Airworthiness and the regulatory system

The Petrel 19 exists on paper. Aircraft Design took it from a list of requirements to a sized, balanced, costed configuration: a 19-seat high-wing commuter with a series-hybrid powertrain, two 700 kW electric motors, a turboshaft generator and a 400 kg battery, designed to fly the short gravel-strip routes around Bethel and the Yukon-Kuskokwim villages of western Alaska. The design review chaired by Dr. Teresa Nakamura ended with a decision to proceed. Now Élise Fournier, the program chief engineer at Prairiewind Aerospace in Wichita, faces a question that no wind tunnel can answer. How does a company prove to a government that a new aircraft is safe enough to carry paying passengers, and how does it keep proving that for the thirty years each airframe will fly?

That question is the subject of this course. Élise has hired a certification manager, Rachel Oduya, who spent twelve years on the other side of the table as an engineer with the Federal Aviation Administration (FAA). Arjun Mehta, the engineer-in-training who ran the sizing studies, joins Rachel's group as a certification engineer. Over the twelve lessons we follow the Petrel 19 from the first meeting with the authority to the type certificate, into production, into service with a launch customer, Kuskokwim Air Link, and through the maintenance, defects, directives and safety reporting that fill an aircraft's working life.

What airworthiness means

An aircraft is airworthy when it conforms to its approved type design and is in a condition for safe operation. Both halves matter. Conformity means the aircraft is built and maintained exactly as the design the authority approved: the same parts, materials, dimensions, software versions and modifications, and nothing else. Condition for safe operation means that wear, damage, corrosion and deferred defects are within the limits the design allows. A brand-new aircraft with an unapproved part fitted fails the first test. A perfectly conforming aircraft with a cracked fitting fails the second.

Airworthiness is therefore not a property the designer achieves once. It is a state that the designer, the manufacturer, the operator, the maintenance organization and every certifying technician maintain together, day after day. The regulatory system exists to assign each of those parties a clear duty and to give the public a way to check that the duty is being done.

The international framework

Civil aviation regulation is national, but it rests on an international treaty. The Convention on International Civil Aviation, signed in Chicago in 1944, created the International Civil Aviation Organization (ICAO) and committed the signatory states to common standards. ICAO publishes those standards as annexes to the Convention. Annex 8, Airworthiness of Aircraft, sets out the duties of states for type certification, production and continuing airworthiness. Annex 6 covers the operation of aircraft, Annex 1 personnel licensing, Annex 13 accident investigation and Annex 19 safety management. A state that cannot meet a standard must file a difference with ICAO.

Annex 8 gives states three roles. The state of design approves the type design and is responsible for its continuing airworthiness. The state of manufacture oversees production. The state of registry issues each aircraft's certificate of airworthiness and oversees its operation and maintenance. For the Petrel 19 the first two roles belong to the FAA, because the aircraft is designed and built in Kansas. When an operator in another country registers a Petrel 19, its own authority becomes the state of registry for that aircraft and relies on the information the state of design provides.

The chain of approvals

The duties of design, production and operation each lead to a certificate. Rachel draws the chain on the whiteboard at the first project meeting, because every later lesson hangs on one link of it.

A type certificate approves the design. It is issued once for the aircraft type, with a type certificate data sheet that lists the models, engines or motors, limits and the certification basis. A production approval, called a production certificate in some systems and a manufacturer approval in others, approves the manufacturer's quality system so that each aircraft built can be shown to conform to the type design. A certificate of airworthiness is issued to each individual aircraft, by serial number and registration, when it is shown to conform and to be in a condition for safe operation. Finally, after every maintenance task, a qualified person signs that the work was done correctly and the aircraft is fit to return to service, a signature called a maintenance release on the Canadian site and a return to service on the US site.

The chain explains why airworthiness is fragile. If the type design is later found unsafe, the authority issues an airworthiness directive and every aircraft must be corrected before further flight or within a set time. If the factory builds an aircraft that does not conform, its certificate of airworthiness is not valid. If a mechanic signs for work that was not done, the aircraft is not airworthy even though it looks perfect.

Rules, standards and guidance

Regulations come in layers. At the top are the rules that have legal force: they say what must be achieved and who must achieve it. Below them are the airworthiness standards a design must meet, such as the requirements for a normal category airplane in 14 CFR Part 23 at certification level 4. Below those sit advisory material and industry consensus standards, which describe acceptable ways to show compliance. An advisory circular is not law; an applicant may propose another means, but must then convince the authority it gives an equivalent level of safety.

