

(AMA) injury records and online videos. The mitigation of laceration injuries is an essential part

of managing risk for operations directly over people with a Phantom 3 multirotor aircraft.

Conducting testing of the design of the blade guards to determine their resilience during a

collision and verifying that the blade guards limit blade contact during horizontal impacts during

a credible aircraft failure scenario under UAH’s Part 107 waiver application CONOPS is critical

to protecting the public when operating over people.

UAH installed the stock blade guards on the Phantom 3 aircraft and replaced the string

connection between the guards with RC aircraft control rods comprised of steel clevises and

carbon fiber tubes (Figure 15). The guard link prevents limbs or other objects from getting

between the propellers. The string was replaced because it does not tolerate impact well and is

difficult to install correctly. A solid connection between the propeller guards is essential because

it prevents a limb from being pulled toward the aircraft body and trapped by counter-rotating

blades.

34

UAH conducted a pendulum test in the UAH Mechanical and Aerospace Engineering

Department’s Autonomous Tracking Optical Measurement (ATOM) laboratory.22 During vehicle

tests with guards installed (Figure 15), the phantom aircraft was swung on a 14-foot pendulum at

varying speeds to strike a chamois-padded PVC pipe in vicinity of the carbon-fiber blade guard

link (Figure 16). The padded pipe was used as a surrogate for a human arm or other body part

capable of fitting between the blade guards. The ATOM lab’s motion tracking cameras were

used to determine the impact velocity and track the locations of visual markers, placed on the

aircraft, during an impact sequence. By placing markers on the blades and blade guards, it is

possible to calculate the relative position of the markers with respect to each other and determine

the extent of blade excursion beyond the guards during an impact.

22 http://www.uah.edu/eng/eng-research/research-laboratories, accessed 08/20/2016

Figure 15 - Modified blade guard link (highlighted with red

oval)

35

During the first seven tests, it was not easily apparent how far the blade tips extended beyond the

guards during blade guard impact with the surrogate arm based on the marker setup. For the

final two tests, more markers were added to the aircraft blades and the guards to clearly ascertain

the amount of blade tip excursion beyond the guards. This final visual marker configuration is

shown in Figure 17. Figure 17 also shows the individual marker naming convention used to

annotate the positions along the left guard, connector, right guard, left/right propellers, and the

Phantom’s body to correlate relative positions during image capture and post-processing in the

ATOM laboratory.

Figure 16 - Blade guard impact test

Figure 17 - Visual Marker Configuration During Tests 8 and 9

36

The test results are shown in Table 14. The link was damaged during an impact at close to

10 kts; however, the surrogate limb did not go between the guards. One 7 kts impact broke the

guards prior to the aircraft rebounding. The fastest impact test, at 15 kts, broke the guards, but

the vehicle still rebounded from the impact point. While parts of the guards broke on some tests,

the outer perimeter formed by the guards and links remained intact, and the vehicle always

rebounded away from the post after the collision.

Figure 18 shows how the guards broke during tests 8 and 9, which had impact speeds of

approximately 7 and 15 kts, respectively. The image from test 8 shows that the blade guard

almost completely broke, and the test 9 image shows that the post connecting the outer guard

radius to the motor mount is completely broken. This indicates that any impact with a horizontal

speed of 10 kts or greater will probably break the guard connections where they mount to the

aircraft.

Tests demonstrated the blade guards had sufficient strength to prevent most cutting injuries when

impact horizontal impact velocities are less than 10 kts (16.89 ft/s). The worst case condition for

laceration injuries is an uncontrolled descent in which the aircraft lands in an edgewise manner

Test #Impact Speed

(knots)Limb Penetration Past Link Blades Go Past Guards (Cutting Potential) Remark

1 6.93 No Indeterminant - Superficial Cutting Possible No Damage

2 7 No Indeterminant - Superficial Cutting Possible No Damage

3 7 No Indeterminant - Superficial Cutting Possible Guard Damaged

4 9 No Indeterminant - Superficial Cutting Possible Connector Damaged

5 9 No Indeterminant - Superficial Cutting Possible Guard Damaged

6 8.95 No Indeterminant - Superficial Cutting Possible Connector Clevis Opened

7 9.84 No Indeterminant - Superficial Cutting Possible No Damage

8 7 No Yes - Approx. 1.3 cm - Momentary Cutting Broken Guard

9 15 No Yes - Approx. 2.7 cm - Momentary Cutting Broken Guard

Table 14 - Pendulum Test Results

Figure 18 - Guard Damage during test 8 (left) and test 9 (right)

37

that exposes the guards to a horizontal impact velocity significantly exceeds 10 kts. In this case,

a non-participant would be exposed to the blades directly or with the blade guards damaged at

impact with the blades spinning. The best mitigation for laceration injuries under this scenario is

for the operator to disarm the vehicle or hit a motor stop switch following loss of control.

The waiver application discussed the most probable impact angles based on ballistic

characterization of the vehicle and showed the majority of impacts will occur with at least a 55°

impact angle with the aircraft falling in a level attitude. The assumption of a level attitude during

power-off, descending flight has been validated throughout UAH’s A4 and A11 flight testing of

the Phantom 2 and Phantom 3 aircraft.6 During an angled descent of 55º or greater, which is the

most credible impact scenario, the upward component of the impact force will push the blade

guard into the blades as shown in Figure 19. During a collision sequence, the blade guard will

push into the blades resulting in motor stoppage on the blade closest to the contact point with the

individual where the impact occurred. Figure 20 shows a simple static load test applied to the

blade guard of the Phantom 2 to determine how much force is required to deflect the blade guard

into the blades. This static test showed that the blade guards require a contact the blades with 2.2

lbs of upward force to deflect the blade guards into the blades. This is a low value that is likely

to be exceeded during any impact.

Figure 19 - Force Components on Blade Guard at 55 deg Impact Angle

38

Figure 20 - Static Load Testing Showing Blade Guard Contact with the Blade Under 1kg Loading (contact is show in red oval)

3. Proposed Standards

The proposed standards are included as Appendix C and Appendix D - Proposed Standard with

Evaluation of Potential Injury Severity. These two methods provide separate options for

evaluating ground collision severity with people. The proposed standard in Appendix C relies

purely on ballistic characterization and estimated ground impact KE correlated to RCC

thresholds for injury in its analysis of potential injury severity and the following operational risk

assessment. The proposed standard in Appendix D - Proposed Standard with Evaluation of

Potential Injury Severity extends the assessment of potential injuries and their severity to

estimated resultant impact loads for assessment of injury potential using Yoganandan’s

established thresholds for skull fracture and FMVSS 208 standards for neck injury against a 30%

chance of AIS3 or greater injury. Both methods can be applied using test techniques and

analysis readily available to the applicant or through use of an aerospace contractor without need

for a specialized testing facility. Test procedures and methods are addressed specifically in the

respective appendix for each one of the methods.

39

4. Conclusion and Recommendations

The research led to successful submission of a Part 107 waiver for flight over people that

provided substantiation data to meet the Category 4 Performance Standards defined by the

Micro-ARC Final Report1. The waiver and this final report include new methodologies for

determining safety thresholds other than those established by the RCC standards. The 98%

confidence level resultant load standard in Appendix D is based upon drop tests data, skull

fracture testing and many other references used to establish collision metrics. The Phantom 3

Standard and Advanced with modified blade guards and other multi-rotors in this class of

vehicles provide different collision dynamics and different collision geometries than the small

mass, large fragment, metal debris that were used to develop the PoF charts included in the RCC

standards and applied to range safety for hypervelocity projectiles and missiles. Flexible, plastic

vehicle structures and frangible payloads do not transfer energy during collisions in the same

manner as the smaller metal debris. The Phantom 3 and other sUAS platforms remain in one

piece with significant elastic response during collision with humans. The structure, landing gear

and blade guards serve as flexible, compliant barriers that minimize the energy absorbed by the

body, reduce the possibility of collision with the center of mass of the vehicle and minimize

collision impacts with smaller areas of the body such as the thorax. The focus of the analysis

addresses skull fractures and injuries to the neck area since these are the most vulnerable areas

when operating over dense populations of people, especially under the operating conditions

required to meet the Category 4 Performance Standards. The consideration of impact energy

standards other than the RCC PoF standards for impact KE is a new approach and provides better

insight into the injury mechanisms associated with sUAS ground collisions with humans. Safe

operation can be conducted when operating these sUAS platforms over people and the

application of the KE standards in this report extends the capabilities of safety mechanisms such

as parachutes for larger platforms up to 25.4 lbs for flight over people under Category 4

Performance Standards once parachute qualification standards for this class of vehicle are better

understood in terms of deceleration and vehicle dynamics required for safe deployment.

Many of these approaches are new, but the methods proposed in this research provide a solid

foundation from which to continue future research for safe operation of sUAS for flight over

people and provides an initial framework for clear standards for evaluating commercial platforms

for future waivers required for flight over people as outlined in Appendix C and D. Laceration

injuries due to blades and penetration injuries must always be addressed by the applicant, and an

operational risk assessment must be completed to evaluate all the hazards and impacts that may

impact safe operations when flying over people. The waiver request submitted in Appendix A

provides a framework for such an assessment for flight over people. The future research areas

are direct extensions of the work conducted under Task A11 and should be considered by the

FAA for future funding to continue to expand safe commercial operations within the NAS.

40

5. Future Research Proposed to Address Research Gaps

During discussions with the FAA, it is clear that there are a number of research areas that require

additional testing or require additional fundamental research to extend this effort for use in

establishing regulatory standards. The following are identified by the team following the A11

research.

5.1. Dynamic Modeling of UAS for a Wider Variety of Failure Modes.

Dynamic modeling of small UAS to account for vehicle dynamics associated with a wider

variety of failure modes beyond loss of power to all four motors is critical to defining a more

complete safety case for flight over people. Dynamic modeling of failure modes such as loss of

one or more rotors, software failures, etc. is required to determine impact angles, orientation and

KE values to properly define collision impact conditions and to properly validate mitigations and

vehicle characteristics as they relate to injury metrics. This work has been proposed to the FAA

in 2016 in W64 – ASSURE White Paper - Falling Multi-Rotor Dynamics Study.

5.2. Blade Guard Development and Standards

Blade guards and mitigations associated with laceration injuries require additional research to

develop standards for determining how these modifications best address the elimination or

substantial mitigation of laceration injuries during flight over people.

5.3. Parachute Standards to Reduce Impact KEs

While parachutes can substantially reduce the impact KE during loss of control events, the

development of certification standards is required to properly evaluate parachute dynamics to

determine deployment, inflation and deceleration times required to mitigate impact collisions.

Furthermore, this research must assess the deployment of parachutes under dynamic failure

conditions when software is used to deploy the parachute and shutdown rotors as a safety

mitigation. Automatic, software-driven parachute deployment is an important feature for Visual

Line of Sight operations and an absolutely essential feature for Beyond Visual Line of Sight

operations. The establishment of these standards could substantially open the commercial UAS

in the NAS system involved in flight over people for both multi-rotor vehicles and fixed wing

platforms. This work has been proposed to the FAA in 2016 in W69 – ASSURE White Paper -

Standards Development for sUAS Parachute Recovery Systems.

41

5.4. Probability of Ground Collision with People

The analysis conducted in Task A4 and Task A11 has solely focused on the collision severity

portion of the safety assessment, and little information and modeling has been conducted to

determine the probability of collision with individuals on the ground when using various

densities of people and a wider variety of dynamic failures that can occur with UAS under

credible scenarios. The modeling will inform probability of actually hitting a person as well as

determine which portions of the body are contacted such that the type and extent of injuries can

be addressed analytically rather than by inference from RCC data on debris. This analysis can

provide the basis for additional collision testing to refine the work conducted by task A4 and

A11. This work has been proposed to the FAA in 2016 in W65 – ASSURE White Paper -

Probability of UAS Ground Strike to People and Objects.

5.5. Additional sUAS Collision Tests and Development of an FMVSS 208 Like Analytical

Standard

The work conducted under A11 requires additional collision data to refine the analytical

techniques that can be applied to a more robust range of sUAS platforms without the

requirements for extensive collision testing of sUAS platforms. The refinement of analytical

methods associated with collision dynamics provides a method for applicants to analyze their

vehicles against a standard using engineering methods and creating vehicles that have safe crash

dynamics as a function of design.

A-1

Appendix A – UAH Part 107 Waiver Submission for Flight Over People

Waiver document provided in subsequent pages of Appendix A as submitted on 25 Aug 2016.

Submission Date 25 August 2016 Submitter and Addressee Information University of Alabama in Huntsville Rotorcraft Systems Engineering and Simulation Center 301 Sparkman Drive Huntsville, AL 35899

1. Which rule are we seeking exemption from? a. The University of Alabama in Huntsville (UAH) is seeking a waiver to § 107.39 Operation

over human beings b. Basis within Part 107 for requesting a waiver

i. § 107.205 List of regulations subject to waiver provides the basis for requesting a waiver to § 107.39 Operation over human beings.

ii. Implementation of operational practices and restrictions to reduce risk in the absence of an airworthiness certification of the Phantom 3 Standard and/or Phantom 3 Advanced.

2. Synopsis of mission types under this waiver request a. Mission types requested under this waiver are listed in Appendix A CONOPS. b. The description of the obstacles, buildings, vehicles and congestion of people proposed

by this waiver is listed in Appendix A CONOPS. c. The proposed operation falls within the proposed Category 4 operations proposed by

the Micro-ARC Report. Traceability to the Category operational requirements are covered in Appendix C.

3. Mandatory Operating Limits and Conditions to Ensure Safety a. Day, VFR, VLOS, Class G Operations Only. b. Height-Velocity Limitations in accordance with Figure C - 15 and Figure C - 16 for the

Phantom 3 Standard and the Phantom 3 Advanced, respectively. c. Modified Blade Guard Installation to minimize laceration injuries resulting in injuries

greater than Abbreviated Injury Scale (AIS)1 Level 3. d. Coordination with event organizers for on and off-campus events as described in

Appendix A and B. e. Flight controller limits on radial distance and altitude distance limits relative to GCS in

accordance with DJI Operators Manuals.2,3 f. NOTAM on file no later than 72 hours prior to events

1 Association for the Advancement of Automotive Medicine Website, http://www.aaam.org/about-ais.html 2 Phantom 3 Standard User’s Manual v1.4 12 Jan 2016. https://dl.djicdn.com/downloads/phantom_3_standard/en/Phantom_3_Standard_User_Manual_v1.4_en_0112.pdf 3 Phantom 3 Advanced User’s Manual v1.8, 19 July 2016. https://dl.djicdn.com/downloads/phantom_3/en/Phantom_3_Advanced_User_Manual_en_v1.8_160719.pdf

g. Qualified Pilot in Command (PIC), Visual Observer (VO), and Pilot (PI), per Appendix A h. Pre-event obstacle surveys to support mission planning, per Appendix A and B. i. Limit operations to Optimized Stabilization and Point of Interest and other Stabilized

Manual flight modes only j. All events will provide public notice of sUAS photography operations k. Standoff from high-traffic roads

4. Synopsis of Technical Basis for Request a. Height-Velocity Limits

i. The Height- Velocity limits for the Phantom 3 Standard and the Phantom 3 Advanced are shown in Figure C - 15 and Figure C - 16, respectively. The height velocity limits describe the initial conditions for flight operations that will not result in a 30% or lower chance of causing an AIS1 Level 3 injury or greater upon impact with a person in accordance with the Category 4 Performance Standards as published in the Micro Unmanned Aircraft Systems Aviation Rulemaking Committee (Micro-ARC) ARC Recommendations Final Report.4

ii. Modeling methods. The height-velocity limits were developed using ballistic modeling of UAS ballistic trajectories following UAS engine failure commensurate with loss of battery power. The impact Kinetic Energy (KE) from various altitudes and forward flight speeds were examined to determine lines of constant impact KE. The impact KEs developed were used to develop a flight test matrix and a drop test matrix for further validation of the ballistic model and to determine corresponding injury metrics associated with the specific impact KE values and the impact angles specific to the test.

iii. Assumptions. 1. Development of a height-velocity diagram for initial conditions of

altitude and airspeed that resulted in injuries no greater than a 30% chance of a AIS1 Level 3 or Greater injury based upon impact KEs for a 50th percentile man were acceptable for demonstrating compliance with the Category 4 Performance Standards.

2. Height-Velocity limits only account for vehicle ballistic characteristics and do not rely on assumed energy absorption by the airframe or offset collisions.

iv. Validation. Validation of the drag coefficients and ballistic modeling was conducted from flight test with a Phantom 3 Standard with Blade Guards and shown in Appendix C. Drop tests were conducted by Wichita State University’s National Institute for Aviation Research (NIAR) (WSU). NIAR conducted drop tests to determine the injury potential for specific impact KEs and impact angles as outlined in Appendix C. These injury metrics were established by using the automotive crash standards for the 50th percentile man ATD Hybrid III Crash

4 Micro Unmanned Aircraft Systems Aviation Rulemaking Committee (Micro-ARC) ARC Recommendations Final Report, 1 April 2016. http://www.faa.gov/uas/resources/uas_regulations_policy/media/Micro-UAS-ARC-FINAL-Report.pdf

Test Dummy using injury metrics established by the National Highway Traffic Safety Administration, National Transportation Biomechanics Research Center (NTBRC) in November 1999.5 The NHTSA study was conducted to upgrade the Federal Motor Vehicle Safety Standard (FMVSS) No. 208 frontal crash protection safety standard. Injury metrics and their formulation are outlined in Appendix C. None of the impact KEs established as corner points of the height-velocity limits for the Phantom 3 Standard or the Phantom 3 Advanced exceed the 30% chance of causing an AIS1 Level 3 injury or greater upon impact with a person in accordance with the Category 4 Performance Standards defined in the Micro-ARC Final Report4.

b. Laceration/Penetration Mitigations i. Laceration Mitigations. UAH has installed the stock blade guards on the

Phantom 3 aircraft and replaced the string linkage between the guards with RC aircraft control rods comprised of steel clevises and carbon fiber tubes (Figure C - 17) The guard link prevents limbs or other objects from getting between the propellers. Testing was conducted at speeds up to 15 kts to determine the viability of the blade guards from mitigating severe lacerations caused by unprotected blades operating at high speeds or deep lacerations that occur when an appendage gets in-between the blade guards of the stock Phantom 3 Blade Guards because the string is not installed or the string has become loose. The test results indicate that the link and guards can effectively mitigate significant blade tip laceration injuries during low speed impacts with people. The most credible scenario for impact with non-participants is the loss of battery power or inadvertent descent into non-participants at partial power. Flight tests were conducted showing the Phantom 3 platform without motor power falls in a flat attitude as discussed in the UAS Characteristics White Paper.16 As shown in Figure C - 19 and Figure C - 20, the descent angles are greater than 55 deg for all initial altitudes and velocities within the flight envelope. Collisions with non-participants will occur at these impact angles. While the horizontal speed during these collisions may exceed the maximum blade guard horizontal impact speed of 10 kts, the impact load on the blade guards will be at an angle equivalent to the impact angle causing the blade guards to be pushed up into the propellers resulting in motor stoppage (Figure C - 21). The blade guards will likely be damaged during these impacts; however, the laceration potential is dramatically reduced by the impact of the blade guards prior to blade contact with the non-participant. They cannot completely prevent laceration and do not withstand multiple impacts. It is also important to note that the guards are open on bottom and will not stop a cutting injury to a finger if a person reaches up through the guards. That can only be mitigated by maintaining a safe operating altitude above people during normal

5 Eppinger, R., Sun, E., Bandak, F., Haffner, M., Khaewpong, N., Maltese, M., Kuppa, S., Nguyen, T., Takhounts, E., Tannous, R., Zhang, A., Saul, R., Development of Improved Injury Criteria for the Assessment of Advanced Automotive Restraint Systems – II, November 1999.

operations. The blade guards do prevent deep and dangerous cuts associated with significant blood loss and AIS1 Level 3 or higher injuries.

ii. Penetration Mitigations. No penetration mitigations were included in the vehicle. The blade guards prevent significant contact with the ends of the arms in horizontal flight and have increased flexibility to reduce penetration injuries. The drop tests also showed that the vehicles landing gear are significantly elastic during impacts and appear that they will readily yield and not penetrate skin. During a fall from 50 feet above people, the vehicle achieves up to 94.2 ft-lb (127.72 J) of KE prior to impact and a perfect strike with the head between the landing gear has the potential to cause a penetration injury when the camera strikes the skull. The likelihood of the fracture is low because the payload mount collapses and the aircraft deforms during a prolonged impact which reduces the impulse loading on the head. During payload mount collapse and breaking of the camera gimbal attachment, impact energy is dissipated and not transferred to the person. While the potential for penetration injury does exist, the probability of such a perfect impact is low and as such does not require additional mitigation.

