Type certification

A type certificate is the authority's statement that a design meets the applicable airworthiness requirements and has no unsafe feature. It certifies the design, not any particular aircraft: every Petrel 19 that rolls out of the factory will rely on the same type certificate, and each will separately need a certificate of airworthiness showing that it conforms to that design. This lesson follows the Petrel 19 through the type certification process, from the first meeting with the FAA to the day the certificate is issued, and shows why most of the schedule risk lies in the early phases rather than in flight testing.

What the type certificate covers

The type design is defined by drawings and specifications that describe the configuration and the design features, information on dimensions, materials and processes needed to define the strength of the product, the airworthiness limitations section of the instructions for continued airworthiness, and any other data needed to determine, by comparison, the airworthiness of later products of the same type. That last clause matters: the type design must be complete enough that someone inspecting a production aircraft can tell whether it conforms. A design that exists only in the heads of its engineers cannot be certified.

The certificate itself is short. It names the holder, the model and the date. The substance is in the type certificate data sheet, which lists the certification basis, the engines and propellers, the operating limitations such as maximum weights and airspeeds, the approved seating, the center of gravity range and any special notes. Maintenance organizations, operators and other authorities consult the data sheet throughout the aircraft's life. Arjun is surprised to find how much of the Petrel 19's commercial value depends on a few numbers in that document, such as the maximum takeoff weight that determines payload on a cold day.

The phases of a type certification project

The FAA and industry describe type certification as five phases in their joint guide to product certification: conceptual design, requirements definition, compliance planning, implementation and post-certification. The names vary between documents, but the logic is shared by most authorities.

In the familiarization phase, the applicant explains what it intends to build and highlights anything novel. For the Petrel 19 that means the series hybrid powertrain, the high-voltage battery, the electric motors driving the propellers and the power management software that decides how much power comes from the turbogenerator and how much from the battery. The authority uses this briefing to assemble its project team and to decide where it will need to write special conditions.

The formal application fixes the date that determines the applicable standards. Under 14 CFR 21.17, the certification basis is generally the regulations in effect on the date of application, and the application for a Part 23 airplane is effective for three years, or five for a Part 25 airplane; if the type certificate is not issued in that time, the applicant must select a new application date and update to the later rules. The application, FAA Form 8110-12, also includes a description of the design.

Agreeing the certification basis is the first major milestone. The FAA records each significant certification question in an issue paper that states the problem, the FAA's position and the applicant's position, and works it until both agree. The issue paper on the certification basis itself is traditionally numbered G-1, and the Petrel 19 team uses that name for the milestone, as do many applicants in both countries.

Planning the work

The certification plan is the backbone of the project. It lists every requirement in the basis, the proposed means of compliance for each (analysis, ground test, flight test, inspection, similarity), the document that will show compliance, and who will make the finding: the authority itself or a delegate. Lesson 1's compliance checklist is the working version of this plan. The authority approves the plan, and changes to it are agreed rather than made unilaterally.

The plan also identifies the tests the authority wishes to witness. Before any test that will be used for credit, the test article must be shown to conform to the design that is being certified, because a test on a part that differs from the production design proves nothing about the production aircraft. Conformity inspections, carried out by the authority's inspectors or by delegated airworthiness inspectors, compare the article with its drawings and record any deviations. A deviation does not necessarily invalidate a test, but it must be assessed and accepted before the test is run.

Rachel assembles a schedule for the whole program, then asks Arjun to find its critical path, the chain of activities in which any delay delays the type certificate. The code below uses a standard critical path calculation on a simplified network.

# Critical path through the Petrel 19 type certification schedule (months).
tasks = {  # name: (duration, predecessors)
    'G1 basis agreed':        (6, []),
    'compliance plan':        (5, ['G1 basis agreed']),
    'detail design':          (14, ['G1 basis agreed']),
    'battery qualification':  (18, ['compliance plan']),
    'first article build':    (10, ['detail design']),
    'structural tests':       (12, ['first article build']),
    'ground tests':           (4, ['first article build', 'battery qualification']),
    'company flight test':    (9, ['ground tests']),
    'certification flights':  (6, ['company flight test', 'structural tests']),
    'type certificate':       (2, ['certification flights']),
}
es, ef = {}, {}
for t in tasks:  # listed in dependency order
    d, pre = tasks[t]; es[t] = max((ef[p] for p in pre), default=0); ef[t] = es[t] + d
end = max(ef.values()); lf, ls = {}, {}
for t in reversed(list(tasks)):
    succ = [s for s in tasks if t in tasks[s][1]]
    lf[t] = min((ls[s] for s in succ), default=end); ls[t] = lf[t] - tasks[t][0]
for t in tasks:
    fl = ls[t] - es[t]
    print(f"{t:22s} start {es[t]:3d}  finish {ef[t]:3d}  float {fl:2d}{'  critical' if fl == 0 else ''}")
print(f"type certificate at month {end}")

