Regulation: the FAA and ICAO

Every Tuesday morning, Prairiewind Aerospace's certification manager, Priya Raman, meets the chief engineer and the heads of each engineering group to review the certification plan. The Tern cannot carry a single paying passenger until the Federal Aviation Administration issues a type certificate stating that its design meets the airworthiness standards, and until each aircraft built receives an airworthiness certificate. Priya invites Arjun to the meeting so he can see how much of the engineering work exists to show compliance with rules. This lesson explains who makes those rules, how they fit together internationally and how an aircraft gets certified.

ICAO and the international framework

Aviation crosses borders constantly, so its rules must fit together. The foundation is the Convention on International Civil Aviation, signed in Chicago in 1944 and usually called the Chicago Convention. It created the International Civil Aviation Organization (ICAO), a United Nations agency headquartered in Montréal. ICAO does not certify aircraft or write national law. Instead, its member states agree on Standards and Recommended Practices (SARPs), published in 19 annexes to the Convention, and each state writes national regulations that implement them. States must notify ICAO of any differences between their rules and the standards.

Under the Convention, the state where an aircraft is registered is responsible for its airworthiness, and the state where it was designed issues the original type certificate. Other states usually validate that certificate rather than certifying the aircraft from scratch, under bilateral agreements between aviation authorities. These agreements let an aircraft certified in one country be accepted in another after a review focused on differences, which is essential for a small company hoping to sell abroad. ICAO also audits each member state's safety oversight system to make sure national authorities are doing their job.

The Federal Aviation Administration

In the United States, Congress gives the Federal Aviation Administration (FAA) authority over civil aviation safety, airspace and air traffic control. Its rules are Title 14 of the Code of Federal Regulations (14 CFR), organized in parts. Part 21 sets certification procedures for products and parts; Part 23 the airworthiness standards for normal-category airplanes; Part 25 for transport-category airplanes; Parts 27 and 29 for rotorcraft; Part 33 for engines and Part 35 for propellers. Operating rules include Part 91 for general operations, Part 135 for commuter and on-demand operations and Part 121 for airlines, while Part 107 covers small drones.

A Tern operator flying scheduled passenger service with nine seats would operate under Part 135, which covers commuter and on-demand operations with aircraft of up to nine passenger seats in scheduled service, as well as larger aircraft in on-demand charter. Part 121 applies to larger scheduled airline operations. Each set of rules has its own requirements for pilot experience, maintenance programs and safety management.

Accident investigation is separated from regulation so that investigators can criticize regulators if necessary. Their purpose is to find causes and recommend safety improvements, not to assign blame.

In the United States this is the job of the National Transportation Safety Board (NTSB), an independent agency that investigates aviation, highway, rail, marine and pipeline accidents.

Airworthiness standards

Airworthiness standards say what a design must achieve. For small aircraft, both Canadian and US standards have shifted over the past decade from prescriptive rules, which said exactly how to design a feature, to performance-based rules, which state the safety outcome required and accept industry consensus standards as one way to show compliance. This change, introduced by the FAA's 2017 rewrite of Part 23 and closely followed in Canada, was meant to reduce the cost of certifying small aircraft and make it easier to introduce new technology such as electric propulsion and simplified flight controls.

The standards cover every aspect of the aircraft: flight performance and handling qualities, structural loads and strength, design and construction, powerplant installation, equipment and systems, and the operating limitations and information given to pilots. Under the performance-based approach, normal-category aircraft are grouped by seating capacity into certification levels, from one seat up to 19 passenger seats, and by performance into low-speed and high-speed groups. Higher levels and speeds face stricter requirements. The Tern, with nine passenger seats and two crew, falls in the level for 7 to 9 passengers.

How type certification works

Certification begins with an application and a series of familiarization meetings in which the company explains its design to the regulator. The two agree on a certification basis: the specific standards, at specific amendment levels, that the design must meet. For new technologies not covered by existing standards, such as the Tern's electric motors and high-voltage battery, the regulator issues special conditions that add requirements tailored to the new feature, for example on battery fire containment or motor overspeed protection. The applicant then writes a certification plan listing every requirement and the method of compliance for each: analysis, ground test, flight test, inspection or similarity to an approved design.

The bulk of the work is generating and presenting evidence: stress reports, wind-tunnel and simulation results, system safety assessments, software and hardware assurance data, material and process specifications, ground tests of structures and systems, and finally flight tests that demonstrate performance and handling across the envelope. Regulators or their delegates review documents and witness key tests. When every requirement has a finding of compliance, the regulator issues the type certificate, along with a type certificate data sheet listing the approved configuration and limitations. The whole process for a new commuter aircraft typically takes several years and costs far more than many first-time companies expect.