Modern small-aircraft standards are written as performance objectives. Instead of specifying, for example, the exact stall speed test procedure, the rule states the safety outcome required, and accepted means of compliance, often published by ASTM International committee F44, give the detailed method. This lets the standards keep pace with new technology such as electric propulsion, a point that becomes central in Lesson 12.

Who holds the duty

The regulations place each duty on a named party. The holder of the type certificate must report failures, investigate service difficulties and design fixes. The production approval holder must build to the design and control suppliers. The operator must use the aircraft within its limits and keep it maintained to an approved program. The maintenance organization and each licensed technician must do the work correctly and record it. The authority's job is to set the rules, approve, audit and enforce. It does not carry the duty for the industry; it checks that the industry carries it.

Rachel's first task for Arjun is to build a compliance checklist: every requirement in the certification basis, the discipline responsible, the means of compliance and its status. The program will live and die by that list. The code below summarizes the checklist at the end of the first year of the project.

# Petrel 19 certification: how far along is the compliance checklist?
# Each requirement has a status; the program tracks coverage by discipline.
reqs = {
    'structures':      {'total': 96, 'planned': 96, 'shown': 41, 'accepted': 27},
    'flight':          {'total': 58, 'planned': 55, 'shown': 12, 'accepted': 6},
    'powerplant':      {'total': 71, 'planned': 64, 'shown': 18, 'accepted': 9},
    'systems':         {'total': 88, 'planned': 85, 'shown': 30, 'accepted': 17},
    'crashworthiness': {'total': 24, 'planned': 24, 'shown': 10, 'accepted': 8},
}
tot = {k: sum(d[k] for d in reqs.values()) for k in ('total', 'planned', 'shown', 'accepted')}
print(f"{'discipline':16s} {'planned':>8s} {'shown':>7s} {'accepted':>9s}")
for name, d in reqs.items():
    print(f"{name:16s} {d['planned']/d['total']:8.0%} {d['shown']/d['total']:7.0%} {d['accepted']/d['total']:9.0%}")
print(f"{'all':16s} {tot['planned']/tot['total']:8.0%} {tot['shown']/tot['total']:7.0%} {tot['accepted']/tot['total']:9.0%}")
gap = [n for n, d in reqs.items() if d['planned'] < d['total']]
print("requirements with no agreed means of compliance yet:", sum(reqs[n]['total'] - reqs[n]['planned'] for n in gap), "in", ', '.join(gap))

discipline        planned   shown  accepted
structures           100%     43%       28%
flight                95%     21%       10%
powerplant            90%     25%       13%
systems               97%     34%       19%
crashworthiness      100%     42%       33%
all                   96%     33%       20%
requirements with no agreed means of compliance yet: 13 in flight, powerplant, systems

Coverage tells a story. Nearly every requirement has a planned means of compliance, but only a third have compliance shown and a fifth have been accepted by the authority. Thirteen requirements, mostly for the hybrid powertrain, still have no agreed method. Those gaps are not paperwork problems; they are the technical questions the authority has not seen answered before, and Lessons 4 and 12 return to them.

Why the system works the way it does

Aviation's regulatory system was built largely from accidents. Many standards can be traced to a specific failure: pressurized fuselage fatigue rules to the Comet accidents of the 1950s, damage tolerance requirements to later structural failures, and human factors rules to maintenance errors that caused crashes. This history explains two features of the system that newcomers find puzzling. First, it is conservative: a new technology must show it is at least as safe as what it replaces before it is accepted. Second, it is documentary: the record of what was done is treated as part of the safety of the aircraft, because a future investigator, mechanic or engineer must be able to rely on it.

The system also depends on trust between authorities. An aircraft certified by one state is validated by others rather than certified again from scratch, under bilateral agreements. Lesson 2 shows how the FAA and Transport Canada work together on the Petrel 19, which Kuskokwim Air Link's sister operators in the other country also intend to buy.

Airworthiness and the operator's view

For Kuskokwim Air Link, airworthiness is a daily operational question rather than a legal abstraction. Each morning, before the first departure from a gravel strip, the crew and the maintenance controller must know that the aircraft's records are complete, that every defect found the day before has been rectified or properly deferred under the minimum equipment list, that no directive or life limit has come due, and that the last maintenance signature covers the work done. Sam Littlechild, the test pilot, who has flown the operator's routes in a borrowed aircraft, warns the design team that a remote operator has no spare aircraft and no hangar at most stations. A design that needs special tools, frequent inspections or parts that cannot be shipped by scheduled cargo will spend days on the ground, and an aircraft that is grounded serves nobody. Designing for maintainability is therefore part of designing for airworthiness, a theme that returns in Lessons 6 to 9.