Appendix A - CONOPS6,7,8 for University of Alabama in Huntsville’s Rotorcraft Systems Engineering and Simulation Center’s Proposed Flight Operations for Aerial Photography of University and Community

Events Involving Flight Over People

1. Situation

Higher Organization and Flight Crew

UAH performs research and development, funded by contracts and grants, in support of government, private, and academic customers. Small UAS (sUAS) operations support many research areas and administrative functions of the university. The university administrative functions supported by sUAS include development of marketing materials and documentation of university events, which forms the basis of this CONOPS and its accompanying Part 107 waiver request for operations over people. sUAS platforms are utilized to support research efforts which include payload design, testing, and modeling, earth system science research, flight management software design, aerodynamic model development and validation, and model-based systems engineering. Flight operations at UAH are centrally managed through the Office of the Vice President for Research who is responsible for obtaining COAs and documentation of training and maintenance. The Rotorcraft Systems Engineering and Simulation Center (RSESC) is the responsible agency at UAH to conduct operations over people as described by this CONOPS. While UAH is a state institution and public aircraft operator, per Part 107, UAH will voluntarily operate sUAS as civil aircraft in compliance with Part 107 for operations over people.9

For operations flying directly over people, the principle flight crew members are the PIC and a PI who will serve as the vehicle operator. Depending on the layout and density of obstacles within the operating area, a VO will be added to the crew to reduce PI workload and observe the aircraft during hover and pre-planned flight routes when the operator is focused on payload operation.9

The PIC will have passed an initial aeronautical knowledge test at an FAA-approved knowledge testing center or hold a part 61 pilot certificate other than student pilot with a complete flight review within the previous 24 months. The remote pilot in command will also and complete an online FAA sUAS training course. The remote pilot in command will have been vetted by the Transportation Security Administration. All crew members will be 16 years of age or older.9 Lastly, the PIC will demonstrate airframe proficiency in mission maneuvers, emergencies, evasive procedures, and maintaining appropriate distances from structures and non-participants.

The VO will maintain position within a specific observation point to provide operator with information on UAS flight path and hazards. The VO will have instantaneous verbal communication with the PIC.

6 UAS General Product Specifications & Concept of Operation (CONOP) Evaluation Worksheet “SMEAC Sheet” DRAFT Rev. 2016-03-08 by Karl E. Garman 7 Draft ASTM Standard, “Standard Practice/Guide for Operational Risk Assessment of Small Unmanned Aircraft Systems (sUAS), March 25, 2016 8 ASTM F39.01 Committee, “WK52089 Standard Specification for Small Unmanned Aircraft Systems (sUAS) Operations Over People (DRAFT),”, received from FAA on 07/22/17 9Federal Aviation Administration, “Operation and Certification of Small Unmanned Aircraft Systems”, downloaded on 07/22/16

A PI will fly the aircraft under the supervision of an appropriate PIC. The PI must demonstrate airframe proficiency in mission maneuvers, emergencies, evasive procedures, and maintaining appropriate distances from structures and non-participants.

Terrain

Operations requiring flight over people will be conducted on the UAH campus and at offsite locations in Northern Alabama in support of research activities and collecting photographic data for events conducted by University students, faculty and staff. Any single operation will be limited to areas within, approximately, visual line of sight (VLOS) of the Phantom 310 pilot and pilot in command, with occasional transit over university, county, and state roads. The aircraft will not transition over interstate roads. The PIC, pilot and controller will be located within or directly adjacent to the area of interest for image capture. Most operations will be on public land, e.g. the UAH campus and local schools, unless agreements have been made with private individuals or organizations or other event hosts where UAH students are involved. All operations will be in Class G airspace; however, in situations where operations are conducted adjacent to Class C, D, or E airspace, the PIC will monitor VHF communications with adjacent controlled airspace or CTAF at adjacent uncontrolled airports. UAH and North Alabama has rolling terrain and tall trees. Obstructions include above ground power lines and light posts. The UAH campus predominantly has buildings that are no higher than three stories tall with the exception of one large building used for astronomy work and the Center for Applied Optics that is six stories tall. The Campus has a variety of sport fields with fences including two lighted baseball fields. A large portion of the campus lies under the Redstone Army Airfield Class D Airspace and this CONOPS only applies to that portion of the campus outside of the Class D airspace and at events conducted off-campus in Class G airspace within the Huntsville area exclusive of the downtown Huntsville area and Redstone Arsenal.

Operating Conditions

All operations will be conducted during the daytime (greater than 30 minutes before sunset or after sunrise), under visual meteorological conditions (VMC), and conducted within VLOS of the UAS operator. The launch and recovery location for sUAS flights will be at least 100 feet downwind of non-participants.11 Flights will only launch and remain aloft if winds are 20 knots or less, there is no precipitation, and temperatures are between 35°-104° F, which precludes flight in known icing.12 Flights with standoff from people may be conducted up to 400 feet AGL; however, flights over people will be restricted to no less than 20 feet above people.

10 The term Phantom 3, in this CONOPS, refers to both Phantom 3 Standard and Advanced Models 11 Academy of Model Aeronautics National Model Aircraft Safety Code, January 1, 2014 12 http://www.dji.com/product/phantom-3-pro/info#downloads, accessed on 07/22/17

Vehicle Technical Data

RSESC will be using a DJI Phantom 3 during flight operations over people. This is a commercially available quadcopter with an integrated camera payload (Figure A - 1). The Phantom 3 Standard is a 2.82 lbs (1280 gram) aircraft with a diagonal rotor tip to rotor tip length of 23.2 inches.13 The Phantom 3 Advanced is a 2.93 lbs aircraft, because it has additional internal components that don’t affect the outer shape. The Phantom 3 aircraft has a plastic monocoque shell that houses the battery, GPS, flight and payload controllers. It comes with standard 10-inch diameter injection molded plastic rotors. This aircraft has plastic u-shaped landing gear with a relatively large bottom contact area. The integrated camera has elevation control, but remains fixed forward and pointed between the landing gear. The hand-held portable controller has flight and camera controls along with a return to home function. The controller also has mount and USB connection for a smart phone or tablet that allows the user to run the DJI Pilot App for advanced control of aerial photography, and flight routing, along with displaying vehicle/battery status, telemetry, and advisory information. The Phantom 3 is powered by a 4480 mAh, 15.2V lithium polymer intelligent battery with integration protection and monitoring circuitry. The battery design incorporates power monitoring, auto-discharge, cell damage monitoring, temperature monitoring, overcharge, overcurrent, and over discharge protection along with communication with the flight controller that updates available flight time based on battery power and distance from home point. The Phantom 3 also incorporates a battery return to home function that automatically initiates vehicle return to home based on low battery status.2,3

The Phantom 3 is able to operate at altitudes up to 6,000 feet MSL, with a limit of 120m above the takeoff point. This aircraft can fly at airspeeds up to 52.5 ft/s in reduced automation modes and has maximum ascent and descent rates of 16.5 ft/s and 13 ft/s, respectively.13 The Phantom 3 model also has a flight data recorder, which is in line with draft ASTM recommendations on system requirements for operations over people.8 The Phantom 3 has altitude and position hold features, return to home function that can be manually activated or automatically activates under low battery power or lost link

13 http://store.dji.com/product/phantom-3-adv?from=menu_products#/spec, accessed on 08/01/16

Figure A - 1 DJI Phantom 3 with controller and tablet installed

conditions, and battery monitoring.2,3 For operations over people, this aircraft will be flown with blade guards which significantly reduce the risk of laceration.

The Phantom 3 uses GPS for primary navigation and has a Vision Positioning System (VPS) to ensure precise hover positioning (vertical and lateral) even without GPS signal. The GPS and VPS both support automatic takeoff and landing functions. The remote control and HD video downlinks are both on 2.4 GHz spread spectrum frequency which mitigates signal interference. This aircraft uses a FCC compliant remote controller that is linked with the aircraft at the factory.2,3 For precise control and safety, operators will perform a compass calibration before every flight and when there is a compass calibration error warning displayed. Flight operations will be suspended when a calibration error is displayed and will not be resumed until the error is eliminated. The DJI Pilot app provides the operator with MSL and AGL altitudes, vertical and horizontal speeds, and a moving map. This app also allows the operator to set flight ceiling and altitude limits as safety precautions and features airspace warnings.Error! Bookmark not

defined. The primary flight mode used for operations over people will be the P-Modes with GPS and Vision Position Systems enabled for aircraft stabilization, altitude and position hold. Alternately, the aircraft may be operated in the F-Mode (Intelligent Orientation Control) mode known as Point of Interest (POI) Mode, which enables the aircraft to circle around a POI and maintain payload/nose orientation on the POI.2,3 Pre-mission site surveys will be used to develop flight plans that avoid sensitive sites or airspace for operations conducted in Point of Interest Mode. The aircraft will not be flown over people in A-mode, which only uses the barometer for altitude control and does not use GPS or VPS for stabilization.

The Phantom 3 will be flown in accordance with the DJI operator’s manuals and will be flown with the latest version of firmware made available by DJI for both the aircraft and controller.

The aircraft and controller interface have the following status indicators to assist in operator situational awareness and mitigate the risk of system failure2,3:

- Aircraft lighting: o Position lighting to show aircraft orientation o Aircraft status light (red/yellow/green light) to indicate if aircraft is safe to fly, navigation

mode, navigation system errors, compass calibration error, lost link with controller, or other system errors

- Battery LEDs: o Battery status lights to show battery power level and remaining battery life

- Controller status lights: o Return-to-Home (RTH) status light indicating if aircraft is in RTH mode o Remote controller battery status o Remote controller system status

- DJI Pilot App Information: o Vision Position System Status o Data link status o Vehicle speeds and altitudes (MSL and AGL) o GPS home point o GPS signal strength o Controller data link strength

o Low or critical battery level indicator o Estimated flight time based on remaining battery and distance from home point o Programmed altitudes for RTH function – aircraft will climb to a safe altitude prior to

transitioning to the home point o Battery damage indicator o Battery error history o Battery current, voltage, and capacity o Battery low temperature warning o Moving map display o Auto takeoff and landing system control o Warning for reaching maximum radial distance from controller o No fly, Restricted, and Warning Zone indicators linked to assist prevention of airspace

incursion

Operating Area Information

The planned operations, under this CONOP, include flight directly over people.4 Operations other than those involving flight over people will be conducted under the requirements of Part 107. For operations under this waiver, RSESC flight crews will fly over dense hyper-local populations of people, e.g. a graduation ceremony in which people are standing or seated closely. People in these scenarios are not expected to be sheltered or wearing any protective equipment, but people are expected to be wearing clothing commensurate with the climactic conditions. The UAH campus and off site areas are moderately built up with structures that are, generally, 4 stories in height or less. Flights will, typically, be conducted over open areas and maintain adequate standoff from obstacles to avoid creating an undue hazard to property in the event of loss of control of the aircraft.14 Flights may transition over roads. During mission planning, all operating areas will be checked on the B4UFLY app15 to verify airspace and restrictions.

2. Mission

RSESC sUAS flight crews will conduct the following flight operations over people in support of research, campus events and media outreach, and academic programs on and off the UAH campus:

• Aerial Photography • Aerial Videography

14 http://www.faa.gov/uas/media/RIN_2120-AJ60_Clean_Signed.pdf, accessed 07/22/16 15 http://www.faa.gov/uas/where_to_fly/b4ufly/

3. Execution

Concept of the Operation

RSESC will be conducting aerial photography and videography of campus events (graduation, outdoor ceremonies, outdoor sporting events, and organizational events) and off-campus outreach events throughout Huntsville and northern Alabama using the DJI Phantom 3 sUAS. These operations will include flight over people, which requires a waiver to the flight restrictions stated in Part 107. RSESC will leverage operating limits (altitude and airspeed), mission planning, system safety features, and crew training to reduce risk of blunt, laceration, and penetrating wound injury to acceptable levels during operation of the Phantom 3.

Flight Operations Description

Based on mitigation of impact KE levels and payload capabilities, the Phantom 3 will be flown within the limits shown in Figure C - 15 and Figure C - 16. Minimum altitudes and maximum airspeeds will be determined by the crew based upon the respective operation and the hazards associated with operating at altitudes down to 5 feet over people. Airspeeds will be commensurate with the altitude and potential hazards within the operating limits defined by Figure C - 15 and Figure C - 16. At no time will the altitude or airspeed of operation result in a hazard to non-participants. Takeoff and landing will take place in marked/blocked off areas of no less than 30 ft x 30 ft area, based on the estimated falling footprint of this aircraft at a 30-foot hover.16 For the safety of the flight crew and non-participants, all people will be cleared out of the takeoff area prior to arming the aircraft throttles. All departures will begin with a vertical climb to a minimum of 5-30 feet prior to any directional flight. All approaches will be conducting as a vertical descent into the landing area from the transition flight level of no less than 5-30 feet. Operations on campus will be conducted outside of the Redstone Army Airfield Class D airspace and below 400 ft AGL which is well below the altitude of any approach and departure routes. All operations will be conducted when weather is greater than a 1000 ft ceiling and 3 statute mile visibility. The pre-mission survey will identify manmade and natural obstacles in the operational area and identify methods and routing to avoid them. The primary flight modes to be used during operations over people are the P-Mode with maximum stabilization and Point of Interest mode, which is allows the vehicle to fly a pre-planned routing in a stabilized manual mode. All launch and recoveries will be conducted in the fully-stabilized Opti-mode. The PIC will monitor the B4UFLY app during operations for increased situational awareness.

Tasks to Crew Members, Resource Management, Coordination, and Crew Considerations

For any flight operation over people, the PIC is responsible for the overall safe conduct of the flight operation and will act as the ATC Liaison, lead planner, site coordinator, mission briefer. Given that this CONOPS is for uncontrolled airspace, the ATC liaison will be primarily responsible for NOTAMS submission and confirmation; however, the PIC will also monitor the nearest airfield’s tower frequency or Common Traffic Advisory Frequency (CTAF). The PIC will also be the lead for conducting coordination with the event organizer and any site owners/managers.

16 “White Paper on UAS Characteristics” FAA UAS Center of Excellence Task A4 UAS Ground Collision Severity Evaluation, 3 June 2016

During mission planning, the VO will assist the PIC in developing the plan for takeoff and landing sites along with placement of crewmembers to ensure visual coverage of the flight area and obstacle avoidance. During flight operations, the VO will be the lead for contacting first responders (EMS, police, or fire department) in the event of a flight-related mishap requiring emergency response when directed by the PIC.

The pilot will conduct maintenance checks on the aircraft, payload, batteries, and a logbook review during preparation for flights. The PI will also conduct the pre-flight inspection of the aircraft with the PIC. The PIC’s and PI’s primary function is safe operation of the vehicle with the pilot having secondary responsibility for taking photos and video during the operation.

The operator to vehicle ratio during all operations near or over people will be 1:1. During flight operations, the controller will not be handed off between operators. Crew members will not approach the vehicle unless the throttle hold function is engaged. Crew members will perform their duties from isolated or elevated positions in order to prevent non-participants from interfering with flight operations. If non-participants are interfering the operating pilot’s ability to perform as a crew member, he/she will engage return to home mode as soon as safely possible to bring the aircraft back to the launch area autonomously.

General Planning Timeline Events

The following events are standard items from the mission planning timeline:

a. NOTAM Submission and Verification no later than 72 hours prior to operation b. Logbook, battery, payload, controller, and vehicle inspection c. Crew currency verification from online flight management system d. Site surveys

a. Map survey b. Physical survey; to include radio range walkout, takeoff/landing area verification, PI, VO,

and PIC Locations, verification of airspace on the B4UFLY app, and obstacle height verification for flight route development and return to home (RTH) functions.

e. Mission brief/Risk Assessment within 24 hours of the flight by RSESC management f. Weather and NOTAM Check within one hour of takeoff g. Crew briefing prior to flight h. Go/No Decision prior to flight i. Verify all RTH altitudes, positions, and flight plans prior to engaging throttles j. Verify vehicle is in Opti-mode prior to engaging throttles k. Communications check with ATC, and within Crew prior to engaging throttles

The following events will lead to termination of operations before or during a flight: a. Electrical or Guidance, Navigation, and Control Malfunctions b. Non-participant interference with the flight crew c. Weather outside of acceptable limits (temperature, winds, precipitation) d. Crew duty day exceeding 12 hours e. Any aircraft behavior that is deemed as less than nominal at any time of the flight

4. Administrative and Logistics

Flight crews will use the cloud-based online flight management service Skyward IO for flight planning, authorization management, training/readiness tracking, maintenance tracking, and flight logging.17 This system will also be used to track vehicle flight time and maintenance status, battery maintenance status, and payload maintenance status. A hardcopy flight log book, containing required authorizations and vehicle maintenance logs, will be used to track vehicle maintenance actions and status.

