Certification basis and means of compliance

The certification basis is the list of requirements a design must meet. For most aircraft it is simply the applicable airworthiness standard at the amendment level in force on the date of application. The Petrel 19 is not most aircraft. Its normal category standard was written for aircraft with fuel tanks, piston or turbine engines and mechanical propeller controls; it says little about a 600-volt battery, electric motors or software that blends two power sources. This lesson shows how the FAA and Prairiewind Aerospace build a certification basis for a design that the standard did not foresee, and how the company then chooses the means by which it will show compliance with each requirement.

The building blocks of a basis

A certification basis has up to four kinds of component. The first is the applicable standard, 14 CFR Part 23 at certification level 4, at its amendment in force on the application date. The second is special conditions, additional requirements that the authority writes when the standard does not contain adequate or appropriate safety standards for a novel or unusual design feature. The third is equivalent level of safety findings, where the applicant does not meet a requirement literally but shows that the design provides an equivalent level of safety by other means. The fourth is exemptions, granted only where there is a public interest and the level of safety is not adversely affected, and used rarely in type certification.

Special conditions are rules in their own right. Under 14 CFR 21.16 the FAA issues them for a specific design, usually after publishing proposed special conditions in the Federal Register for comment, and once final they apply with the same force as the regulations. Because they are written for one design, they often draw on work already done elsewhere, such as the European Union Aviation Safety Agency's special condition for electric and hybrid propulsion, or on special conditions the FAA has issued for similar features. Reusing existing language saves time and supports validation by other authorities.

An equivalent level of safety finding is different. The requirement stays in the basis, but the authority accepts an alternative design. The applicant must explain what the requirement is trying to achieve and show that the alternative achieves it. For the Petrel 19, a requirement that the crew be able to see usable fuel quantity is meant to ensure that the crew knows how long the aircraft can stay airborne. Since endurance depends on both fuel and battery state of charge, the company proposes a single endurance display, backed by separate fuel and battery indications, and argues that it meets the intent better than fuel quantity alone.

Performance-based standards and consensus means

The current normal category standards are written as safety objectives rather than design rules. Instead of telling an applicant exactly how to size a stall warning margin or design a fuel system, they state what must be achieved, and leave the method to accepted means of compliance. Many of those means are consensus standards developed through ASTM International Committee F44 and accepted by the authorities, in whole or with exceptions. An applicant may also propose its own means, which the authority must accept before it is used.

The approach has a cost for an applicant like Prairiewind Aerospace: it must keep track of which means are accepted, at which revision, and with which exceptions. It has a benefit too. Because the objectives are general, they can accommodate new technologies without immediate rule changes; a battery can be made to meet an objective about preventing hazardous fires even though no rule mentions batteries. Much of the special condition work for the Petrel 19 is about defining how the general objectives apply to the hybrid powertrain.

Failure conditions and safety assessment

One of the most important requirements in any certification basis concerns equipment and systems. It requires that each system be designed so that the probability of a failure condition is inversely related to its severity: the worse the outcome, the less likely it must be. The method is a system safety assessment, starting with a functional hazard assessment that lists each aircraft function, how it could fail and what the effect would be.

The targets are averages per flight hour over the fleet. They are not guarantees that a given event will never happen, but they set a design discipline. Achieving 1e-9 for a catastrophic failure condition is only possible with redundancy: two or more independent paths, each far less reliable than the target, combined so that both must fail. That raises the critical question for every safety assessment, which is whether the redundant paths are truly independent.

Teresa Nakamura, who leads propulsion, presents the Petrel 19's propulsion architecture: two electric propulsion units, each with its own motor, inverter and propeller, fed by a common high-voltage bus that draws on the battery and the turbogenerator. The code below estimates the probability of several failure conditions using the failure rates the team has from suppliers.

