Certification of new technologies

The Petrel 19 has been a test of the airworthiness system's ability to handle something new. Its hybrid powertrain did not fit the standards written for fuel-burning engines, and every lesson in this course has met that problem from a different direction: the certification basis needed special conditions, the safety assessment found common causes in the electrical bus, the maintenance program needed new tasks for batteries and wiring, the technicians needed new training, and the first directive and the serious incident both came from power electronics and cells. This final lesson looks at how authorities certify new technologies in general, with batteries as the main example, then at the wider wave of new aircraft types, and closes with a review of the whole course.

Why new technology is hard to certify

Airworthiness standards are distilled experience. Most requirements exist because an accident or a near miss showed that something mattered. That makes the standards reliable for conventional designs and incomplete for new ones. A new technology may introduce failure modes that the standards never contemplated, such as thermal runaway propagating from one cell to its neighbours, or may make existing requirements meaningless, such as a fuel quantity requirement for an aircraft that also stores energy in a battery. It may also lack the service history that lets engineers and authorities judge which analyses can be trusted.

Authorities respond in a common sequence. First, they use the existing standards wherever they apply. Second, they write special conditions for the novel features, as Lesson 4 described, often reusing language from other authorities. Third, as several applicants work on similar technologies, they generalize the special conditions into published policy or consensus standards. Finally, once enough experience exists, the requirements are written into the standards themselves. Each step makes the next applicant's work easier, which is why early applicants carry the heaviest certification burden.

Batteries

Lithium-ion batteries store energy densely, which is why they are attractive for propulsion, and that same density makes their failure hazardous. A cell with an internal short can heat itself until its electrolyte decomposes, releasing flammable and toxic gas and enough heat to drive adjacent cells into the same state. This chain is thermal runaway propagation. Battery events on transport aeroplanes in the 2010s, in which main and auxiliary batteries vented and in one case caught fire, led authorities to strengthen requirements for battery installations and to insist on demonstrating containment by test.

The usual requirements for a propulsion battery installation include: no propagation of thermal runaway from one cell to others, or containment of any propagation within the battery; no hazardous quantity of gas, smoke or flammable fluid reaching the occupants; protection against overcharge, overdischarge and short circuit; monitoring of temperature, voltage and state of health; and crashworthiness. Equipment standards such as RTCA DO-311A, the minimum operational performance standard for rechargeable lithium batteries, provide test methods, including tests where a cell is deliberately driven into runaway.

Teresa Nakamura's team uses a simple model to size the thermal barrier between cells before the formal tests. The code below estimates whether runaway in one cell would drive an adjacent cell to its runaway onset temperature, and how much gas must be managed.

# Battery thermal runaway containment check (illustrative special condition test logic):
# a single cell in runaway must not propagate, and the enclosure must stay below limits.
cell_energy_kJ = 48.0        # heat released by one cell in runaway
adj_mass_g = 70.0; cp = 1.0       # J/(g K)
barrier_fraction = 0.12      # fraction of heat reaching each adjacent cell through the barrier
n_adjacent_cells = 4
T0, T_onset = 35.0, 160.0    # C: initial temperature, onset of runaway in an adjacent cell
dT = barrier_fraction * cell_energy_kJ * 1000 / (adj_mass_g * cp)
print(f"adjacent cell temperature rise {dT:.0f} K -> peak {T0 + dT:.0f} C (onset {T_onset:.0f} C)")
print("propagation:", 'none expected' if T0 + dT < T_onset else 'likely')
vent_gas_L_per_Wh = 0.6; cell_Wh = 18.0
gas = vent_gas_L_per_Wh * cell_Wh
box_free_L = 85.0
print(f"vent gas from one cell about {gas:.0f} L into {box_free_L:.0f} L of free volume: must be ducted overboard")
margin = (T_onset - (T0 + dT)) / T_onset
print(f"temperature margin {margin:.0%}")

adjacent cell temperature rise 82 K -> peak 117 C (onset 160 C)
propagation: none expected
vent gas from one cell about 11 L into 85 L of free volume: must be ducted overboard
temperature margin 27%

With 12 percent of the failed cell's energy reaching each adjacent cell through the barrier, the adjacent cell rises by 82 kelvin to a peak of 117 degrees Celsius, below the 160-degree onset temperature, so no propagation is expected. The temperature margin is 27 percent. The vent gas, about 11 litres from one cell, is too much for an 85-litre free volume to absorb safely, so it must be ducted overboard through a dedicated vent. The model is only a screening tool. The certification test, a cell deliberately triggered into runaway in a production-standard module at the most adverse temperature, is the evidence. The serious incident in Lesson 11 showed both parts working: containment held and the vent carried the gas overboard.