The following safety equipment will be on-hand for all flight operations:

• Fire extinguisher (Capable of extinguishing Lithium Battery fires) • VHF Hand-held Radios • Cell phones with each crew member’s phone number list • Vehicle maintenance kit • LiPo Battery bags for failed battery containment • Additional cameras • Additional propellers • Copy of Pre-Accident Plan

Per Part 107 requirements, the PIC will report any accident that results in at least serious injury to any person or any loss of consciousness; or damage to any property, other than the small unmanned aircraft, for which the cost of repair (including materials and labor) exceeds $500; or the fair market value of the property exceeds $500 in the event of total loss.9

Any Phantom 3 that has undergone maintenance or alterations that affect the UAS operation or flight characteristics, e.g., replacement of a flight critical component, must undergo a functional test flight prior to conducting further operations under this CONOP.18 The PIC/pilot of the Phantom 3 is responsible for maintaining and inspecting the UAS to ensure that it is in a condition for safe operation. Prior to each flight, the PIC must conduct a pre-flight inspection and determine the Phantom 3 is in a condition for safe flight. The pre-flight inspection must account for all potential discrepancies, e.g., inoperable components, items, or equipment. If the inspection reveals a condition that affects the safe operation of the Phantom 3, the aircraft is prohibited from operating until the necessary maintenance has been performed and the Phantom 3 is found to be in a condition for safe flight. The PIC/pilot must follow the Phantom 3 manufacturer’s maintenance, overhaul, replacement, inspection, and life limit requirements for the aircraft and aircraft components. Each Phantom 3 operated under this CONOPS must comply with all manufacturer safety bulletins and have the latest version of firmware installed on the vehicle, controller and smart battery.2,3 Flight operations over people may not be performed or continued in the absence of GPS signal or with any degraded navigation function.

17 https://skyward.io/, accessed 05/25/16 18 Exemption No. 14118 Regulatory Docket No. FAA–2015–4596, accessed 08/04/16

Flight operations may be immediately continued after the following maintenance actions are performed:

• Replacement of the battery • Replacement of the payload • Recharging the aircraft controller or tablet attached to the controller

All other maintenance actions require a functional flight test at least 500 feet from all non-participants prior to resuming flight over people.

5. Command and Control

Communications Plan (Primary, Alternate, Contingency – PAC)

Table A - 1 Communications Plan

Primary Alternate Contingency PIC to ATC (ATC

Liaison) VHF Radio Cell Phone Email/Web

(NOTAM submission only)

Within Crew Voice Radio Cell phone VO to Emergency

Response Cell phone Cell Phone Cell Phone

Crew to Event/Property

Manager Voice Cell phone Email

The FCC compliant data link is a spread-spectrum 2.4 GHz link operating at less than 100mW. This not is a secure data link; however, the controller and vehicle are linked at the factory and the DJI Pilot app indicates if there are controller/aircraft linking malfunctions.

The PIC will communicate with ATC for NOTAM filing and confirmation, radio calls on CTAF to alert operators at adjacent uncontrolled airports, and radio calls to tower in the event of a UAS fly away. However, this CONOP is for operations in Class G airspace.

Table A - 2 shows flight crew and system responses to emergency conditions.

Table A - 2 Emergency Procedures

Condition Response Lost Link Vehicle initiates RTH function after link is lost for 3 seconds

Loss of Control Crew initiates RTH function via flight controller and alerts people within area of UAS operations

Erratic flight/ Uncommanded Response Land as soon as possible away from non-participants

Battery Malfunction (Battery fire on ground before/after flight)

Extinguish fire, place battery in battery bag. If airborne, land as soon as possible away from non-participants. If the battery becomes wet or exposed to moisture, follow emergency procedures in DJI manual and place in battery bag.

Loss of GCS Power Vehicle will initiate RTH function after lost link, GCS will be connected to charger

Low Vehicle Battery Power Vehicle will initiate RTH function

Manned Aircraft In Area Yield to aircraft as needed; however, this is unlikely based on planned operating altitude (less than 100 feet AGL in Class G airspace)

Unplanned UAS in Area Land as soon as practicable and avoid the other vehicle. Report the unauthorized vehicle to Campus Police and local event organizer.

Loss of GPS Signal Manually fly UAS to planned landing area Uncontrolled Descent or Collision with Non-Participant or Ground

Immediate engine shutdown command by the PI in the event of a collision with non-participants or the ground or uncontrolled descent to minimize laceration injuries.

Appendix B – Operational Risk Assessment (will use tables per ASTM draft document)

1. An operational risk assessment for the use of the Phantom 3 standard and advanced involving flight over people is provided

1. General. An operational risk assessment for flight over people is outlined below. The risk assessment utilizes Table A-1, Sample Severity and Likelihood Criteria and A-2, Safety Risk Matrix – Example from Appendix A, Risk Tools, AC 107-219. While Table A-1 and A-2 in AC 107-2 are sample/examples, these are used as a basis for developing the operational risk assessment for this waiver and shown in Table B - 1 and Table B - 2 below.

Table B - 1: Severity and Likelihood Criteria

19 Advisory Circular 107-2, Subject: Small Unmanned Aircraft Systems (sUAS), 21 June 2016.

Table B - 2: Safety Risk Matrix

2. Identification of Hazards.

a. Operational Hazards. The associated failure modes and likelihood of occurrence for the failure modes of the Phantom 3 Standard and Advanced are not known; however, the operational hazards that can result in loss of control of the vehicle, loss of situational awareness, or loss of attitude or position relative to obstacles, etc. are specifically addressed and mitigations are defined. The operational risks associated with the Phantom 3 Standard and Phantom 3 Advanced are included in here to establish Baseline Risk. Approval to conduct a specific operation with a specific crew and a specific operation is assessed to address mission risk and to identify the required briefings and approvals required to approve risk above the baseline risk. A pre-mission briefing is included to address mission risk over and above Baseline Risk. A crew briefing checklist is provided to further crew communications and resource management and to address any changes identified just prior to conduct of the flight. The crew briefing checklist is in addition to the DJI Operators Manual2,3 and Vehicle checklists provided by the OEM.

b. Collision Hazards. These hazards are related to the three types of collision injuries, Blunt Force Trauma, Penetrating Injury Risk and Laceration Risk. i. Blunt force trauma hazards are associated with the impact KE values that could result in

greater than a 30% chance of an AIS Level 3 injury or greater. ii. Penetrating injury hazards are those sharp edges that could result in a penetrating injury

when struck by the UAS. Specific hazard areas on the UAS are those associated with the camera, and the landing gear corners.

iii. Laceration hazards are this associated with the rotating blades of the UAS striking soft tissue such as skin. The Phantom 3 Standard and Advanced do not have automatic shut off in the event of collision or when a particular pitch or roll angle are exceeded. The configuration outlined for this waiver includes the use of standard blade guards installed on the aircraft, without the use of the string installation to join the blade guards. A modified linkage was installed between the blade guards to mitigate a person’s arm getting caught between the blade guards and being cut by the blades.

c. Table B - 3 below shows the hazards identified for the Phantom 3 Standard and Phantom 3

Advanced associated with the operations outlined in Appendix A.

Table B - 3: Operational Risk Assessment

Hazard Causes Unmitigated Risk Identify

Controls/Mitigations New Risk

Consequence Likelihood Risk Level Consequence Likelihood Risk

Level

Loss of Control In Hover in Opti-Mode

1. Operator does not calibrate compass prior to flight 2. Electromagnetic Interference with GPS or Magnetometer 3. Interference with GPS/magnetometer due to metal buildings 4. Operations in high or gusty winds

4 2 2B

1. Compass calibration included in preflight checklist as well as pilot monitoring of system status. 2. Terminate flight should erratic motion or yellow caution on GPS status is indicated 3. Pre-site inspection for metal buildings and sources of EMI such as power lines or transmitters. 4. Pre-site survey to establish emergency landing areas away from congested areas of non-participants. 5. Land as soon as possible away from non-participants. 6. Remain within operating envelope specified by waiver 7. Operate within wind limits set by the manufacturer. 8. Immediate engine shutdown command by the PI in the event of a collision with non-participants or the ground.

3 1 1C

Loss of Control in Forward Flight in Opti-

Mode

1. Operator does not calibrate compass prior to flight 2. Electromagnetic Interference with GPS or Magnetometer 3. Interference with GPS/magnetometer due to metal buildings 4. Operations in high or gusty winds

4 2 2B

1. Compass calibration included in preflight checklist as well as pilot monitoring of system status. 2. Terminate flight should erratic motion or yellow caution on GPS status is indicated 3. Pre-site inspection for metal buildings and sources of EMI such as power lines or transmitters. 4. Pre-site survey to establish emergency landing areas away from congested areas of non-participants. 5. Land as soon as possible away from non-participants 6. Remain within operating envelope specified by waiver 7. Operate within wind limits set by the manufacturer. 8. Immediate engine shutdown command by the PI in the event of a collision with non-participants or the ground.

3 1 1C

Hazard Causes

Unmitigated Risk Identify Controls/Mitigations

New Risk

Consequence Likelihood Risk

Level Consequence Likelihood Risk

Level

Loss of control of UAS in RPA Mode (Point of Interest or Waypoint

Modes)

1. Pilot disorientation in RPA Mode 2. Task saturation in RPA Mode 3. Pilot distractions in RPA Mode 4. Operating at too great of a standoff range in RPA mode without stabilizing functions on 5. Pilot unaware he has not transitioned out of RPA Mode to Opti-Mode 6. Operations in high or gusty winds

4 3 3B

1. Pilot proficiency evaluated in RPA Mode 2. Crew duties assigned and distributed amongst crew members and crew brief completed. Minimize pilot responsibilities when operating in RPA mode. 3. Reduce distractions to PIC and pilot operating sUAS. 4. Operate within 400 ft of pilot/operator at all times. 5. Pilot call out when transitioning between RPA and Opti-modes and crew member confirmation of call out. 6. Remain within operating envelope specified by waiver 7. Operate within wind limits set by the manufacturer. 8. Immediate engine shutdown command by the PI in the event of a collision with non-participants or the ground.

3 1 1C

Loss of Clearance between Non-Participants or

Obstacles in a Hover while in Opti-Mode

1. Slow drift downward due to errors in altitude hold functions not noticed by the pilot. 2. Pilot distractions while changing altitude 3. Operations in high or gusty winds

3 2 2C

1. Pilot and VO observe altitude and remain 20 ft above participants at all times. 2. Reduce distractions in and around pilot while maneuvering. 3. Remain within operating envelope specified by waiver 4. Operate within wind limits set by the manufacturer. 5. Immediate engine shutdown command by the PI in the event of a collision with non-participants or the ground.

3 1 1C

Hazard Causes

Unmitigated Risk Identify Controls/Mitigations

New Risk

Consequence Likelihood Risk

Level Consequence Likelihood Risk

Level

Loss of Link with UAS

1. Loss of battery power on controller. 2. EMI interference 3. Vehicle executes RTM function if link is lost for 3 seconds. 4. Improper obstacle clearance or path could cause loss of vehicle control 5. Loss of line of sight of the UAS 6. Antennas on controller not properly spread.

3 2 2C

1. Checklists include controller battery status checks and controller antenna spread prior to flight. 2. Monitoring of controller battery status during operations. Return to landing location away from non-participants if controller battery status reaches one bar or turns yellow on status page. 3. Verify obstruction clearances for all obstacles and locations in operating area as part of site inspection. Verify RTH mode altitudes and location as part of pre-takeoff procedures to avoid obstacles due to lost link recovery procedures. 4. Activate RTH mode if control of the vehicle becomes non-responsive. 5. Keep non-participants clear of landing and takeoff area throughout the operation for potential RTH requirements. 6. Maintain line-of-Sight with UAS at all times.

2 2 2D

Battery Fire on the Ground

1. Battery failure due to damage or failure.

3 3 3C

1. Maintain battery bags and fire extinguisher capable of extinguishing lithium-ion battery fires. 2. Inspect batteries as part of preflight check. 3. Maintain batteries in accordance with manufacturer’s procedures.

2 2 2D

Hazard Causes

Unmitigated Risk Identify Controls/Mitigations

New Risk

Consequence Likelihood Risk Level Consequence Likelihood

Risk Level

Battery Fire in Flight 1. Battery failure due to damage or failure.

3 3 3C

1. Maintain battery bags and fire extinguisher capable of extinguishing lithium-ion battery fires. 2. Inspect batteries as part of preflight check. 3. Maintain batteries in accordance with manufacturer’s procedures. 4. Monitor battery status on aircraft status page. Land as soon as possible if battery status changes to yellow or smoke is observed. 5. Pre-site survey to establish emergency landing areas away from congested areas of non-participants. 6. VOs maintain battery bags and aware of battery fire procedures.

2 2 2D

Loss of GPS Signal 1. Failure of internal GPS functions 2. EMI Interference 3. Loss of satellite coverage

3 2 2C

1. Pilot proficiency evaluated in RPA Mode 2. Manually fly UAS to home point and land. 3. If aircraft flies erratically, land as soon as possible away from non-participants. 4. Pre-site survey to establish emergency landing areas away from congested areas of non-participants.

2 2 2D

Takeoff and Landing Site Becomes

Congested

1. Crowds observe UAS operation and congregate around takeoff and landing site. 2. Crowds distract pilot from duties

3 3 3C

1. Coordinate with event sponsors to maintain takeoff and landing area clear of non-participants. 2. Coordinate proper separation of crews and takeoff and landing area with officials. 3. Mark takeoff and landing areas. 4. Crew where easily identifiable clothing that distinguishes flight crew from non-participants.

3 1 1C

Hazard Causes

Unmitigated Risk Identify Controls/Mitigations

New Risk

Consequence Likelihood Risk

Level Consequence Likelihood Risk

Level

Penetrating injuries following ground

collision

1. Legs and camera can cause penetrating injuries due to sharp edges during a collision.

3 2 2C

1. Preflight of frangible mounts on camera are intact and functional 2. Perfect collision between legs required to cause penetrating injury with camera. Offset of as little as three inches from a UAS center of mass and a head center of mass collision mitigates camera penetration risk

3 1 1C

Laceration Injuries following ground

collision

1. Blades contact soft tissue during collision with a person while the blades are at operating RPM

3 2 2C

1. Inspect modified blade guards for proper installation and integrity 2. Remain within operating envelope specified by waiver to insure blade guard integrity in the event of a collision 3. Immediate engine shutdown command by the PI in the event of a collision or uncontrolled descent occurs.

3 1 1C

3. Pre-Mission Site Survey and Mission Rehearsal. The team will conduct a pre-mission site survey of the mission area to document the following as time allows prior to the event. Following the initial site survey, a pre-mission rehearsal flight of the mission will be flown prior to flight over people to assess the conclusion from the pre-mission site survey. Failure to conduct the pre-mission rehearsal will restrict the team to evaluating the Operational Risk Assessment outlined in paragraph 2 of this appendix and limit the operation of the Phantom 3 to Opti-Mode operations with maximum stability.

a. Document the location of hazards and obstacles in the mission area. b. Identify locations of steel buildings, high power lines and other sources of EMI impacts on the

compass or GPS signals. c. Conduct radio range walkout with observers and verify communications will not interfere

with the event host communications planned for the event. d. Coordinate with local police and other first responders as appropriate for the event after

coordinating with the event host for security covering the event if that is different than the local or campus police.

e. Identify and coordinate with the event host the use of a landing and takeoff area that is isolated from non-participants and results in minimum distractions to the PIC and PI. Verify that the RTH direction and altitude to the takeoff and landing location is free of obstacles and hazards for all locations planned to be flown during the mission.

f. Identify emergency landing areas in the event of erratic behavior of the UAS around the mission area that minimizes overflight of congested areas of non-participants and allows for safe landing.

g. Identify number and locations of VOs based upon hazards, obstacles and location of emergency landing areas.

h. If time permits, determine waypoints and point of interest functions that might be useful and practice these maneuvers during the pre-mission rehearsal.

i. Measure the altitude of all obstacles and hazards with the UAS to insure altitude selected for the RTH is sufficient and has at least 20 ft clearance above the highest obstacle should RTH be required.

j. Develop emergency response phone roster for the location to be flown and coordinate the pre-accident plan with the host sponsor.

4. Pre-mission Brief/Risk Assessment. Review the Operational Risk Assessment and determine if any mitigations cannot be satisfied or have changed based upon the pre-mission site survey and the pre-mission rehearsal. Conduct a permission briefing with the Director, RSESC or other authorized UAS Flight Over People Briefers approved by the Director, RSESC and cover the following topics.

a. Overview of the mission and the results of the pre-mission site survey and the conduct of the pre-mission rehearsal.

b. Crew assignments (PIC, PI and VOs) and training status of all crew members involved in the operation. Is there sufficient experience to conduct the mission safely?

c. Weather and wind limits for the operations. d. Review Operational Risk Limit and Mitigations and any Mitigations that cannot be met.

Review the unmitigated risk level.

e. Review of the aircraft status and any limitations in the mission configuration. Discuss abort

limits prior to launch and during the mission. f. Discuss coordination with the host and any limitations of the site that might impact risk. g. If during the conduct of the pre-mission brief, the risk assessment results in a yellow risk, the

Director, RSESC and the PIC shall review the risk with the Vice President for Research and Economic Development or his designated representative to obtain approval to fly the mission with yellow risks 2B, 2C, 3D, 4E or 5E as outlined in Table B-2. Any other yellow risks or red risks shown in Table B-2 are prohibited for flight over people missions as part of this waiver.

5. Crew Briefing a. Crew Introduction.

i. Personal and Professional Equipment. Do all crew members have all of the required equipment for the operation including communication equipment, checklists and emergency contact numbers

ii. Crew Physical and Mental Readiness. Utilize the IMSAFE Checklist. 1. Illness – Is anyone sick? 2. Medication – Is anyone taking medications that might impair their judgement? 3. Stress – Is anyone under psychological pressure from school or their job? 4. Alcohol – Has anyone been drinking in 8 hrs.? 24 hrs.? 5. Fatigue – is anyone tired and not adequately rested? 6. Emotion – Is anyone emotionally upset?

b. Mission. Provide a mission overview. c. Execution.

i. Routes and altitudes ii. Estimated time of the operation

iii. Review of the site and obstacles within the site iv. Battery limits and procedures for battery changes

d. Weather. Review weather brief and weather limitations e. NOTAMS and Local Operating Limitations. Review any applicable NOTAMS and Limitation

imposed by the host or event sponsor f. Aircraft. Discuss aircraft limitations, preflight issues or status anomalies. g. Emergency Procedures.

i. Lost Link Procedures ii. Lost Communications Procedures

iii. Landing areas in the event of battery fire, erratic vehicle behavior iv. Battery fire or damaged battery procedures v. Emergency response in the event of mishap

vi. Use of emergency equipment including fire extinguishers h. Flight Coordination and Communication Procedures especially for emergencies.

i. Communications with VOs ii. Communications with PIC and PI

iii. Discuss the pre-accident plan with the crew and review the emergency response phone roster.

iv. If you see something that looks unsafe then speak up!

i. Crew Duties. i. Pilot-in-Command (PIC)

1. Monitor overall operation 2. Monitor communications with VOs and PI 3. Ensure PI and VOs coordinate properly to maintain obstacle and clearance over

people 4. Monitor and communicate with ATC and event host, as required

ii. Pilot on control of the UAS (PI) 1. Fly the UAS and maintain obstacle clearance 2. Monitor vehicle status 3. Request assistance when needed from VOs

iii. Visual Observers 1. Monitor clearance of the vehicle from obstacles and non-participants 2. Assist the PI when requested 3. Identify safety concerns and notify the PI/PIC as soon as possible

iv. Camera Operator as appropriate 1. Operate the camera as required. 2. Monitor the vehicle status and notify the PI when vehicle status becomes degraded

Appendix C – Technical Basis for Waiver Request

This appendix is divided into three main sections. The first details the development of operating Height-Velocity limits for the Phantom 3 variants. These limits will mitigate the risk of blunt trauma injuries following an aircraft failure when operating over people. The second section provides an overview of the design modifications implemented to limit the risk of laceration injuries due to blade strike. The final section shows analysis of critical contact points and operating considerations associated with the risk of penetration injuries following vehicle failure when operating over people.