The FAA delegates much of this work. Designated engineering representatives (DERs) approve specific technical data, and larger companies hold an organization designation authorization (ODA) that lets them make certain findings on the FAA's behalf under its oversight. After the 737 MAX accidents in 2018 and 2019, Congress passed the Aircraft Certification, Safety, and Accountability Act in 2020, which strengthened FAA oversight of delegated organizations.

System safety and assurance

Modern aircraft rely on electrical, electronic and software systems whose failures could be dangerous. Regulators require a system safety assessment that identifies every failure condition, classifies its severity, and shows that its probability is acceptably low. Failure conditions range from minor, which slightly reduce safety margins, through major and hazardous to catastrophic, which would prevent continued safe flight and landing. The more severe the effect, the less likely the failure must be. For large transport aircraft, catastrophic failure conditions must be extremely improbable, typically less than one in a billion per flight hour; requirements for smaller aircraft are scaled by class. No single failure may lead to a catastrophic event, regardless of its probability.

Software cannot be tested exhaustively, so regulators rely on development assurance: showing that software and complex electronic hardware were developed with disciplined processes for requirements, design, coding, verification and configuration control, scaled to the severity of the failure they could cause. The industry guidance documents DO-178C for software and DO-254 for electronic hardware are accepted by both authorities, together with system-level guidance for aircraft development and safety assessment. Flight control and engine control software usually sits at the highest assurance levels and can cost far more to develop than ordinary commercial software.

# Which rules apply? A simplified sorter for the Prairiewind program (teaching aid, US rules)
def category(kind, mass_kg, passengers=0, bvlos=False):
    lb = mass_kg / 0.4536
    if kind == "drone":
        if lb < 0.55:
            return "under 0.55 lb: no registration for recreational flying"
        if lb < 55:
            band = "small UAS: Part 107 remote pilot certificate and registration"
        else:
            return "55 lb or more: section 44807 exemption or airworthiness certificate"
        if bvlos:
            band += "; beyond visual line of sight needs a waiver until Part 108 takes effect"
        return band
    if passengers <= 19 and lb <= 19000:
        return "normal-category airplane (14 CFR Part 23)"
    return "transport-category airplane (14 CFR Part 25)"

cases = [("drone", 0.2), ("drone", 24, 0, True), ("drone", 120), ("airplane", 6500, 9), ("airplane", 21000, 50)]
for c in cases:
    print(f"{str(c):<28} -> {category(*c)}")

('drone', 0.2)               -> under 0.55 lb: no registration for recreational flying
('drone', 24, 0, True)       -> small UAS: Part 107 remote pilot certificate and registration; beyond visual line of sight needs a waiver until Part 108 takes effect
('drone', 120)               -> 55 lb or more: section 44807 exemption or airworthiness certificate
('airplane', 6500, 9)        -> normal-category airplane (14 CFR Part 23)
('airplane', 21000, 50)      -> transport-category airplane (14 CFR Part 25)

Production and continued airworthiness

A type certificate approves a design. Building copies of it requires a production approval, which shows that the manufacturer has a quality system able to produce aircraft that conform to the approved design. Each aircraft is then inspected and receives its own certificate of airworthiness. After that, the aircraft must be maintained according to an approved maintenance program by licensed personnel and organizations, and its owner must comply with airworthiness directives, mandatory instructions issued when the regulator finds an unsafe condition in a type of aircraft, engine, propeller or appliance.

Changes to a certified design need approval too. The type certificate holder can make changes under its own design approval, while third parties can modify aircraft under a supplemental type certificate, for example to install a new avionics system or convert an aircraft to cargo. Operators report service difficulties to the regulator and manufacturer, which feed back into airworthiness directives and design improvements. This closed loop of design, operation, reporting and correction is a major reason for aviation's safety record.

Safety management

Beyond meeting technical standards, aviation organizations are increasingly required to run safety management systems (SMS), as set out in ICAO Annex 19. An SMS is an organized way to identify hazards, assess and control risks, monitor safety performance, and continuously improve, with clear accountability at the top of the organization. Airlines have had SMS requirements for years, and design and manufacturing organizations are now following. For Prairiewind Aerospace, an SMS means that hazards found in testing, near-misses in the shop and lessons from other manufacturers' accidents are systematically recorded and acted on, rather than depending on individual memory.