# Failure condition classification and quantitative targets for the Petrel 19
# (a level 4 commuter). Targets follow the AC 23.1309-style table; checks are illustrative.
targets = {'minor': 1e-3, 'major': 1e-5, 'hazardous': 1e-7, 'catastrophic': 1e-9}
dal = {'minor': 'D', 'major': 'C', 'hazardous': 'B', 'catastrophic': 'A'}
def series(*p):        # any one failure causes the event
    q = 1.0
    for x in p: q *= (1 - x)
    return 1 - q
def parallel(*p):      # all must fail
    q = 1.0
    for x in p: q *= x
    return q
lam_bus = 2e-5; t_flt = 1.2   # per flight hour, average flight hours
p_bus = lam_bus * t_flt          # probability one power bus fails during a flight
common = 1e-10                   # common-cause term (shared controller software, installation)
cases = [
    ('uncommanded thrust asymmetry at takeoff', 'hazardous', series(3e-8, 2e-8)),
    ('loss of all propulsive power, independent only', 'catastrophic', parallel(p_bus, p_bus, 1e-4)),
    ('loss of all propulsive power, with common cause', 'catastrophic', parallel(p_bus, p_bus, 1e-4) + common),
    ('loss of primary flight displays', 'major', series(2e-6, 3e-6)),
]
for name, cls, p in cases:
    ok = 'meets' if p <= targets[cls] else 'fails'
    print(f"{name:48s} {cls:12s} {p:9.2e} /fh  target {targets[cls]:7.0e}  {ok}  DAL {dal[cls]}")

uncommanded thrust asymmetry at takeoff          hazardous     5.00e-08 /fh  target   1e-07  meets  DAL B
loss of all propulsive power, independent only   catastrophic  5.76e-14 /fh  target   1e-09  meets  DAL A
loss of all propulsive power, with common cause  catastrophic  1.00e-10 /fh  target   1e-09  meets  DAL A
loss of primary flight displays                  major         5.00e-06 /fh  target   1e-05  meets  DAL C

The first result shows how hazardous thrust asymmetry at takeoff is handled: a single-unit failure must be rare enough, and the aircraft must remain controllable with one unit failed, which the flight test program will demonstrate. The second and third results are the important lesson. If the two propulsion units were truly independent, the probability of losing both would be a vanishingly small 5.76e-14 per flight hour. Once a common cause such as a bus fault, a software error in the power management system or a battery fire is included, the probability rises to 1.00e-10. It still meets the 1e-09 target, but the common cause term now dominates the answer by more than three orders of magnitude.

That is typical. Redundancy makes random hardware failures negligible, and safety then depends on common causes. Safety assessment therefore includes common cause analysis: zonal safety analysis to find physical threats to separated systems in the same area, particular risk analysis for events such as rotor burst, tire burst, bird strike or battery thermal runaway, and common mode analysis for shared design, software, maintenance errors and environmental effects.

Development assurance

Probability targets work for hardware that fails randomly. Software and complex electronic hardware do not fail randomly; they do exactly what their design tells them, including any error the designers made. For these, authorities rely on development assurance: a disciplined process whose rigor depends on the severity of the failure conditions the item could cause. The levels run from A, the most rigorous, for items that could contribute to catastrophic failure conditions, to D for minor ones. Software is developed to RTCA DO-178C and complex electronic hardware to DO-254, and aircraft and system development processes follow SAE ARP4754B, with safety assessment methods in ARP4761A.

The Petrel 19's power management software can contribute to loss of all propulsive power, a catastrophic failure condition, so it is assigned level A unless an architecture with independent monitoring allows a lower level for some components. Level A means structural coverage analysis down to modified condition and decision coverage, independent verification and a demanding configuration management process. Kenji Watanabe, the division head, approves the extra cost, noting that the alternative, discovering a software defect in service, would be far more expensive.

Means of compliance

For every requirement, the certification plan states how compliance will be shown. The usual categories are a compliance statement or design review, calculation or analysis, safety assessment, laboratory test, ground test on the aircraft, flight test, inspection, simulation and equipment qualification. Many requirements are met by a combination. The choice is negotiated with the authority, and the agreed means becomes a commitment.

Good means of compliance are efficient and convincing. Analysis is cheap but must be validated, usually by test. Test is convincing but expensive and, for some conditions, dangerous or impossible; nobody deliberately fails both propulsion units at low altitude. Similarity to a previously certified design can avoid testing altogether, but only if the similarity is real and documented. For the Petrel 19's structure, which follows well-established practice, analysis supported by component tests is enough for most of the airframe. For the battery installation, there is no history, so the company plans extensive testing.

The equation summarizes the propulsion example: the probability of losing both units is the product of the independent failure probabilities, scaled by the exposure time over which a first failure can remain undetected, plus the common cause probability. Reducing exposure time, by checking each unit before every flight, reduces the first term; only better design, separation and assurance reduce the second.