1. Height-Velocity Limits Overview

The primary means of limiting the risk of blunt impact injuries when operating over people in this CONOP (Appendix A) is through following Height-Velocity (H-V) limits to mitigate excessive ground impact KE. This section discusses the technical approach and rationale behind UAH’s recommended H-V limits. It is divided into two areas of vehicle characterization. The first area is the aerodynamic modeling and analysis of the vehicle which was done solely to determine impact KE levels based on failure flight condition and vehicle attributes. The ground impact KE level is determined by the vehicle mass, flat plate drag (vertical and lateral). The second area of vehicle analysis is the estimated energy transfer to an impacted person. The energy transfer level is determined by the impact orientation, vehicle construction, and vehicle materials. The energy transfer levels are estimated based on conservation of angular momentum analysis of the vehicle’s rebound trajectory and ATD Hybrid III dummy movement after impact.

Ballistic Characterization of the DJI Phantom 3 Standard and Advanced Models

The ballistic characterization of the two aircraft involved modeling and simulation experimental validation of the modeling results. Both the Phantom 3 Standard and the Phantom 3 Advanced with propeller guards were rendered in CAD software and these models were loaded into STAR-CCM+® computational fluid dynamics (CFD) software. The aircraft went through flow field simulation in STAR-CCM+® for horizontal flight and vertical falling conditions, referred to as 0° and 90°, respectively, at airspeeds of 2, 5, 10, 20, 40, and 50 m/s. The resulting drag coefficients, vehicle masses, and planform areas were used as inputs to a ballistic falling model to determine impact KE as a function of failure airspeed and altitude. These model outputs compared favorably with observed impact velocities from the NIAR drop tests and observed falling velocities during UAH flight tests.

UAH researchers downloaded the Phantom 3 CAD rendering from GrabCAD20 and compared the model dimensions with an actual Phantom 3 Standard and Advanced aircraft to validate model dimensions. The Phantom 3 propeller guards were modeled in CAD software by UAH. The CAD file models were scaled, cleaned, and wrapped in STAR-CCM+® to create surface geometries suitable for CFD analysis. The propellers were aligned with the arms in the STAR-CCM+® environment to create a worst-case minimum drag geometry in vertical fall. The Phantom 3 Standard aircraft was simulated in drop tests without propeller guards to match the aircraft configuration used in the NIAR drop tests. This provided 20 https://grabcad.com/, accessed 02/15/16 during FAA A4 Ground Collision Severity Assessment studies

a validation of the ballistic modeling for failure during stationary hover by comparing NIAR’s observed impact velocities with the ballistic model’s predicted impact velocities. The Phantom 3 Standard and Advanced aircraft were modeled with propeller guards for development of full impact KE plots based on failure altitude and airspeed to match the aircraft used in UAH flight tests (Figure C - 1).

In the CFD simulation, the aircraft encountered steady, incompressible, constant density, and constant laminar viscosity flow. Table C - 1 shows the CFD input values for the atmospheric conditions and the vehicle model planform areas based on propeller guard configuration. Turbulent flow, due to separation around the aircraft was modeled with a Turbulent Kinetic Energy (TKE) viscosity model. This model was chosen based on its accuracy predicting drag coefficients for the Phantom 2 during drop testing in the FAA A4 Ground Collision Severity Study.16

Table C - 1: Atmospheric Condition CFD Inputs and Phantom 3 Planform Areas

Density Viscosity Pressure Planform Areas w/o Guards

Planform Areas w/ Guards

0.073 lbm/ft3 0.283 lbf-s/ft2 14.69 lbf/in2 0° 0.262 ft2 0° 0.313 ft2

90° 0.459 ft2 90° 0.657 ft2

The CFD simulations reached converged solutions for all cases and yielded estimated drag coefficients for velocity sweeps in both orientations. The average coefficient of drag values for the Phantom 3 without guards are Cd,vert = 0.9313 and Cd,lat = 1.077. The average coefficient of drag values for the Phantom 3 with guards are Cd,vert = 1.124 and Cd,lat = 1.122. There is a 42% increase in the vertical flat plate drag area, and a 19.6% increase in the lateral flat plate drag area when the guards are added.

The physics-based ballistic model was used to determine impact KE based on failure altitude and airspeed. This model uses atmospheric conditions, aircraft failure airspeed and altitude, and the aircraft

Figure C - 1: Phantom 3 sUAS Surface Model in STAR-CCM+ (prior to rotating props parallel to arms)

mass and aerodynamic coefficients as inputs. The model uses a time stepping method to calculate net vehicle acceleration, velocity, and position at any time during a fall. The net acceleration is the difference between gravitational acceleration and deceleration due to drag. This model also uses a lookup function for drag coefficient, which varies based on vehicle velocity.

The NIAR drop tests provided an initial validation of the ballistic model and CFD-generated flat plate drag areas. The observed drop test impact velocities compare favorably with the predicted vehicle impact velocities from the ballistic model. The NIAR drop test vehicle was a 2.67 lbs Phantom 3 standard without prop guards. This vehicle was modeled in CFD and then run through a ballistic drop simulation from 20, 30, 40, and 50 feet (Figure C - 2). Average kinetic energies achieved in the vertical drop NIAR testing, which served as initial validation for the drag and ballistic models were 43.6, 63.3, 78.2, and 100.8 ft-lb (Figure C - 3). Differences between the observed and predicted velocities were generally less than 1%, with the 40-foot drop prediction exhibiting 2.28% error (Figure C - 4). It is important to note that these vehicles did not achieve terminal velocity in either the simulation or experimental drop tests, which is predicted to be approximately 56 ft/s for the Phantom 3 Standard and 58 ft/s for the Phantom 3 Advanced; both with guards installed. This is consistent with the predicted and observed Phantom 2 (without guards) 60-64 ft/s terminal velocities from simulation and testing during the A4 Project.16

Figure C - 2: Comparison of NIAR Observed Impact Velocities and UAH Predicted Impact Velocities

The ballistic characterization of the Phantom 3 Standard and Phantom 3 Advanced models is accomplished by calculating impact KE based on combinations of failure altitude and airspeed combinations. During a single iteration of these calculations, an aircraft initial state is set and the algorithm determines the time of fall and the vertical and horizontal components of velocity. The total impact velocity is calculated from the components and then impact KE is evaluated based on the total impact velocity. Figure C - 5 shows results of simulating a Phantom 3 Standard failure at combinations of altitude from 0-70 ft and airspeeds of 0-50 ft/s. This plot shows line of constant impact KE that are achieved for varying failure flight conditions. From a hovering failure (Vx0 = 0 ft/s), the aircraft achieves

43.6

63.3

78.2

100.8

44.3

64.1

81.7 99.4

40.0

50.0

60.0

70.0

80.0

90.0

100.0

15 20 25 30 35 40 45 50 55

Predicted and Achieved Impact KE

NIAR Achieved KE (ft-lb) UAH Predicted KE (ft-lb)

Impa

ct K

E (f

t-lb

)

Drop height (ft)

Figure C - 4: Comparison of NIAR Achieved Impact KE and UAH Predicted Impact KE

Figure C - 3: Average % Error in Predicted Velocity and KE for Phantom 3 Standard without Propeller Guards

20, 40, 60, 80, and 100 ft-lb of impact KE when falling from approximately 9, 18, 29.5, 43, and 64 feet of altitude, respectively. In light of Micro-ARC Final Report4 recommendations to maintain an altitude of 20 feet above people, it can be assumed the aircraft will always achieve at least 40 ft-lb of impact KE by the time it reaches head level. This head-level impact KE was also the basis for the NIAR drop testing, which limited all aircraft impacts to the dummy’s head. Figure C - 6 shows the results of the Phantom 3 Advanced ballistic characterization and impact KE levels based on failure altitude and velocity. This aircraft has the same outer geometry as the Phantom 3 Standard, but it weighs 0.14 pounds more based on different internal components. Based on this weight difference, it achieves the same impact KE levels at the Phantom 3 Standard at marginally lower altitudes and airspeeds, but all trends in the lines of constant impact KE remain the same. NIAR drop test points, correlated to the in-flight failure conditions that they represent on the plot, are overlaid on the to provide reference for model validation efforts and generation on impact KE. Trajectory analysis of ballistic simulations shows that impact angles are within 30°-35° degrees of vertical for failure airspeeds out through 35 ft/sec and failure altitudes of 20 ft and above (Figure C - 7). The NIAR angled impact drop tests were completed with 62° and 58° impact angles, measured from horizontal, and are representative of impacts following failure at low altitude and low airspeed.

Figure C - 5: Phantom 3 Standard Impact KE

Figure C - 6: Phantom 3 Advanced Impact KE

Figure C - 7: Impact Trajectory Fan based on Ballistic Simulations

70°

The ballistic model was further validated by way of flight test. UAH modified a Phantom 2 with empennage, to replicate the Phantom 3 payload and VPS module, and weight to serve as a ballistic match for the Phantom 3 Standard and Advanced Models (Figure C - 8). Blade guard links, shown in the laceration mitigation section, were not included in the flight test, because this design modification was completed after CFD analysis was done. The addition of the links will add a small increase in flat plate drag area to the model, the same as the guards have done, and further slow the vehicle’s descent in comparison to the baseline aircraft. The flight test aircraft weighed 3.01 lbs, which was used as the vehicle weight during ballistic simulations for model validation. The flight test aircraft was equipped with a Pixhawk flight controller in lieu of the standard controller to save additional weight by simultaneously acting as the flight controller and data logger.21 The flight crew recorded ambient conditions, i.e. temperature, relative humidity, and wet bulb temperature in order to calculate air

density so the ballistic model can be run for the same conditions that were experienced during the flight test. A backup Phantom 3 Standard was also prepared for flight testing. The flight test aircraft were also equipped with a MARS mini V2 parachute recovery system to prevent a full crash following simulated failure of the aircraft.22 This was a top-mounted parachute in order to avoid altering the vehicle’s vertical planform area. While there was some impact to the horizontal flat plate drag area, it is assumed that this is of lesser impact due to the low forward airspeeds, compared to expected peak vertical speeds, used in the drop testing. Flight testing consisted of iterations of cutting motor power at 400 feet AGL with initial velocities of 5, 10, 20, and 30 ft/s. The hover failure case was not tested, because the NIAR drop tests validated the accuracy of ballistic model predictions for falls from a pure hover.

21 https://store.3dr.com/products/3dr-pixhawk, accessed 08/20/2016 22 http://www.marsparachutes.com/mars-mini/, accessed 08/20/2016

Figure C - 8: UAH Flight Test Phantom 2 with Blade Guards, Replicated Payload, and MARS Mini V2 Parachute Recovery System

Figure C - 9 shows good correlation between predicted falling flight trajectories and flight test data for the Phantom 3 with blade guards. Cross-winds during test flight lead to some discrepancies, but the comparison of a flight test drop with an initial velocity of 27 ft/s corresponds well with the simulated drop with an initial velocity of 30 ft/s. The two drops with initial velocities of 6 ft/s and 7 ft/s are close to the simulation; however, the drop with light green markers appears to have experienced gusts during the drop. Overall, the ballistic model, driven by CFD flow field simulation, produces accurate data outputs that are validated by both vertical drops and forward flight failure test flights.

The ballistic modeling and validation show that impact KE levels can be managed by maintaining appropriate limits to altitude above people and airspeed. The accuracy of the simulation also demonstrates that high-fidelity models, supported by limited test points, can be used to assess vehicle ballistic characteristics and impact KE after failure in a wide range of flight conditions that cannot be readily assessed with flight tests.

Figure C - 9: Comparison of Simulated Phantom 3 Advanced Falling Trajectories and Flight Test Trajectories

Phantom 3 Standard Energy Transfer Analysis

Wichita State University (WSU) National Institute for Aviation Research (NIAR) conducted vehicle drop testing of the Phantom 3 Standard on the head of a ATD Hybrid III 50th Percentile Male Crash Test Dummy (Figure C - 10).23 This testing collected data from internal load cells and accelerometers in the dummy and photometric analysis to track vehicle (3D position) and dummy head position (XZ positions only) during the impact sequences. Load cells and accelerometers (Error! Reference source not found.) in the dummy were used to measure Head Acceleration (g), Head Injury Criteria (HIC15), Upper Neck Tension (lbf), Upper Neck Compression (lbf), Upper Neck Flexion (lbf-ft), Upper Neck Extension (lbf-ft), Upper Neck Shear (lbf), and Upper Neck Nij. The last term, Upper Neck Injury Criteria (Nij) is a derived term, which is the sum of normalized neck load and moments. This term normalizes measured loads and moments by the maximum acceptable values, such that values for Neck Injury Criteria fall between 0 and 1.5

23 http://www.humaneticsatd.com/crash-test-dummies/frontal-impact/hybrid-iii-50th, accessed 08/22/2016

Figure C - 10: Hybrid III 50th Percentile Male Crash Test Dummy

Figure C - 11: Hybrid III Crash Test Dummy Internal Instrumentation (left) and Photometric Data (right) Used in NIAR Testing

UAH conducted analysis of photometric tracking data to evaluate energy transfer from the vehicle to the ATD Hybrid III dummies during the NIAR drop test impacts. This analysis serves to characterize the vehicle’s impact characteristics and offer experimental validation of A4 modeling work that shows that sUAS do not transfer 100% of impact energy to an impacted person. Some of the pre-impact energy is retained in the vehicle, which results in vehicle rebound from the point of collision, vehicle rotation after the collision, and deformation of the airframe during collision. Pre-collision attitude, mid-collision deformation, and post collision rebound and rotation during a 50-foot drop test can be seen in Figure C - 12.

UAH researchers have calculated the percentage of impact KE retained in the UAS after collision through conservation of angular momentum. Figure C - 13 shows that the dummy can be viewed as a set of links between hinges. As such, angular momentum is conserved around the points of rotation. It is important to note that since the dummy system cannot translate freely, linear momentum is not conserved.

Figure C - 1 Figure C - 12: 50 foot drop test (UA17A-13) Pre-collision Orientation (left), vehicle deformation (center), and post-collision rebound and rotation

The parameters in Figure C - 13 are all known system parameters or collected directly from the NIAR tests. The known system parameters are Phantom 3 Standard mass, the Phantom’s moments of inertia, the dummy head and torso weights and moments of inertia, and the radial distances between dummy hinges and the dummy component centers of gravity. The UAS and dummy component linear and angular velocities come from the NIAR photometric data outputs. Since angular moment is conserved about the hinges, the sum of system angular momentum prior to impact is equal to the sum of system angular momentum after impact as:

(𝑚𝑚1𝑢𝑢1 × 𝑟𝑟1)𝑢𝑢𝑢𝑢𝑢𝑢 = (𝑚𝑚1𝑣𝑣1 × 𝑟𝑟1 + 𝐼𝐼1𝜔𝜔1)𝑢𝑢𝑢𝑢𝑢𝑢 + (𝑚𝑚2𝑣𝑣2 × 𝑟𝑟2 + 𝐼𝐼2𝜔𝜔2)ℎ𝑒𝑒𝑢𝑢𝑒𝑒 + (𝑚𝑚3𝑣𝑣3 × 𝑟𝑟3 +𝐼𝐼3𝜔𝜔3)𝑡𝑡𝑡𝑡𝑡𝑡𝑢𝑢𝑡𝑡 Equation 1

where m = object mass, I = object moment of inertia, v = translational velocity, and ω = rotational velocity.

Table C - 2 and Table C - 3 show the results of Conservation of Angular Momentum analysis applied to the NIAR photometric data. The lower drops from 20 and 30 feet show between 66%-85% transfer of energy from the Phantom 3 Standard to the dummy and the higher drops show 86%-97% energy transfer. One data point, for test V(90) 50-1, is a significant outlier in terms of the calculated percent of energy transfer. The photometric data from this test was marked by very high rates of rotation after the impact, which are suspect because they aren’t apparent in the impact video, and they account for the lower than expected calculated percentage of energy transfer.

There is a significant disconnect between the calculated impact energies, estimated percentages of energy transfer, and the assessed injury severity criteria by NIAR. There are two reasons, which are likely the biggest drivers behind this disconnect. First, the conservation of angular momentum modeling

Figure C - 2 Figure C - 13: System Diagram for UAS and Phantom Conservation of Angular Momentum Analysis

does not account for vehicle elastic distortion, which is shown in Figure C - 12. High fidelity finite element analysis modeling must be done to account for this airframe behavior and the impact energy that is expended in deforming the airframe. The other, likely, reason why many of the injury severity criteria are lower than expected is that the loadings occur over a shorter time frame (15 ms) for the deformable airframe versus a virtually rigid object like a metal weight or a brick of the same mass, that has limited or no elastic response other than the response of the head and neck. This results in higher static loadings for the rigid objects then for elastic or flexible objects.