Electric and hybrid propulsion

Electric propulsion units, combining motors, inverters and controllers, do not fit engine standards written for turbines and pistons. Concepts such as rated power, overspeed, fire zones and endurance testing need to be reinterpreted. The European Union Aviation Safety Agency published Special Condition SC E-19 for electric and hybrid propulsion systems in April 2021, defining requirements and test approaches for electric engines, and at least one electric motor has since been certified against it. The FAA has issued special conditions for individual electric engines under its engine standard. These documents give later applicants such as Borealis Aerospace a starting point, and their alignment across authorities eases validation.

Hybrid systems add another layer: the interaction between power sources. The Petrel 19's power management software decides at every moment how much power comes from the turbogenerator and how much from the battery, and must handle the failure of either. Its safety assessment, development assurance and integration testing are among the largest work packages in the program. Authorities increasingly view such software as a primary flight-critical system, comparable to flight control software, and apply the same rigour.

New categories of aircraft

Beyond hybrid commuter aircraft, a wave of new vehicles is reaching certification: electric vertical takeoff and landing aircraft for short urban and regional flights, hydrogen-fuelled aircraft, and aircraft with increasing levels of automation. Some do not fit any existing category. Vertical takeoff aircraft that use rotors for lift and wings for cruise are neither aeroplanes nor helicopters.

Authorities have taken different approaches. The European Union Aviation Safety Agency published a special condition for small vertical takeoff and landing aircraft in 2019, defining a new category with its own requirements. The FAA decided to type certificate powered-lift aircraft as a special class, with a certification basis assembled from aeroplane and rotorcraft standards plus specific requirements, and in late 2024 adopted Special Federal Aviation Regulation No. 120 to allow pilot certification and operations of powered-lift for an interim period of ten years. TCCA has been working with both and with industry on its own approach, and validation of such designs under the bilateral agreements will rely heavily on alignment among the authorities.

Hydrogen raises its own set of questions: cryogenic or high-pressure storage, leak detection, the behaviour of hydrogen fires, and refuelling at airports. Automation raises questions about how to show that software making decisions previously made by pilots is safe, especially where it uses machine learning whose behaviour is hard to verify by traditional methods. In each case, the same tools apply: special conditions, consensus standards, early engagement with the authority and evidence from test.

Engaging the authority early

The single most useful practice for certifying new technology is early and continuous engagement with the authority. Rachel Oduya began briefing TCCA on the Petrel 19's powertrain two years before the formal application, and invited the FAA to the same meetings. Both authorities assigned specialists who followed the design from concept, so that the special conditions reflected the actual design and the test plans were agreed before hardware existed. Surprises, which are the main cause of delay in certifying new technology, were found in conference rooms rather than in test cells.

Early engagement also lets the authority build its own competence. Authorities cannot certify technologies they do not understand, and the people with the deepest knowledge of a new technology usually work for the companies developing it. Joint research programs, workshops, secondments and consensus standards committees all help to transfer that knowledge. Rachel, who once sat on the authority's side, knows that the authority's engineers are not obstacles but partners with a different responsibility, and treats them that way.

Course review

The course has followed one aircraft from the first question about airworthiness to its fourth year in service. Its key ideas form a single chain. Airworthiness means conforming to an approved design and being in a condition for safe operation. The rules come from national authorities working within the ICAO framework, with delegation to qualified industry engineers and bilateral agreements between states. A type certificate approves a design against a certification basis, which for new technology includes special conditions. Safety assessment sets probability targets by severity, and common causes dominate redundant systems. Production approval ensures that every aircraft built conforms to the design.

In service, continued airworthiness compares experience with the certification predictions. Maintenance programs built with MSG-3 preserve inherent reliability, and licensed technicians certify each task. Service bulletins and airworthiness directives correct problems, with directives reserved for unsafe conditions. Safety management systems let organizations find and control their own risks. Independent investigations find out what went wrong and feed lessons back to design, production, maintenance and the rules. The system works only when all of these parts work together, and when the people in them speak up.

Arjun, who started the course building a compliance checklist, now leads the certification work for the Petrel 19 stretch. His first act is to read every service difficulty report, directive, investigation report and reliability review from the first four years of the fleet, and to list the lessons for the new design. The list is long. It includes thermal cycling profiles, connector locking, supplier change notification, high-voltage training, contaminated gravel performance and regenerative descent behaviour. None of these were in the original certification basis. All of them will be in the next one, either as requirements or as better design.