G1 basis agreed        start   0  finish   6  float  0  critical
compliance plan        start   6  finish  11  float  1
detail design          start   6  finish  20  float  0  critical
battery qualification  start  11  finish  29  float  1
first article build    start  20  finish  30  float  0  critical
structural tests       start  30  finish  42  float  1
ground tests           start  30  finish  34  float  0  critical
company flight test    start  34  finish  43  float  0  critical
certification flights  start  43  finish  49  float  0  critical
type certificate       start  49  finish  51  float  0  critical
type certificate at month 51

The result is sobering. The certificate is projected at month 51, and the critical path runs through the agreement of the certification basis, detail design, the first article build, ground tests, company and certification flight testing. Battery qualification and the structural test program have only one month of float each. Any surprise in the battery tests, for example a cell that propagates thermal runaway in a test that was expected to pass, would immediately push the certificate date out. Rachel therefore asks for the battery test program to start with an early development test, before the formal qualification, so that problems are found while there is still time to change the design.

Analysis, tests and findings

Most compliance is shown by analysis supported by test. Structural strength, for example, is shown by a finite element model of the airframe validated against static tests of major components and, for the wing, a full-scale test to ultimate load. Systems safety is shown by a safety assessment, covered in Lesson 4, supported by bench tests of equipment and integrated ground tests. Flight characteristics can only be shown in flight. Each finding of compliance is documented: the requirement, the data, the reasoning and the name of the person who made the finding.

Findings are not made in one batch at the end. As each compliance report is completed and accepted, the requirement is closed in the checklist. Rachel tracks three numbers each month: the fraction of requirements with an agreed means of compliance, the fraction with data submitted, and the fraction with findings made. The gap between the second and third numbers is the authority's backlog, and it is the most common place for schedules to slip.

Before the official flight tests, the FAA issues a type inspection authorization (TIA), which confirms that the aircraft conforms to the design, that the company's own flight testing is complete and that the aircraft is safe for the tests planned. FAA flight test pilots and engineers then fly the certification tests or witness them. They check performance, handling qualities, stalls, system failures and any special tests required by special conditions, such as a battery failure at a critical moment in the climb. The type inspection report records the results.

The authority's pilots also look at the aircraft as a working machine. Sam Littlechild, the company test pilot, prepares them for the Petrel 19's power lever, which commands total propulsive power regardless of whether it comes from the battery, the turbogenerator or both. The authority's pilots want to know what the crew sees when the power management system changes source, and whether a pilot under stress could misread the display. Their questions lead to a change in the cockpit display logic that the design team had not considered.

Issuing the certificate

When every requirement has a finding, every issue paper or equivalent document is closed, the flight manual is approved, and the instructions for continued airworthiness are acceptable, the authority issues the type certificate and the data sheet. The airworthiness limitations section, which contains mandatory life limits and inspections, must be approved as part of the type design. The rest of the instructions for continued airworthiness may still be completed later, but must be available before the first aircraft is delivered.

Issue of the certificate is not the end of the authority's interest. The holder now has continuing obligations: reporting failures, malfunctions and defects, developing corrective action when an unsafe condition is found, and keeping the instructions for continued airworthiness current. Lesson 6 covers these obligations. The certificate holder also controls changes to the type design; minor changes may be approved under the holder's own procedures, while major changes need authority approval, possibly with an updated certification basis.

Changes to type design

Few aircraft stay as certified. A customer may want a different interior, the company may introduce a higher maximum weight, or a supplier may change a part. Under 14 CFR 21.93, changes are classified as minor or major according to their effect on weight, balance, structural strength, reliability, operational characteristics and other characteristics affecting airworthiness. Major changes by the type certificate holder are approved as amendments to the type design; changes by others are approved through a supplemental type certificate under Subpart E. The changed product rule in 14 CFR 21.101 requires a significant change to comply with later regulations for the areas affected, unless an exception applies.

For the Petrel 19, Élise Fournier already knows the first major change: a stretched version with two more seats, planned for three years after entry into service. She asks Rachel to make sure the original certification is documented in a way that will let the stretch reuse as much as possible. That means clear records of which tests covered which configurations, and analyzes written so that a change in fuselage length can be traced through the loads, the weights and the systems without starting again.