Table C - 2: Analysis of NIAR Drop Test UAS Energy Transfer for 20 and 30 foot Drops

Test Name V(90)-20-1

V(90)-20-2

V(90)-20-3

V(90)-30-1

V(90)-30-2

V(90)-30-3

Vehicle Weight (lbm) 2.68 2.68 2.68 2.68 2.68 2.68 Moment of Inertia (Iyy) 0.01 0.01 0.01 0.01 0.01 0.01

Desired Drop Height (ft) 20.00 20.00 20.00 30.00 30.00 30.00 Actual Drop Height (ft) 20.08 20.00 20.00 30.08 30.00 30.00

Desired Impact Velocity (ft/s) 36.00 36.00 36.00 44.00 44.00 44.00 Actual Impact Velocity (ft/s) 32.49 32.31 32.50 39.25 39.00 38.74

Velocity (z dir.)before collision

(ft/s) 28.84 29.00 29.01 37.18 37.35 37.49

Time of deformation (ms) /frames

16.00 18.00 18.00 16.00 19.00 18.00

Rebound Velocity after collision (ft/s)

-12.23 -12.00 -12.17 -5.62 -11.13 -7.08

omega before collision (rad/s) 2.55 -4.50 -2.89 4.36 1.20 5.23 omega after collision (rad/s) -36.51 -20.00 -22.50 -41.92 -39.73 -43.00

UAV KE before collision (ft-lb) 34.57 34.96 34.99 57.47 57.98 58.54 UAV Rotational Energy before

collision (ft-lb) 0.03 0.08 0.03 0.08 0.01 0.11

UAV KE after collision (ft-lb) 6.22 5.99 6.16 1.31 5.15 2.09 UAV Rotational Energy after

collision (ft-lb) 5.53 1.66 2.10 7.29 6.55 7.67

Loss in UAV Energy (ft-lb) 22.85 27.40 26.76 48.95 46.29 48.90

Percentage Transfer to Dummy 66.05% 78.18% 76.42% 85.06% 79.83% 83.37%

Table C - 3: Analysis of NIAR Drop Test UAS Energy Transfer for 40 and 50 foot Drops

Test Name V(90)-40-1

V(90)-40-2

V(90)-40-3

V(90)-50-1

V(90)-50-2

V(90)-50-3

Vehicle Weight (lbm) 2.68 2.68 2.68 2.67 2.68 2.67 Moment of Inertia (Iyy) 0.01 0.01 0.01 0.01 0.01 0.01

Desired Drop Height (ft) 40.00 40.00 40.00 50.00 50.00 50.00 Actual Drop Height (ft) 40.08 40.00 40.00 51.33 51.25 51.25

Desired Impact Velocity (ft/s) 51.00 51.00 51.00 57.00 57.00 57.00 Actual Impact Velocity (ft/s) 43.08 43.21 43.96 49.58 49.17 49.14

Velocity (z dir.)before collision

(ft/s) 39.47 40.24 43.52 46.58 45.65 45.11

Time of deformation (ms) /frames

20.00 17.00 21.00 17.00 14.00 18.00

Rebound Velocity after collision (ft/s)

-6.07 -8.19 -7.03 -6.06 -5.47 -3.94

omega before collision (rad/s) -3.98 7.81 -1.20 1.81 -8.90 -2.89 omega after collision (rad/s) -41.85 -17.20 -24.00 -97.49 -39.62 -19.54

UAV KE before collision (ft-lb) 64.88 67.31 78.72 90.02 86.62 84.42 UAV Rotational Energy before

collision (ft-lb) 0.07 0.25 0.01 0.01 0.33 0.03

UAV KE after collision (ft-lb) 1.53 2.79 2.05 1.52 1.24 0.64 UAV Rotational Energy after

collision (ft-lb) 7.26 1.23 2.39 39.42 6.51 1.58

Loss in UAV Energy (ft-lb) 56.15 63.55 74.29 49.09 79.20 82.23

Percentage Transfer to Dummy 86.45% 94.06% 94.36% 54.52% 91.08% 97.36%

The UAS Characteristics White Paper16 showed the relationship between energy transfer to the human as a function of impact angle to the torso for FW and RW collisions (Figure C - 14). While the analysis for horizontal collisions, the data for multi-rotor vehicles correlates with the data shown above for the 90 degree cases in the vertical direction. While the analysis shown in the UAS Characteristics White Paper16 is a larger vehicle than that tested during the NIAR tests, the trends are expected to be similar. Elastic energy in the vehicle itself could not be measured during the tests and as seen in the collision videos, the vehicle retains substantial energy in terms of elastic response that further reduces the transfer of energy to the human as the vehicle absorbs much of the energy in the bending and distorting of the structure that is ultimately not converted to translational or rotational energy that can be measured

during test. Additional finite element modeling and development of more complete finite element modeling is required to document the structural elastic energy and fully document the energy transfer in terms of KE.

Figure C - 14: Impact Angle and Impact on Energy Absorption for RW and FW Reference UAS Characteristics Report16

2. Blunt Force Trauma Injury Evaluation

The drop tests were conducted by NIAR using new DJI Phantom 3 Standard without blade guards were used to determine the injury potential from a blunt force impact to the head and neck region following an inflight failure (loss of power) event while operating over a congested area of people. Previous analysis conducted by UAH using the area weighted KE method established different impact KEs associated with specific probabilities of fatality based upon the data established in previous work on non-lethal submunitions and published in the UAS Characteristics White Paper16 submitted to the FAA in June 2016. The work published in June was based upon non-lethal submunitions that were designed to provide nearly perfect energy transfer without causing lethal injury. Much of the previous safety standards established by the NAVAIR and others utilized the non-lethal submunition standards of fragment standards derived from fragmentation standards established by the Department of Defense and NATO. The methods and approaches established in the white paper had limitations in size up to 2 lbs and the fragments and munitions used were not flexible structures with impact areas as large as the Phantom 3 Standard or Advanced; therefore, the NIAR testing provided the first tests of UAS against test

ATD test dummies to determine the validity of the assumptions made in the initial analysis using historical data from other applications.

The NIAR drop tests had two fundamental objectives; (1) to conducted actual impact tests at various angles and speeds that could be traced back to initial altitude and velocity conditions for the Phantom 3 Standard and Advanced such that a height-velocity diagram could be established for this specific vehicle and (2) to establish a method for determining energy transfer to the human for various test conditions to develop a method for establishing simple test procedures for small UAS based upon actual impact KE and using modeling or coefficient of restitution values based upon the structure to refine injury metrics from those developed from non-lethal munitions studies. Due to delays in obtaining photometric data from NIAR to complete this waiver, the analysis for establishing the boundary conditions of the test utilizes the results of objective (1) and limited data from objective (2).

The results of NIAR testing for probability of head (skull fracture) and neck injuries are shown in Table C-1. The standards for establishing these injury metrics were established by using the automotive crash standards for the 50th percentile man ATD using injury metrics established by the National Highway Traffic Safety Administration, National Transportation Biomechanics Research Center (NTBRC) in November 1999.5 The NHTSA study was conducted to upgrade the Federal Motor Vehicle Safety Standard (FMVSS) No. 208 frontal crash protection safety standard. “Based on the agency’s analysis of comments received in response to the publication of the NPRM and the accompanying technical reports, the agency has made modifications to the recommended injury criteria and their associated performance limits…. This report, which is a supplement to the previous report, “Development of Improved Injury Criteria for the Assessment of Advanced Automotive Restraint Systems”, (Kleinberger, et. al, NHTSA Docket 98-4405-9) documents these modifications and the rationale.”5 It should be noted that the probabilities for the different AIS Levels are not cumulative as the probabilities are based upon a cumulative normal distribution for their potential injury.

The NHTSA report utilizes the AIS called out in the Micro-ARC Final Report4 to establish standards for AIS Level 3 or greater injury for category four operations that includes flights over congested areas of people. The Micro-ARC Category 4 Performance Standards4 recommended an injury metric that included no greater than a 30% chance of AIS Level 3 injury or greater following impact with a non-participant. Table C - 4 clearly shows that the probability of occurrence of an AIS injury for the impact KE tested during the NIAR tests shows the injury potential for the conditions tested show the probability of injury of an AIS Level 3 or greater injury to be no higher than 12.5% based upon the NHTSA standards with the probability of a skull fracture being substantially less (less than 1.5% for the conditions tested). As such, the height-velocity limitations proposed for the part 107 waiver for flight over people establishes the conditions that will remain within the impact KEs defined by this test and are shown in. The injury metrics conclude that these operating conditions provide substantial margin to the Micro-ARC injury thresholds established for category 4 operations with the most likely injury potential being AIS Level 2 or less injury.

Table C - 4 NIAR Test Results

Test Number UAV

Weight (lbs)

Impact Velocity

(fps)

Impact KE

(ft-lbs)

Impact Angle (deg)

Maximum Resultant

Head Acceleration

(g)

HIC15 (Max 700)

Probability of Head Injury

P(AIS≥2)

Probability of Neck Injury

P(AIS≥2)

Probability of Neck Injury

P(AIS≥3)

Probability of Neck Injury

P(AIS≥4)

Probability of Neck Injury

P(AIS≥5)

UA17A-01 V(90)-20-1 2.69 32.49 44.1 90 54.31 12.02 0.00% 17.48% 8.32% 10.05% 3.50%

UA17A-02 V(90)-20-2 2.69 32.31 43.6 90 56.68 14.99 0.00% 18.00% 8.78% 10.38% 3.63%

UA17A-03 V(90)-20-3 2.69 32.5 44.2 90 49.18 15.64 0.00% 18.36% 9.10% 10.60% 3.71%

UA17A-05 V(90)-30-1 2.69 39.25 64.4 90 47.78 19.29 0.00% 18.54% 9.26% 10.72% 3.76%

UA17A-06 V(90)-30-2 2.69 39 63.6 90 48.35 23.45 0.00% 20.02% 10.68% 11.67% 4.12%

UA17A-07 V(90)-30-3 2.69 38.74 62.7 90 66.36 23.02 0.00% 18.18% 8.94% 10.49% 3.67%

UA17A-08 V(90)-40-1 2.69 43.08 77.6 90 78.7 46.62 0.01% 21.40% 12.06% 12.56% 4.46%

UA17A-09 V(90)-40-2 2.69 43.21 78.1 90 54.01 34.13 0.00% 21.80% 12.49% 12.82% 4.56%

UA17A-10 V(90)-40-3 2.69 43.96 80.8 90 78.62 42.79 0.01% 20.22% 10.86% 11.79% 4.16%

UA17A-11 V(90)-50-1 2.69 49.58 102.8 90 82.38 59.54 0.03% 21.80% 12.49% 12.82% 4.56%

UA17A-12 V(90)-50-2 2.69 49.17 101.1 90 71.5 48.04 0.01% 21.20% 11.86% 12.43% 4.41%

UA17A-13 V(90)-50-3 2.69 49.14 100.9 90 119.13 42.24 0.01% 21.40% 12.06% 12.56% 4.46%

UA17A-14 H(0)-4.5-1 2.69 17.25 12.4 0 25.05 7.83 0.00% 12.36% 4.44% 6.93% 2.36%

UA17A-15 H(0)-4.5-2 2.69 17.25 12.4 0 60.65 29.18 0.00% 12.63% 4.61% 7.08% 2.42%

UA17A-16 H(0)-4.5-3 2.69 17.2 12.4 0 43.18 19.94 0.00% 12.49% 4.52% 7.01% 2.39% UA17A-17 A(65)-36.5-

1 2.69 37.03 57.3 65 60.12 39.55 0.01% 19.46% 10.12% 11.30% 3.98%

UA17A-18 A(65)-36.5-2 2.69 36.8 56.6 65 60.88 0.04 0.00% 19.27% 9.95% 11.18% 3.93%

UA17A-20 A(65)-36.5-4 2.69 36.56 55.9 65 55.64 26.25 0.00% 19.08% 9.77% 11.07% 3.89%

UA17A-21 A(58)-46.1-1 2.69 45.95 88.3 58 112.69 107.94 0.35% 19.46% 10.12% 11.30% 3.98%

UA17A-22 A(58)-46.1-2 2.69 46.06 88.7 58 120.49 119.07 0.49% 18.90% 9.60% 10.95% 3.84%

UA17A-23 A(58)-46.1-3 2.69 46.06 88.7 58 130.47 147.82 1.01% 19.27% 9.95% 11.18% 3.93%

UA17A-24 A(58)-51.7-1 2.69 50.37 106.1 58 119.79 137.17 0.79% 18.54% 9.26% 10.72% 3.76%

UA17A-25 A(58)-51.7-1 2.69 50.48 106.5 58 139.15 165.07 1.41% 18.90% 9.60% 10.95% 3.84%

UA17A-26 A(58)-51.7-1 2.69 50.46 106.4 58 126.58 123.64 0.56% 18.90% 9.60% 10.95% 3.84%

Based upon the injury potential shown in Table C - 4, the following operational limits were established for the Phantom 3 Standard and Phantom 3 Advanced operating over congested areas of people requested by this waiver (Figure C - 15 and Error! Reference source not found.). When operating from the takeoff and landing areas, movement to and from the takeoff and landing area will occur vertically until an altitude between 10 and 55 ft AGL is attained to avoid hazards to non-participants. Then the vehicle will be translated to the operating area within the speed and altitude envelopes described below. RTH routes will be designated to stay within these boundaries to the greatest extent possible,

but the RTH mode may require a slightly higher altitude to avoid obstructions or hazards the could cause a greater risk if injury to non-participants than that of a transient operation at a higher altitude in the event that this emergency mode must be activated.

Figure C - 15: Phantom 3 Standard Height Velocity Limits

Figure C - 16: Phantom 3 Advanced Height Velocity Limits

Laceration Mitigation

Based on a survey of the Academy of Model Aeronautics’ injury records and online videos, the FAA A4 Project team concluded that the most prevalent type of injury associated with sUAS are laceration injuries from propellers.16 UAH has installed the stock blade guards on the Phantom 3 aircraft and replaced the string linkage between the guards with RC aircraft control rods comprised of steel clevises and carbon fiber tubes (Figure C - 17). The guard link prevents limbs or other objects from getting between the propellers. This is crucial because counter rotating propellers (consider if the propeller on the left is turning counter clockwise and the propeller on the right is turning clockwise) will pull a limb in towards the aircraft body, which can result in multiple, deep tissue lacerations as seen in many videos available on social media. The string was replaced because it does not tolerate impact well and is difficult to install correctly. It can also be hard for the crew to see if the string has become loose or dislodged, so a larger link between the guards can be seen by flight crew members from a distance for better verification that the link is installed. Furthermore, the link allows the guards to absorb more energy during impact reducing penetration into the blade area and as a result minimizing the severity of the laceration.

UAH conducted a pendulum test in which the vehicle with guards was swung on a 14-foot pendulum at varying speeds to strike a chamois-padded PVC pipe, which acted as a surrogate for a human limb. Vehicle pre and post impact speeds were measured with motion tracking cameras in the UAH Mechanical and Aerospace Engineering Department’s Autonomous Tracking Optical Measurement (ATOM) laboratory.24 In addition to measuring vehicle speed, the vehicle and impacted post had optical markers to measure the penetration of the surrogate arm into the guard space and the passage of blade tips beyond the propeller guard (by way of comparing prop center distance to the guard during the test). The vehicle was aligned and swung as necessary to impact the link between the guards. Figure C - 18 shows the optical marker setup on the Phantom aircraft with modified guards and an impact test image. On the right side of Figure C - 18, the arm markers (purple) and vehicle markers (green, yellow, lavender, and pink) are shown prior to impact (right center image with space between purple markers and others) and during an impact where the arm had minor penetration into the guard space (Test 8).

The test results are shown in Error! Reference source not found.. The link was damaged during an impact at close to 10 knots; however, the surrogate limb did not go between the guards. One 7 knot 24 http://www.uah.edu/eng/eng-research/research-laboratories, accessed 08/20/2016

Figure C - 3

Figure C - 4 ATOM Lab Marker Setup (left), Impact Test (left center), Pre-Impact Motion Tracking Image (right center), Mid-Impact Motion Tracking Image (right)

Figure C - 17: Modified blade guard link (highlighted with red oval)

Figure C - 18: ATOM Lab Marker Setup (left), Impact Test (left center), Pre-Impact Motion Tracking Image (right center), Mid-Impact Motion Tracking Image (right)

impact broke the guards and the impacted post made a minor penetration of the area inside the guards and link prior to the aircraft rebounding. The fastest impact test, which was at 15 knots, broke the guards, but the vehicle still rebounded from the impact point.

These results indicate that the link and guards can effectively mitigate significant blade tip laceration injuries during low speed impacts with people. They cannot completely prevent laceration and do not withstand multiple impacts. It is also important to note that the guards are open on bottom and will not stop a cutting injury to a finger if a person reaches up through the guards. That can only be mitigated by maintaining a safe operating altitude above people during normal operations. The guard damage incurred during the testing also shows that new guards have to be installed following any contact with people that results in damage. During Test 9, blades protruded approximately 2.5 cm (~1 in) past the blade guard. While this could result in a deep cut, the guards and link still prevent the limb from being pulled into the area between the propellers. Additionally, the ballistic analysis showed that the aircraft is most likely to be descending from between vertical and 35° from vertical. In that case, most contacts are going to be with the bottom of the guards and the aircraft will pivot away from the point of contact versus presenting the guard so that it can be deflected into the aircraft which would expose the blade tips. An impact from below will drive the guard up into the blade tip path and stop the propeller from turning.

Table C - 5: Blade Guard and Link Pendulum Test Results

Tests demonstrated the blade guards had sufficient strength to prevent most cutting injuries when impact horizontal impact velocities are less than 10 kts (16.89 ft/s). The worst case condition for laceration injuries is an uncontrolled descent with the aircraft tumbling and the Phantom 3 lands inverted or lands with the blade guards exposed to velocities exceeding 10 kts in the vertical direction where a non-participant would be exposed to the blades directly or with the blade guards damaged at impact with the blades spinning at speed. Crews will be made aware of these emergencies and in the event of an uncontrolled impact command the motors to stop which takes 2-3 seconds.

The most credible scenario for impact with non-participants is the loss of battery power or inadvertent descent into non-participants at partial power. Flight tests were conducted showing the Phantom 3 platform without motor power falls in a flat attitude as discussed in the UAS Characteristics White

Paper.16 As shown in Figure C - 19 and Figure C - 20, the descent angles are greater than 55 deg for all initial altitudes and velocities within the flight envelope. Collisions with non-participants will occur at these impact angles. While the horizontal speed during these collisions may exceed the maximum blade guard horizontal impact speed of 10 kts, the impact load on the blade guards will be at an angle equivalent to the impact angle causing the blade guards to be pushed up into the propellers resulting in motor stoppage (Figure C - 21). The blade guards will likely be damaged during these impacts; however, the laceration potential is dramatically reduced by the impact of the blade guards prior to blade contact with the non-participant. To further reduce laceration severity, emergency procedures for uncontrolled descent will include the pilot commanding motor stop through the controller to reduce the time the motor remains running to 2-3 seconds after impact in order to minimize risk to non-participants.

Figure C - 19: Impact Angles Based Upon Failure Altitudes and Failure Velocities for the Phantom 3 Standard (Altitudes are height above impact on Chart)

Figure C - 20: Impact Angles Based Upon Failure Altitudes and Failure Velocities for the Phantom 3 Standard (Altitudes are height above impact on Chart)

Figure C - 21: Force on Blade Guard at 55 deg Impact Angle Forces Blade Guard Upwards Causing Blade Stoppage

3. Penetration Injury Mitigation

Based on flight profile analysis, analysis of NIAR drop test footage, and application of the blade guards, the most significant point impact on either Phantom 3 Standard or Advanced is if the aircraft falls from a hover 50 feet above a person and the payload is the primary point of contact. The blade guards prevent significant contact with the ends of the arms in horizontal flight and are flexible, which reduces penetration injuries. The drop tests also showed that the landing gear are significantly elastic during impacts and appear that they will readily yield or give way rather than penetrate skin since they have no sharp edges. During a fall from 50 feet above people, the vehicle achieves up to 94.2 ft-lb (127.72 J) of KE prior to impact. Figure C - 2 shows the likely payload contact areas on the Phantom 3 models. The bottom of the camera and its mount, which are the lowest parts of the payload, have a total contact area of 5.24 cm2. The bottom has a flat surface, so penetration like a knife blade is unlikely; however, it could result in skin lacerations or damage to the soft tissue of the skull since the peak energy density is 24.36 J/cm2. If the camera lens is pointed down during the impact, it has a contact area of 6.9 cm2, which yields a contact energy density of 18.52 J/cm2. Both of these energy densities exceed the 12J/cm2

threshold for penetration of skin.16 The likelihood of the skull fracture is low because the payload mount

Figure C - 22: Likely Payload Contact Areas

collapses and the aircraft deforms during a prolonged impact which reduces the impulse loading on the head. There are also no sharp edges on the camera that contacts the head so skull fracture is unlikely especially given the very low HIC numbers observed for all impact KEs during the NIAR drop tests. During payload mount collapse and breaking, impact energy is dissipated and not transferred to the person. The likelihood of a perfect collision is also uncertain since the vehicle will often be moving and winds are always a possibility resulting in some translation following descent to an impact. All of NIAR’s drop tests were no wind and perfectly aligned collision tests. Figure C - 23 shows the landing gear of a Phantom 3 model in comparison to the width of the Janser Standard Man, which aligns with a 50th percentile male.16 This demonstrates that even a displacement of 3 inches left or right during the impact means that the landing gear makes contact first and the aircraft will rotate about the point of impact preventing a direct contact with the camera. The worst case impact (50-foot vertical fall with the payload leading the impact) for penetrating injury is not the most credible impact scenario because it requires such a precise alignment of the falling aircraft with a completed stationary person; however, this scenario is the most severe penetrating injury scenario. Furthermore, the lateral impact tests resulted in the camera soft mounts breaking away nearly immediately on contact resulting in little or no penetration during the lateral impact tests.

3 in. 3 in.3 in.3 in.

6.3 in. 6.3 in.3 in.

Figure C - 23: Alignment of Phantom 3 Payload during impact with a 50th Percentile Male Head for Maximum Impact and Offset Impact

with Minimal Camera Contact

B-1

Appendix B - NIAR Test Article Damage

B.1 Summary

Thirteen of the Phantom 3 Standard test articles that were used for drop testing by NIAR were

inspected to evaluate the resulting damage to the fuselage, payload and battery. The remaining

vehicles were assessed by viewing the impact video to determine if the payload separated on

impact. A summary of the vehicle damage is provided in Table B-1. This appendix also

includes pictures of the damage to help qualify the information in Table B-1. These inspections

did not include methods like x-ray, non-destructive inspections or power-on testing. The most

common damage seen across the tests was payload damage. The payload camera has two weak

points where the camera separates from the gimbal. The damage to the fuselage occurs because

of flexing and buckling during impact. In the 50 ft drop tests internal fuselage damage is

observed. The batteries of the Phantom 3 test articles did not sustain any obvious physical

damage like cuts, punctures, or bulging. Further battery charging and testing may be performed

to ascertain if there was internal damage due to acceleration or impingement by the fuselage as it

distorted during impact. The section below describes the damage to each component of the

Phantom.

Table B-1 Summary of Test Article Damage

Test

NameDescription Fuselage damage Payload damage

Battery

damage

Payload

Separation in

Video

UA17A-01 V(90)-20-1 No separation

UA17A-02 V(90)-20-2 No damage Cracks in the camera No No separation

UA17A-03 V(90)-20-3 No separation

UA17A-04 V(90)-30-no test Slight buckling Camera breaks away No no video available

UA17A-05 V(90)-30-1 Very little buckling Cracks in the camera No No separation

UA17A-06 V(90)-30-2 broken, but intact

UA17A-07 V(90)-30-3 Very little buckling Cracks in the camera No No separation

UA17A-08 V(90)-40-1 Partial separation

UA17A-09 V(90)-40-2 No separation

UA17A-10 V(90)-40-3 moderate buckling partially breaks No No separation

UA17A-11 V(90)-50-1 Severe buckling Cracks in the camera No No separation

UA17A-12 V(90)-50-2Buckling, cracks,

creasesCracks in the camera No No separation

UA17A-13 V(90)-50-3Buckling, internal

crackingCracks in the camera No Partial separation

UA17A-14 H(0)-4.5-1 No separation

UA17A-15 H(0)-4.5-2 No separation

UA17A-16 H(0)-4.5-3 No separation

UA17A-17 A(65)-36.5-1 Partial separation

UA17A-18 A(65)-36.5-2 Very little buckling Cracks in the camera No No separation

UA17A-19 A(65)-36.5-3No Test Very little buckling Cracks in the camera No no video available

UA17A-20 A(65)-36.5-4 No separation

UA17A-21 A(58)-46.1-1 Separation

UA17A-22 A(58)-46.1-2 No damage Cracks in the camera No Partial separation

UA17A-23 A(58)-46.1-3 No damage Cracks in the camera No No separation

UA17A-24 A(58)-51.7-1Buckling and

internal crackingCracked Payload Mount No Separation

UA17A-25 A(58)-51.7-2 Separation

UA17A-26 A(58)-51.7-3 SeparationNo physical inspection

No physical inspection

No physical inspection

No physical inspection

No physical inspection

No physical inspection

No physical inspection

No physical inspection

No physical inspection

No physical inspection

No physical inspection

No physical inspection

No physical inspection

B-2

B.1.1 Fuselage Damage

When the Phantom 3 impacts the dummy head, it undergoes flexing where the arms merge into

the fuselage. The Phantom fuselage is comprised of the upper and lower shells and buckling

between these two frames is the most commonly occurring damage. Figure B-1 and Figure B-2

show the most common damage on the fuselage. This damage varies from very slight buckling to

severe buckling and cracking of the frame. In the angular drop tests at high speeds, the fuselage

internal structure is damaged (Figure B-3). This damage was observed only after pulling the

battery out. Due to the internal damage, the battery could not be pushed back inside the fuselage.

The motors on the test articles do not undergo any damage. In some test articles, the propellers

are damaged and bent (Figure B-4). This could be a result of the drops or transportation from

NIAR to UAH.

Figure B-1 - Buckling on Test Article UA17A-05

B-3

Figure B-2 - Internal Fuselage Cracking on Test Article UA17A-24

Figure B-3 - Significant Buckling and Cracking on Fuselage of Test Article UA17A-11

B-4

Figure B-4 - Bent propeller on the Test Article UA17A-13

B.2.1 Payload Damage

The most noticeable and severe damage in every drop is observed at the payload. Most of the

tests involve initial contact of the payload with the dummy head before any other part of the

vehicle. The most common damage to the payload is observed in Figure B-5. At this location,

cracks developed in the base plate of the camera because the camera is compressed into it.

Figure B-6 shows how the camera commonly breaks away from the payload gimbal. This image

shows that the motor/joint for controlling camera elevation is the weakest link on the payload

where loads can lead to separation. For high impact velocities at an angle, the entire payload

separates away from the test article (Figure B-7). The payload damage can be categorized into

three types, cracks at the base plate, camera separation from the gimbal and complete (camera,

gimbal, and base plate) payload separation.

Figure B-5 - Damage on Payload Base Plate on Test Article UA17A-11

B-5

Figure B-6 - Camera Separation from Gimbal at the Elevation Motor on Test Article UA17A-10

Figure B-7 - Complete Payload Separation in Test Article UA17A-22

B.3.1 Battery Damage

No obvious physical damage was found on any of the batteries from 26 test articles returned

from NIAR following the drop tests. Damage to battery compartments was identified as shown

in Figure B-2 that could have led to battery damage of contact was made with the soft sides of

the batteries of the Phantom 3, but none were observed as a function of these tests.

C-1

Appendix C - Proposed Standard with Impact KE Assessment Only

C.1. Introduction

The tests and analysis conducted under Task A4 and Task A11 of the FAA UAS CoE have led to

the development of a proposed standard to be used by industry to substantiate vehicle-specific

operational height-velocity envelopes for safe operation for flight over people. The proposed

standard uses the same methodology used to establish an envelope during Task A11.

Additionally, the standard outlines test procedures that can be conducted by the applicant that do

not require use of a separate testing site or significant increase in costs or time to collect

envelope validation data for part 107 waiver submission. The basic steps in the process are as

follows:

a. Develop a CONOPS.

b. Conduct an operational safety assessment to identify hazards.

c. Identify aircraft modifications required for mitigations for laceration and

penetration injury hazards (parachutes, blade guards, material selection,

frangibility, etc.).

d. Conduct CFD analysis or other analysis to determine the flat plate drag area and

mass of the applicant’s proposed vehicle configuration to refine the height-

velocity diagram.

e. Conduct a ballistic analysis/characterization of the applicant vehicle based upon

flat plate drag area and mass of the applicant’s proposed vehicle configuration to

develop initial height-velocity diagram to achieve CONOPs.

f. Conduct flight test to substantiate the flat plate drag area and mass of the

applicant’s proposed vehicle configuration to refine the height-velocity diagram

from the original ballistic analysis.

g. Evaluate ground impact KE from vehicle ballistic characterization and use RCC

impact KE thresholds, correlated to PoF to determine the acceptable Height-

Velocity limitations for the waiver application.

C.2. Flow chart with Data Requirements

The data requirements to support this testing standard and the testing standard workflow are

illustrated in Figure C-1. The applicant must provide aircraft CAD models, the CONOPS

describing the operations covered by the waiver application, and the vehicle model. An initial

operational safety assessment will be provided by the applicant. Depending on the availability of

time, funding, software and expertise, an applicant may choose to conduct ballistic

characterization via CFD flow field simulation, ballistic modeling, flight test validation, or

conduct an in-depth flight test to support ballistic characterization. In the former method, the

applicant or a representative organization will evaluate and modify aircraft CAD models for use

in CFD simulation and then conduct ballistic characterization of the vehicle based on the vehicle

C-2

mass and aerodynamic properties. The applicant or a representative will conduct flight test

following integration of the vehicle state data logging unit and procedures that are established for

safe recovery of the vehicle following power-off drops from altitude. If an applicant chooses to

use flight test alone, this will be used to verify the vertical flat plate drag area of the vehicle and

impact KE-levels based on failure airspeed. Penetration and laceration mitigations will be

analyzed and tested to determine the remaining risk of penetrating and lacerating injuries.

Mitigations for laceration and penetration will be redesigned and retested if initial designs are not

effective. Height-Velocity boundaries and/or operational procedures in the CONOP will be

amended to show the impact KE levels defined by the FAA to achieve the defined target level of

safety, or at a minimum the impact KE, defined by the applicant as safe for operations. Ranges

of impact KE, as a function of altitude and velocity, will be defined by the applicant to provide a

range of safe height-velocity profiles for the selected vehicle configuration. An example of

height-velocity envelope development is shown in Appendix A – UAH Part 107 Waiver

Submission for Flight Over People. The operational risk assessment (ORA) will be updated

jointly by the applicant, representatives, and the FAA based on the results of testing an analysis

in order to determine residual risk present in the CONOPS.

Figure C-1 - Testing and Analysis Standard Block Diagram

Provided by Applicant

Provided by Applicant in Draft Form

Completed by Applicant or Representative

Completed Jointly with Applicant

Operator’s ManualOperational Procedures

Required H-V Capabilities

Resources available for CFD?

Is risk of penetration

or laceration acceptable?

Vehicle Selection

Develop Initial H-V Boundaries

Identification and Evaluation of Residual Risk

Aircraft CAD Models

CAD Evaluation for CFD Analysis

Operational Risk Assessment

Penetration and Laceration Design

Modifications

CONOPS

Required Payload

Ballistic Characterization

Analyze/Test Modifications

Develop H-V Boundaries Based on Impact KE and

RCC ThresholdsFlight Test

CFD Flow Field Simulation

Sharp points, edges, and small contact areas will be evaluated against the impact energy density threshold of 12J/cm2. Exceeding this threshold may be permissible based on a low likelihood of contact during impact.

(For draft ORA only)

Yes

No

No

Yes

C-3

C.3. CONOPS Development

CONOPS development is the framework for the operational aspects of the mission that

ultimately define the height-velocity operational restrictions. The development of the CONOPS

is beyond the scope of this report, but the CONOPS should clearly articulate the operational

requirements from which an operational risk assessment can be made. An example CONOPS is

contained within the waiver in Appendix A. The CONOPS will take into account the applicant’s

existing operational procedures, which play a key role in the draft operational risk assessment

and first set of risk mitigations developed under the waiver application.

Requirements within the CONOPS, in terms of payload capabilities and required height-velocity

combinations drive vehicle selection by the applicant. Selection of the vehicle feeds three

separate efforts within the testing and analysis. First, the vehicle’s mass, along with assumed flat

plate drag areas are used for an initial evaluation of Height-Velocity diagram which feeds

development of the draft ORA. The selection also begins the process of developing injury

mitigations for penetration and laceration injuries. Lastly, the vehicle selection feeds into

ballistic characterization.

C.4. Ballistic Characterization Option 1: CFD Analysis of Flat Plate Drag Area

C.4.1. Development of CFD Models from Vehicle Computer-Aided Design (CAD)

Models

A well-designed CAD model is critical for performing CFD and FEA simulations. There are

several specific considerations when modeling for a CFD or FEA workflow. CAD models used

for CFD are different than those used for manufacturing and those used for structural analysis.

The CAD model must be watertight and free of discontinuous surfaces or gaps between

intersecting surfaces. The amount of time to run a CFD or FEA simulation is a function of the

size of the grid mesh applied over the surfaces. The grid size is determined by the area of the

smallest face on the model; therefore, extremely small part faces or radius of curvature

significantly increases the simulation run time. Selection of meaningful details that may impact

drag calculations is critical in the development of the CFD model from CAD. Most industry

CAD models require some modification from engineering and production drawings to conduct

CFD analysis. A simpler method of refining flat plate drag for the vehicle can be conducted

using a wetted area analysis if CFD cannot be conducted due to schedule or cost concerns.

For applicants who may not have access to the original aircraft manufacturer’s CAD files, the

applicant can use a coordinate measuring machine (CMM) to create point cloud data of the

airframe which could then be translated through sketches to a solid CAD model. This method is

a time consuming and expensive process in the absence of an expert who can perform this

analysis. Many vehicles may have existing CAD available online that represent the vehicle with

acceptable dimensional error. UAH used a CAD model of a Phantom 3 Advanced from

GrabCAD that had acceptable dimensional accuracy for a baseline CAD model. Several

C-4

modifications were made to the downloaded CAD model to correct geometry errors and

discontinuous surfaces to create a clean model to import the CFD workflow.

C.4.2. CFD Flow Field Simulation

The overarching goal of the CFD flow field simulation is to develop vertical and horizontal

equivalent flat plate drag areas for a given vehicle. Equivalent flat plate drag is expressed as:

𝑓 = 𝐶𝑑𝐴𝑟𝑒𝑓 Equation C - 1

where Cd is the CFD-generated drag coefficient based on an assumed reference Area, or Aref.

The reference area is an assumed wetted area, because it is not possible to determine the actual

wetted area for a complex shape, unlike an airfoil. Therefore, it must be emphasized that the

calculated drag coefficients are specific to the assumed area and cannot be applied to other

reference area values; however, the flat plate drag area is representative of the aircraft

specifically.

It is recommended that the applicant utilize the vertical and horizontal projections of the vehicle

viewed from above and the side, respectively as the reference areas such that the drag coefficient

can be a reasonable value that makes engineering sense in the analysis. The Aref values can be

determined via CAD software or in a CFD environment. Standardized reference areas also assist

in the calculation of the Reynolds number of the vehicle for simulation. The expression for

Reynolds number is given by:

𝑅𝑒 =𝜌𝑉𝐿

𝜇 Equation C - 2

where ρ is air density, V is the speed of incident flow, L is the characteristic length of the

aircraft, and μ is dynamic viscosity. Given that sUAS, particularly multi-rotor sUAS, have

widely varying geometries, it is challenging to develop a standard characteristic length based on

vehicle arm length or fuselage length. The proposed method is to calculate the diameter of a

circle with area equal to reference area of the vehicle. This diameter, in turn, is the characteristic

length of the vehicle for flow coming from that direction. This means that there are different Re

values for vertical and horizontal flow over the vehicle, even at the same incident flow velocity,

because the characteristic length of the vehicle will generally be different when calculated based

on vertical and horizontal projected areas. The relation for the characteristic length of the

vehicle, for a given orientation with respect to flow, is given by:

𝐿 = 2√𝐴𝑒𝑓𝑓

𝜋 Equation C - 3

CFD modelers should complete grid sensitivity studies to ensure that grid densities are sufficient

to estimate vehicle forces during simulation. Additionally, it is recommended that several

turbulent flow models are used to compare estimated drag coefficients and provide several

modeling options when correlating CFD and ballistic characterization results with flight test data

during validation. The UAH modeling, which was validated for both the Phantom 2 and

C-5

Phantom 3 aircraft, used laminar incident flow on the aircraft and a Turbulent Kinetic Energy

method to model turbulent flow after separation from the fuselage and components. Both of

these modeling methods appear to provide very accurate estimations of vehicle drag forces with

estimated impact velocities being within 1% of observed impact velocities for most NIAR drop

tests. The outlier cases, which replicated 40-foot drop tests, were within 2.2% (Appendix A –

UAH Part 107 Waiver Submission for Flight Over People) of the observed velocities.

For standardization between analytical efforts, modelers will employ standard conditions, vehicle

attitudes and incident flow velocities during CFD simulation. Standard Sea Level (SSL) air

properties are recommended for use in CFD flow field simulation (Table C-1). CFD simulations

must be completed for a range of speeds in orientations, with respect to flow, that represent

vertical falling of the vehicle in a level attitude and horizontal flight in a level attitude. This is

based on the assumption that the vehicle will fall in a level attitude. If designers know that a

vehicle will fall in a different attitude, the simulation should be completed in orientations that

reflect the known post-failure vehicle attitudes with respect to flow. The vehicle must have the

same configuration during simulation as it will have during flight test and operational use, e.g.

blade guards and with the appropriate payload(s) installed. The simulations will be completed

for velocities that are representative of the vehicle’s minimum through maximum horizontal

airspeeds and vertical speeds up through the terminal velocity of the aircraft.

Table C-1 - SSL Properties for CFD Analysis

Property Pressure Density Viscosity

SI units 101.325 kPa 1.225 kg/m3 1.789x10-5 Pa-s

English units 14.696 lbf/in2 0.002377 slug/ft3 3.737x10-7 slug/(s-ft)

The required minimum output of the flow field simulations are tables of vehicle drag coefficients

and the respective effective areas of the vehicle based on orientation with respect to flow.

C.5. Flight Test Validation of Flat Plate Drag Area

C.5.1. Flight Test Requirements

Waiver applicants will complete flight testing in the proposed aircraft configuration, e.g. payload

and blade guards etc., representative of how the aircraft will be flown under the waiver

CONOPS. This also applies to the use of a parachute recovery system if operators are planning

to use a parachute for impact energy mitigation during waivered operations.

Flight tests are aimed at collecting vehicle state data (velocities, attitudes, and angular rates)

during a power-off descent. State will be collected using a data logger with a minimum of 5Hz

sampling rate for vehicle state data. The required data outputs of the flight test are the vehicle

pitch, roll, yaw, and vertical and horizontal velocity components with respect to time during fall

C-6

for an unmitigated vehicle, i.e. without a parachute installed as part of the CONOP/waivered

operations. The ballistic characterization will be completed by comparing predicted and

achieved vehicle trajectories (vertical and horizontal displacement of the vehicle as a function of

time) during fall. This will be completed for a range of initial velocities at failure, e.g. 0, 5, 10,

and 20 ft/s.

Testing to validate parachute recovery system performance must record the vehicle vertical and

horizontal velocities after failure. It is desirable to log the parachute deployment signal to

evaluate the time and altitude loss between when the parachute actuation command is transmitted

to when the aircraft achieves a steady rate of descent under parachute. This will allow for

determination of the minimum operating altitude required for operations with a parachute

recovery system.

If ambient conditions during flight test vary more than 5 degrees Fahrenheit or 500 ft pressure

altitude from the original ballistic characterization of the vehicle, then the characterization of the

vehicle should be rerun under the same conditions as the flight test.

C.6. Ballistic Characterization Option 2: Determine Flat Plate Drag and Ballistics by Flight

Test Only

Operators may conduct flight test only, in lieu of CFD simulation, to support ballistic

characterization, based on limited available time, funding, CFD software and CFD modeling

expertise. This flight test is meant to replicate ballistic characterization, albeit at a lower level of

fidelity in terms of the number of failure altitude and airspeeds that are tested. This means that

the testing must also verify the vehicle’s terminal velocity following failure. Any fall altitude

that is sufficient to achieve terminal velocity covers the need for variation in failure altitude.

Failure airspeeds, during flight test, must be representative of the range of operating airspeeds for

the planned operations under waiver. There may be minor fluctuations in the recorded terminal

velocity values during a drop test, because of wake shedding and resulting changes in pressure

drag. An average value may be taken to be the vehicle’s stabilized or quasi-static terminal

velocity. The vehicle terminal velocity will be used to calculate the worst case impact KE value

and the vehicle’s flat plate drag area at terminal velocity. The flat plate drag area will be

calculated as follows:

𝑓 = 𝐴𝑒𝑓𝑓𝐶𝑑 =2𝑚𝑔

𝜌𝑉𝑡𝑒𝑟𝑚𝑖𝑛𝑎𝑙2 Equation C - 4

where g is the rate of gravitational acceleration and ρ is the density of the ambient air during

flight testing.

C.7. Instrumentation and Data Collection Requirements

Table C-2 shows the minimum required vehicle state data needed for validation of ballistic

models. The minimum required sampling rate for all vehicle parameters is 5Hz. All parameters

C-7

must have time stamps in order to determine the total velocity and attitude of the aircraft at any

point in time during a drop. The pitch, roll, and yaw parameters are recorded to verify the

vehicle attitude during drop – one key aspect of validating the ballistic model is to verify that the

vehicle falls, while unpowered, with the same attitude that was assumed during CFD flat-plate

drag area estimation and ballistic characterization. There will be discrepancies between the

predicted and observed descent and drift rates if the actual falling attitude is different than the

falling attitude that was modeled. As such, the flight test will not serve as validation because the

model is inaccurate.

Table C-2 - Flight Test Instrumentation Requirements

Parameter Minimum Sampling

Rate

Remarks

Time 5 Hz

Altitude 5 Hz Must be timestamped

Vz 5 Hz Must be timestamped

Vx 5 Hz Must be timestamped

Vy 5 Hz Must be timestamped

Roll 5 Hz Must be timestamped

Pitch 5 Hz Must be timestamped

Yaw 5 Hz Must be timestamped

The terminal velocity, which can generally be reached in approximately 200 ft of falling for a

multi-rotor aircraft, is used to calculated the effective flat plate drag of the vehicle. Operators

will have to conduct several vertical drop tests to ensure consistency and verification of the

terminal velocity value. Flat plate drag area is calculated, from terminal velocity, by the

following relationship:

𝑓 =2𝑚𝑔

𝜌𝑉𝑡𝑒𝑟𝑚2 Equation C - 5

Flight test data will be post-processed in order to determine the vehicle’s vertical and lateral

displacement based on time. The ballistic modeling will be validated by comparing the predicted

vehicle trajectory for a given failure flight condition, in terms of failure horizontal velocity and

altitude, with the observed trajectory from flight test. The flight test trajectory can be developed

directly from altitude and drift recorded by the data logger or calculated based on the vehicle’s

instantaneous velocity at each time step and the interval between time steps. The vertical

displacement at any time step, based on the latter method, is calculated by:

𝑧 = 𝑧𝑖 + 𝑉𝑧∆𝑡 Equation C - 6

where zi is the initial altitude and Δt is the interval between altitude samples in the data logger.

The horizontal displacement is calculated at any time step by:

𝑥 = 𝑥𝑖 + 𝑉ℎ∆𝑡 Equation C - 7

C-8

where Vh is the resultant velocity vector based on the vehicle’s x and y velocities during the fall.

In this analysis, the point where motor power is cut off is treated as x = 0. Figure 3 provides an

example of comparing predicted and actual post-failure trajectories.

C.8. Vehicle Ballistic Analysis/Characterization

The vehicle ballistic characterization provides estimated impact KE values for the UAS based on

combinations of failure altitude and airspeed. The characterization also provides estimated

impact angles for the aircraft. Examples of these outputs are provided in Figures C–5, C–6,

C–19, and C–20 in Appendix A – UAH Part 107 Waiver Submission for Flight Over People.

This is purely a ballistic modeling effort that assumes a constant vehicle attitude during descent,

full loss of propulsion, and failure in a level attitude with no representation of vehicle dynamics.

It represents a failure scenario in which the vehicle falls as an inert mass. Basic characterization

of the vehicle should be conducted to produce impact KE values based on failure under SSL

conditions. If operators expect to conduct operations under unique conditions, i.e. high and hot

conditions, the simulation inputs should represent those conditions to determine worst case

impact KE values. The failure altitude and velocity combinations used in the ballistic

characterization should reflect the operators full desired operating envelope, which will be

related to the accompanying waiver CONOPS.

C.9. Injury Mitigations

Waiver applicants must develop, validate, and apply mitigations to all identifiable categories of

human injury that can result from malfunction of their aircraft during missions conducted under a

waiver to Part 107 operating restrictions. The known injury types inherent to sUAS collision

with a person, per the Project A4 White Paper on UAS Characteristics are blunt trauma,

penetrating injuries, and laceration injuries. Mitigations can be in the form of operational

restrictions, e.g. operating height-velocity limits to minimize impact energy, or design

modifications like shrouds, guards, or padding to minimize the most likely means of causing

penetration or laceration injuries, or any other means that an applicant can devise.

Waiver applications will contain data and analysis that validates the effectiveness of applied

mitigations and the correctness of any engineering assumptions, for example, assumed energy

transfer values during sUAS collision with a person. Validation may take the form of safety case

analysis based on the CONOPS and flight test data and/or ballistic modeling. It can also come

from experimental work, for example impact testing of blade guards to measure resilience and

determine residual injury risk. All analytical modeling efforts require some form of

experimental validation. Design mitigations and operational limits will be tested and revised, as

needed, until appropriate levels of safety are reached based on ground impact KE levels. It is

important to emphasize that data from experiments and modeling should provide the FAA with

an understanding of the residual risk after the mitigation is applied. Information about the

residual risk feeds both the waiver applicant’s Operational Risk Assessment process and

C-9

document, and allows the FAA to make clear determinations of acceptable operations and

mitigations on a case-by-case basis. The absence of identified residual risk will likely hinder

FAA evaluation of the waiver package.

C.9.1. Blunt Trauma Injuries

The assessment of blunt trauma injury potential and PoF will be conducted by comparing

predicted and observed ground impact KE values from ballistic characterization with RCC

thresholds. Blunt trauma PoF values can be determined using values shown in Figure 9 or

Figure 10 depending on the application and the knowledge of whether non-participants are

sitting, standing or laying down as defined in the CONOPS.

C.9.2. Penetrating Injuries

Penetration injuries can be assessed against impact KEs and the contact areas that may result

during collision events to identify local areas of focused energy. Energy densities of components

that exceed 57 ft-lbs/in2 (12 lbs/cm2) should be addressed to reduce injury potential. These

values should not be used as reasons for rejecting the applicant’s request. Landing gear,

payloads and blade guards are potential sources of penetrating injuries. Landing gear and blade

guards are typically flexible and absorb energy that reduce energy density when compared with

straight calculations of impact energy divided by the contact areas. Payloads typically have

frangible fittings or mounts that cause the payload to break away under load or absorb some of

the energy and reduce the energy density during collision. For these reasons, the energy density

standards cannot be applied as a rigid test, but analyzed to determine how sufficiently the

mitigation has reduced the hazard relative to the impact energies and the collision orientations

identified by the applicant.

C.9.3. Laceration Injuries

Laceration injuries are the result of blade contact with unprotected skin. Even light clothing can

mitigate laceration injuries to some degree. Multiple blade contacts with unprotected skin and

deep penetration injuries greater than ½ inch cause the most severe injuries. Small lacerations to

the head can cause more substantial bleeding, while lacerations to the neck area are the most

severe especially when the carotid artery is involved. Laceration injuries that result in injuries of

AIS3 or greater involve more than 20% loss of blood by volume or involve bilateral lacerations

to arteries such as the carotid artery during a single collision. Blade guards create the simplest

and most effective form of mitigation to laceration injuries when the blade guards are capable of

sustaining impacts at the impact velocities identified within the height-velocity diagrams without

allowing only momentary penetration into the cutting area by less than ½ inch before rebounding

the vehicle away from the person. Blade guards also create collision geometries with other parts

of the vehicle that prevent the vehicle from reaching small areas such as the neck when

descending at steep angles. For flight over people waivers, the applicant should show how the

blade guards function under collision velocities to minimize intrusion into the cutting area by

C-10

less than ½ in. as long as they rebound the vehicle away from the person. Furthermore, blade

guards may be designed to intrude into the blade area causing blade stoppage during the

collision, and the applicant should show how the blade guards operate at a variety of impact

angles and collision velocities within the operating envelope. The applicant should also show

how blade guards may mitigate access to the thorax/neck area, as these areas are the most

vulnerable to laceration injuries. These mitigations are deemed as acceptable since they mitigate

the majority of AIS 3 or greater laceration injuries that blades can induce following a collision.

Blade guards will always be limited in performance due to weight and drag. As such, failure of

the blade guards during testing should not be a reason for rejecting the mitigation as long as the

vehicle rebounds away from the person during the collision when the blade guard fails. Blade

guards should survive multiple contacts when the CONOPS requires flight over a densely

populated operation over people, and there are no other mitigations for blade stoppage following

the first collision since the vehicle can rebound from one individual and contact another under

these type scenarios.

C.10. Operational Risk Assessment (ORA)

The operational risk assessment is beyond the scope of this report, but the operational risk

assessment should define the failure scenarios, associated severity of the hazard resulting from

the failure and the appropriate mitigations used to mitigate the hazard. Of particular importance

for this effort is for the applicant to review the vehicle configuration for potential blunt force

trauma, penetration injuries and laceration injuries that this vehicle configuration might cause

during a collision scenario with a non-participant or a participant for that matter. Blunt force

trauma is related to the impact KE and mitigations are related to how the impact KE is reduced

prior to collision or during the collision due to absorption by the vehicle or frangibility of the

vehicle. Penetration injuries are focused on sharp edges of the vehicle other than rotating

components or small contact areas where the impact KE may become concentrated in a single

area. Laceration injuries are related to impacts by rotating blades caused by rotors or propellers.

These laceration injuries are isolated from lacerations that might occur from penetration injuries

of non-rotating components since their mitigations are uniquely different.

The identification of these mitigations are important to identify early as many of the proposed

mitigations can have an impact on flat plate drag area and the ultimate vehicle configuration.

An example ORA is contained in the waiver request contained in Appendix A. More research is

required to develop a comprehensive ORA for UAS operations in general so one is not provided

as part of this report. Many of the hazards identified in the ORA contained in Appendix A are

common hazards to most UAS operations and may support the development of future ORAs

until a comprehensive example can be developed. The ASSURE Team has proposed developing

a comprehensive ORA outline for UAS operations.

C-11

The applicant will coordinate with the FAA to reach consensus on the level of residual risk

inherent to the operations covered by the waiver application.

D-1

Appendix D - Proposed Standard with Evaluation of Potential Injury Severity

D.1. Introduction

The tests and analysis conducted under Task A4 and Task A11 of the FAA UAS CoE have led to

the development of a proposed standard to be used by industry to substantiate vehicle-specific

operational height-velocity envelopes for safe operation for flight over people. The proposed

standard uses the same methodology used to establish an envelope during Task A11.

Additionally, the standard outlines test procedures that can be conducted by the applicant that do

not require use of a separate testing site or significant increase in costs or time to collect

envelope validation data for part 107 waiver submission. This standard also develops new

procedures for assessing injury metrics without using RCC metrics for impact PoF only. The

basic steps in the process are as follows:

a. Develop a CONOPS.

b. Conduct an operational safety assessment to identify hazards.

c. Identify aircraft modifications required for mitigations for laceration and

penetration injury hazards (parachutes, blade guards, material selection,

frangibility, etc.).

d. Conduct CFD analysis or other analysis to determine the flat plate drag area and

mass of the applicant’s proposed vehicle configuration to refine the height-

velocity diagram.

e. Conduct a ballistic analysis/characterization of the applicant vehicle based upon

flat plate drag area and mass of the applicant’s proposed vehicle configuration to

develop initial height-velocity diagram to achieve CONOPs.

f. Conduct flight test to substantiate the flat plate drag area and mass of the

applicant’s proposed vehicle configuration to refine the height-velocity diagram

from the original ballistic analysis.

g. Analyze resultant impact loads based upon mass and velocity of the vehicle at the

corner points of the height-velocity diagram to determine AIS injury standard

does not exceed 30% chance of AIS 3 or greater injury for head and neck injuries

(limiting factor). All areas of the height-velocity diagram must not exceed 30%

probability of resulting in an AIS 3 or greater injury.

D.2. Flow chart with Data Requirements

The data requirements to support this testing standard and the testing standard workflow are

illustrated in Figure D-1. The applicant must provide aircraft CAD models, the CONOPS

describing the operations covered by the waiver application, and the vehicle model. An initial

operational safety assessment will be provided by the applicant. Depending on the availability of

D-2

time, funding, software and expertise, an applicant may choose to conduct ballistic

characterization via CFD flow field simulation, ballistic modeling, and flight test validation, or

conduct an in-depth flight test to support ballistic characterization. In the former method, the

applicant or a representative organization will evaluate and modify aircraft CAD models for use

in CFD simulation and then conduct ballistic characterization of the vehicle based on the vehicle

mass and aerodynamic properties. The applicant or a representative will conduct flight test

following integration of the vehicle state data logging unit and procedures are established for

safe recovery of the vehicle following power-off drops from altitude. If an applicant chooses to

use flight test alone, this will be used to verify the vertical flat plate drag area of the vehicle and

impact KE-levels based on failure airspeed. The applicant or a representative will conduct

resultant impact load analysis and injury severity correlation based on achieved impact KE

values, and develop mitigations for penetration and laceration injuries. Penetration and

laceration mitigations will be analyzed and tested to determine the remaining risk of penetrating

and lacerating injuries. Mitigations for laceration and penetration will be redesigned and retested

if initial designs are not effective. If resultant impact load and correlated blunt trauma injury

severity estimates exceed 30% probability of an AIS-3 or greater injury, the Height-Velocity

Boundaries in the CONOP will be amended or operational procedures will be amended until

accepted injury severity levels are reached. The operational risk assessment (ORA) will be

updated jointly by the applicant, representatives, and the FAA based on the results of testing an

analysis in order to determine residual risk present in the CONOPS.

Figure D-1 - Testing and Analysis Flow Chart and Data Input Requirements

Provided by Applicant

Provided by Applicant in Draft Form

Completed by Applicant or Representative

Completed Jointly with Applicant

Operator’s ManualOperational Procedures

Required H-V Capabilities

Resources available for CFD?

Is risk of penetration

or laceration acceptable?

Prevent 30% Chance of AIS 3 or greater

injury?

Vehicle Selection

Develop Initial H-V Boundaries

Identification and Evaluation of Residual Risk

Aircraft CAD Models

CAD Evaluation for CFD Analysis

Operational Risk Assessment

Penetration and Laceration Design

Modifications

Resultant Impact Load/Injury Analysis

CONOPS

Required Payload

Ballistic Characterization

Analyze/Test Modifications

Revise H-V Boundaries, Adjust Procedures

Flight Test

CFD Flow Field Simulation

Sharp points, edges, and small contact areas will be evaluated against the impact energy density threshold of 12J/cm2. Exceeding this threshold may be permissible based on a low likelihood of contact during impact.

(For draft ORA only)

Yes

No

No

No

Yes

Yes

D-3

D.3. CONOPS Development

CONOPS development is the framework for the operational aspects of the mission that

ultimately the height-velocity operational restrictions are defined. The development of the

CONOPS is beyond the scope of this report, but the CONOPS should clearly articulate the

operational requirements from which an operational risk assessment can be made. The outline

for a CONOPS is contained in Appendix B, and an example CONOPS is contained within the

waiver in Appendix A. The CONOPS will take into account the applicant’s existing operational

procedures, which play a key role in the draft operational risk assessment and first set of risk

mitigations developed under the waiver application.

Requirements within the CONOPS, in terms of payload capabilities and required height-velocity

combinations, drive vehicle selection by the applicant. Selection of the vehicle feeds three

separate efforts within the testing and analysis. First, the vehicle’s mass, along with assumed flat

plate drag areas are used for an initial evaluation of Height-Velocity diagram which feeds

development of the draft ORA. The selection also begins the process of developing injury

mitigations for penetration and laceration injuries. Lastly, the vehicle selection feeds into

ballistic characterization.

D.4. Ballistic Characterization Option 1: CFD Analysis of Flat Plate Drag Area

Development of CFD Models from Vehicle Computer-Aided Design (CAD)

Models

A well-designed CAD model is critical for performing CFD and FEA simulations. There are

several specific considerations when modeling for a CFD or FEA workflow. CAD models used

for CFD are different than those used for manufacturing and those used for structural analysis.

The CAD model must be watertight and free of discontinuous surfaces or gaps between

intersecting surfaces. The amount of time to run a CFD or FEA simulation is a function of the

size of the grid mesh applied over the surfaces. The grid size is determined by the area of the

smallest face on the model; therefore, extremely small part faces or radius of curvature

significantly increase the simulation run time and selection of meaningful detail that may impact

drag calculations is critical in the development of the CFD model from CAD. Most industry

CAD models require some modification from engineering and production drawings to conduct

CFD analysis. A simpler method of refining flat plate drag for the vehicle can be conducted

using a wetted area analysis if CFD cannot be conducted due to schedule or cost concerns.

For applicants who may not have access to the original aircraft manufacturer’s CAD files, the

applicant can use a coordinate measuring machine (CMM) to create point cloud data of the

airframe which could then be translated through sketches to a solid CAD model. This method is

a time consuming and expensive process in the absence of an expert who can perform this

D-4

analysis. Many vehicles may have existing CAD available online that represent the vehicle with

acceptable dimensional error. UAH used a CAD model of a Phantom 3 Advanced from

GrabCAD that had acceptable dimensional accuracy for a baseline CAD model. Several

modifications were made to the downloaded CAD model to correct geometry errors and

discontinuous surfaces to create a clean model to import the CFD workflow.

CFD Flow Field Simulation

The overarching goal of the CFD flow field simulation is to develop vertical and horizontal

equivalent flat plate drag areas for a given vehicle. Equivalent flat plate drag is expressed as:

𝑓 = 𝐶𝑑𝐴𝑟𝑒𝑓 Equation D - 1

where Cd is the CFD-generated drag coefficient based on an assumed reference Area or Aref. The

reference area is an assumed wetted area, because it is not possible to determine the actual

wetted area for a complex shape, unlike an airfoil. Therefore, it must be emphasized that the

calculated drag coefficients are specific to the assumed area and cannot be applied to other

reference area values; however, the flat plate drag area is representative of the aircraft

specifically.

It is recommended that the applicant utilizes the vertical and horizontal projections of the vehicle

then viewed from above and the side, respectively as the reference area such that the drag

coefficient can be a reasonable value that makes engineering sense in the analysis. The Aref

values can be determined via CAD software or in a CFD environment. Standardized reference

areas also assist in the calculation of the Reynolds number of the vehicle for simulation. The

expression for Reynolds number is given by:

𝑅𝑒 =𝜌𝑉𝐿

𝜇 Equation D - 2

where ρ is air density, V is the speed of incident flow, L is the characteristic length of the

aircraft, and μ is dynamic viscosity. Given that sUAS, particularly multi-rotor sUAS, have

widely varying geometries, it is challenging to develop a standard characteristic length based on

vehicle arm length or fuselage length. The proposed method is to calculate the diameter of a

circle with area equal to the reference area of the vehicle. This diameter, in turn, is the

characteristic length of the vehicle for flow coming from that direction. This means that there

are different Re values for vertical and horizontal flow over the vehicle, even at the same

incident flow velocity, because the characteristic length of the vehicle will, generally, be

different when calculated based on vertical and horizontal projected areas. The relation for the

characteristic length of the vehicle, for a given orientation with respect to flow, is given by:

𝐿 = 2√𝐴𝑒𝑓𝑓

𝜋 Equation D - 3

D-5

CFD modelers should complete grid sensitivity studies to ensure that grid densities are sufficient

to estimate vehicle forces during simulation. Additionally, it is recommended that several

turbulent flow models are used to compare estimated drag coefficients and provide several

modeling options when correlating CFD and ballistic characterization results with flight test data

during validation. The UAH modeling, which was validated for both the Phantom 2 and

Phantom 3 aircraft, used laminar incident flow on the aircraft and a Turbulent Kinetic Energy

method to model turbulent flow after separation from the fuselage and components. Both of

these modeling methods appear to provide a very accurate estimation of vehicle drag forces with

estimated impact velocities being within 1% of observed impact velocities for most NIAR drop

tests. The outlier cases, which replicated 40-foot drop tests, were within 2.2% (Appendix A –

UAH Part 107 Waiver Submission for Flight Over People) of the observed velocities.

For standardization between analytical efforts, modelers will employ standard conditions, vehicle

attitudes and incident flow velocities during CFD simulation. Standard Sea Level (SSL) air

properties are recommended for use in CFD flow field simulation (Table D-1). CFD simulations

must be completed for a range of speeds in orientations, with respect to flow, that represent

vertical falling of the vehicle in a level attitude and horizontal flight in a level attitude. This is

based on the assumption that the vehicle will fall in a level attitude. If designers know that a

vehicle will fall in a different attitude, the simulation should be completed in orientations that

reflect the known post-failure vehicle attitudes with respect to flow. The vehicle must have the

same configuration during simulation as it will have during flight test and operational use, e.g.

blade guards and with the appropriate payload(s) installed. The simulations will be completed

for velocities that are representative of the vehicle’s minimum through maximum horizontal

airspeeds and vertical speeds up through the terminal velocity of the aircraft.

Table D-1 - SSL Air Properties for CFD Analysis

Property Pressure Density Viscosity

SI units 101.325 kPa 1.225 kg/m3 1.789x10-5 Pa-s

English units 14.696 lbf/in2 0.002377 slug/ft3 3.737x10-7 slug/(s-ft)

The required minimum output of the flow field simulations are tables of vehicle drag coefficients

and the respective effective areas of the vehicle based on orientation with respect to flow.

D.5. Flight Test Validation of Flat Plate Drag Area

Flight Test Requirements

Waiver applicants will complete flight testing in the proposed aircraft configuration, e.g. payload

and blade guards, etc., representative of how the aircraft will be flown under the waiver

CONOPS. This also applies to the use of a parachute recovery system if operators are planning

to use a parachute for impact energy mitigation during waivered operations.

D-6

Flight tests are aimed at collecting vehicle state data (velocities, attitudes, and angular rates)

during a power-off descent. State will be collected using a data logger with a minimum of 5Hz

sampling rate for vehicle state data. The required data outputs of the flight test are the vehicle

pitch, roll, yaw, and vertical and horizontal velocity components with respect to time during fall

for an unmitigated vehicle, i.e. without a parachute installed as part of the CONOP/waivered

operations. The ballistic characterization will be completed by comparing predicted and

achieved vehicle trajectories (vertical and horizontal displacement of the vehicle as a function of

time) during fall. This will be completed for a range of initial velocities at failure, e.g. 0, 5, 10,

and 20 ft/s.

Testing to validate parachute recovery system performance must record the vehicle vertical and

horizontal velocities after failure. It is desirable to log the parachute deployment signal to

evaluate the time and altitude loss between when the parachute actuation command is transmitted

to when the aircraft achieves a steady rate of descent under parachute. This will allow for

determination of the minimum operating altitude required for operations with a parachute

recovery system.

If ambient conditions during flight test vary more than 5 degrees Fahrenheit or 500 ft pressure

altitude from the original ballistic characterization of the vehicle, then the characterization of the

vehicle should be rerun under the same conditions as the flight test.

Ballistic Characterization Option 2: Determine Flat Plate Drag and Ballistics by

Flight Test Only

Operators may conduct flight test only, in lieu of CFD simulation, to support ballistic

characterization, based on limited available time, funding, CFD software and CFD modeling

expertise. This flight test is meant to replicate ballistic characterization, albeit at a lower level of

fidelity in terms of the number of failure altitude and airspeeds that are tested. This means that

the testing must also verify the vehicle’s terminal velocity following failure. Any fall altitude

that is sufficient to achieve terminal velocity covers the need for variation in failure altitude.

Failure airspeeds, during flight test, must be representative of the range of operating airspeeds for

the planned operations under waiver. There may be minor fluctuations in the recorded terminal

velocity values during a drop test, because of wake shedding and resulting changes in pressure

drag. An average value may be taken to be the vehicle’s stabilized or quasi-static terminal

velocity. The vehicle terminal velocity will be used to calculate the worst case impact KE value

and the vehicle’s flat plate drag area at terminal velocity. The flat plate drag area will be

calculated as follows:

𝑓 = 𝐴𝑒𝑓𝑓𝐶𝑑 =2𝑚𝑔

𝜌𝑉𝑡𝑒𝑟𝑚𝑖𝑛𝑎𝑙2 Equation D - 4

where g is the rate of gravitational acceleration and ρ is the density of the ambient air during

flight testing.

D-7

Instrumentation and Data Collection Requirements

Table D-2 shows the minimum required vehicle state data needed for validation of ballistic

models. The minimum required sampling rate for all vehicle parameters is 5Hz. All parameters

must have timestamps in order to determine the total velocity and attitude of the aircraft at any

point in time during a drop. The pitch, roll, and yaw parameters are recorded to verify the

vehicle attitude during drop – one key aspect of validating the ballistic model is to verify that the

vehicle falls, while unpowered, with the same attitude that was assumed during CFD flat-plate

drag area estimation and ballistic characterization. There will be discrepancies between the

predicted and observed descent and drift rates if the actual falling attitude is different than the

falling attitude that was modeled. As such, the flight test will not serve as validation, because the

model is inaccurate.

Table D-2 - Flight Test Instrumentation Requirements

Parameter Minimum Sampling

Rate

Remarks

Time 5 Hz

Altitude 5 Hz Must be timestamped

Vz 5 Hz Must be timestamped

Vx 5 Hz Must be timestamped

Vy 5 Hz Must be timestamped

Roll 5 Hz Must be timestamped

Pitch 5 Hz Must be timestamped

Yaw 5 Hz Must be timestamped

The terminal velocity, which can generally be reached in approximately 200 ft of falling for a

multi-rotor aircraft, is used to calculated the effective flat plate drag of the vehicle. Operators

will have to conduct several vertical drop tests to ensure consistency and verification of the

terminal velocity value. Flat plate drag area is calculated, from terminal velocity, by the

following relationship:

𝑓 =2𝑚𝑔

𝜌𝑉𝑡𝑒𝑟𝑚2 Equation D - 5

Flight test data will be post-processed in order to determine the vehicle’s vertical and lateral

displacement based on time. The ballistic modeling will be validated by comparing the predicted

vehicle trajectory for a given failure flight condition, in terms of failure horizontal velocity and

altitude, with the observed trajectory from flight test. The flight test trajectory can be developed

directly from altitude and drift recorded by the data logger or calculated based on the vehicle’s

instantaneous velocity at each time step and the interval between time steps. The vertical

displacement at any time step, based on the latter method, is calculated by:

𝑧 = 𝑧𝑖 + 𝑉𝑧∆𝑡 Equation D - 6

D-8

where zi is the initial altitude and Δt is the interval between altitude samples in the data logger.

The horizontal displacement is calculated at any time step by:

𝑥 = 𝑥𝑖 + 𝑉ℎ∆𝑡 Equation D - 7

where Vh is the resultant velocity vector based on the vehicle’s x and y velocities during the fall.

In this analysis, the point where motor power is cut off is treated as x = 0. Figure 3 provides an

example of comparing predicted and actual post-failure trajectories.

D.6. Vehicle Ballistic Analysis/Characterization

The vehicle ballistic characterization provides estimated impact KE values for the UAS based on

combinations of failure altitude and airspeed. The characterization also provides estimated

impact angles for the aircraft. Examples of these outputs are provided in Figures C – 5, C – 6, C

– 19, and C – 20 in Appendix A – UAH Part 107 Waiver Submission for Flight Over People.

This is purely a ballistic modeling effort that assumes a constant vehicle attitude during descent,

full loss of propulsion, and failure in a level attitude with no representation of vehicle dynamics.

It represents a failure scenario in which the vehicle falls as an inert mass. Basic characterization

of the vehicle should be conducted to produce impact KE values based on failure under SSL

conditions. If operators expect to conduct operations under unique conditions, i.e. high and hot

conditions, the simulation inputs should represent those conditions to determine worst case

impact KE values. The failure altitude and velocity combinations used in the ballistic

characterization should reflect the operators full desired operating envelope, which will be

related to the accompanying waiver CONOPS.

D.7. Injury Mitigations

Waiver applicants must develop, validate, and apply mitigations to all identifiable categories of

human injury that can result from malfunction of their aircraft during missions conducted under a

waiver to Part 107 operating restrictions. The known injury types inherent to sUAS collision

with a person, per the Project A4 White Paper on UAS Characteristics are blunt trauma,

penetrating injuries, and laceration injuries. Mitigations can be in the form of operational

restrictions, e.g. operating height-velocity limits to minimize impact energy, or design

modifications like shrouds, guards, or padding to minimize the most likely means of causing

penetration or laceration injuries, or any other means that an applicant can devise.

Waiver applications will contain data and analysis that validates the effectiveness of applied

mitigations and the correctness of any engineering assumptions, for example, assumed energy

transfer values during sUAS collision with a person. Validation may take the form of safety case

analysis based on the CONOPS and flight test data and/or ballistic modeling. It can also come

from experimental work, for example, impact testing of blade guards to measure resilience and

determine residual injury risk. All analytical modeling efforts require some form of

experimental validation. Design mitigations and operational limits will be tested and revised, as

D-9

needed, until appropriate levels of safety are reached, e.g. reducing blunt trauma injury severity

to a 30% or less than of AIS-3 or greater severity of injury. It is important to emphasize that data

from experiments and modeling should provide the FAA with an understanding of the residual

risk after the mitigation is applied. Information about the residual risk feeds both the waiver

applicant’s Operational Risk Assessment process and document and allows the FAA to make

clear determinations of acceptable operations and mitigations on a case-by-case basis. The

absence of identified residual risk will likely hinder FAA evaluation of the waiver package.

D.8. Injury Analysis

Blunt Trauma Injuries

The applicant would determine the resultant load for head and neck injuries using the following

equation.

𝑅𝑒𝑠𝑢𝑙𝑡𝑎𝑛𝑡 𝐿𝑜𝑎𝑑 𝐹𝑎𝑐𝑡𝑜𝑟 (𝑔) = 1.5441 ∗ 𝑖𝑚𝑝𝑎𝑐𝑡 𝐾𝐸 (𝑓𝑡 − 𝑙𝑏𝑠) Equation D - 8

The impact KE is derived from the ballistic analysis for the vehicle configuration under

evaluation, and the resultant load factor is calculated. As long as the resultant load factor remains

below 196 g, then there is a 98% confidence that no skull fractures will occur and there will be

less than 30% probability of having a neck injury exceed AIS3 or greater. The limit of this

analysis is for multi-rotor vehicles made with plastic, flexible structures. The analysis applies to

blunt force trauma type injuries. Laceration and penetration injuries must be addressed

separately.

Penetrating Injuries

Penetration injuries can be assessed against impact KEs and the contact areas that may result

during collision events to identify local areas of focused energy. Energy densities of components

that exceed 57 ft-lbs/in2 (12 lbs/cm2) should be addressed to reduce injury potential. These

values should not be used as reasons for rejecting the applicant’s request. Landing gear,

payloads and blade guards are potential sources of penetrating injuries. Landing gear and blade

guards are typically flexible and absorb energy that reduce energy density when compared with

straight calculations of impact energy divided by the contact areas. Payloads typically have

frangible fittings or mounts that cause the payload to break away under load or absorb some of

the energy and reduce the energy density during collision. For these reasons, the energy density

standards cannot be applied as a rigid test, but analyzed to determine how sufficiently the

mitigation has reduced the hazard relative to the impact energies and the collision orientations

identified by the applicant.

Laceration Injuries

Laceration injuries are the result of blade contact with unprotected skin. Even light clothing can

mitigate laceration injuries to some degree. Multiple blade contacts with unprotected skin and

D-10

deep penetration injuries greater than ½ inch cause the most severe injuries. Small lacerations to

the head can cause more substantial bleeding while lacerations to the neck area are the most

severe especially when the carotid artery is involved. Laceration injuries that result in injuries of

AIS3 or greater involve more than 20% loss of blood by volume or involve bilateral lacerations

to arteries such as the carotid artery during a single collision. Blade guards create the simplest

and most effective form of mitigation to laceration injuries when the blade guards are capable of

sustaining impacts at the impact velocities identified within the height-velocity diagrams without

allowing only momentary penetration into the cutting area by less than ½ inch before rebounding

the vehicle away from the person. Blade guards also create collision geometries with other parts

of the vehicle that prevent the vehicle from reaching small areas such as the neck when

descending at steep angles. For flight over people waivers, the applicant should show how the

blade guards function under collision velocities to minimize intrusion into the cutting area by

less than ½ in as long as they rebound the vehicle away from the person. Furthermore, blade

guards may be designed to intrude into the blade area causing blade stoppage during the

collision, and the applicant should show how the blade guards operate at a variety of impact

angles and collision velocities within the operating envelope. The applicant should also show

how blade guards may mitigate access to the thorax/neck area as these areas are the most

vulnerable to laceration injuries. These mitigations are deemed as acceptable since they mitigate

the majority of AIS 3 or greater laceration injuries that blades can induce following a collision.

Blade guards will always be limited in performance due to weight and drag. As such, failure of

the blade guards during testing should not be a reason for rejecting the mitigation as long as the

vehicle rebounds away from the person during the collision when the blade guard fails. Blade

guards should survive multiple contacts when the CONOPS requires flight over a densely

populated operation over people and there are no other mitigations for blade stoppage following

the first collision since the vehicle can rebound from one individual and contact another under

these type scenarios.

D.9. Operational Risk Assessment (ORA)

The operational risk assessment is beyond the scope of this report, but the operational risk

assessment should define the failure scenarios, associated severity of the hazard resulting from

the failure and the appropriate mitigations used to mitigate the hazard. Of particular importance

for this effort is for the applicant to review the vehicle configuration for potential blunt force

trauma, penetration injuries and laceration injuries that this vehicle configuration might cause

during a collision scenario with a non-participant or a participant for that matter. Blunt force

trauma is related to the impact KE, and mitigations are related to how the impact KE is reduced

prior to collision or during the collision due to absorption by the vehicle or frangibility of the

vehicle. Penetration injuries are focused on sharp edges of the vehicle other than rotating

components or small contact areas where the impact KE may become concentrated in a single

area. Laceration injuries are related to impacts by rotating blades caused by rotors or propellers.

D-11

These laceration injuries are isolated from lacerations that might occur from penetration injuries

of non-rotating components since their mitigations are uniquely different.

The identification of these mitigations are important to identify early as many of the proposed

mitigations can have an impact on flat plate drag area and the ultimate vehicle configuration.

An example ORA is contained in the waiver request contained in Appendix A. More research is

required to develop a comprehensive ORA for UAS operations in general so one is not provided

as part of this report. Many of the hazards identified in the ORA contained in Appendix A are

common hazards to most UAS operations and may support the development of future ORAs

until a comprehensive example can be developed. The ASSURE Team has proposed developing

a comprehensive ORA outline for UAS operations.

The applicant will coordinate with the FAA to reach consensus on the level of residual risk

inherent to the operations covered by the waiver application.