EASA dropped big news on Monday, announcing a proposed special condition under which electric VTOL aircraft under 2000kg may be certified in the European Union. This is the most concrete pathway to certification from a major western regulator and is sure to be followed closely by the FAA (which tends to keep regulations in sync with Europe for the most part, and vice versa). I'll take a quick look at the updated rule and identify the novel issues raised. Several of the points are sure to be contentious, and I expect the public comment period to be quite lively.
Background: eVTOL and the existing rules
The rule departs from the latest revision of Europe's general aviation design regulations, known as CS-23 Amendment 5. This latest revision introduced major flexibility for manufacturers, which may now use industry consensus standards (such as those maintained by ASTM) to show compliance to performance-based standards. The old method involved showing compliance to prescriptive design rules, which were intended to result in the desired level of performance, but may not be the only way to meet performance goals. The CS-23 rewrite parallels the U.S. rewrite of the 14 CFR 23 general aviation rules.
However, as pointed out by the FAA and EASA, CS-23 / 14 CFR 23 do not contain enough material to assure the safety of electric VTOL vehicles. Notably, eVTOL aircraft rely on powered rotors for lift, but because they don't have a large main rotor, they are generally not capable of autorotating safely to the ground. Alternatively, in VTOL mode, they may not be able to glide to an forced landing on aerodynamic wing lift. Nevertheless, they may have redundancy sufficient to assure safety in the event of a system failure (e.g. a rotor/prop failure or a motor failure). Therefore, some additional requirements need to be added to the existing Part 23 rules.
Furthermore, eVTOL are potentially unique in that they may soon carry a very large volume of passengers on commercial flights. In the US and Europe, 14 CFR 25 / CS-25 govern the vast majority of passenger trips flown in commercial service, since economics favors using fewer, larger aircraft. Part 23 airplanes do carry commercial passengers, but generally not in large volumes. They are also frequently used in more sparsely populated areas -- think Cessna Caravans shuttling around people from village to village in Alaska.
The problem is that Part 23's system reliability requirements for small aircraft (1-6 passengers) are much less stringent than for Part 25 commercial transport aircraft. We see a much higher accident rate in the general aviation fleet. If we transfer those accident rates to hundreds of thousands of urban air mobility vehicles flying over urban areas, people on the ground are likely to get hurt, and public confidence in the eVTOL project will falter. Therefore, even though eVTOLs are small by weight and passenger count, a strong argument can be made that they deserve a higher level of design assurance than a typical Cessna.
The new special condition
The eVTOL Special Condition does a great job of addressing these shortcomings in the existing rules. It is basically a copy and paste of CS-23, and EASA was kind enough to highlight any changes. The vast majority of rules are left unchanged, or are changed except for minor terminology issues. However, there are some large changes to report.
Fundamentals
This rule applies to non-helicopter VTOL aircraft with MTOW < 2,000kg and carrying up to 5 passengers. Aircraft under this rule must be certified as one of the following:
- Category Basic (up to 5 passengers, no commercial operations, not designed for operation over congested areas)
- Category Enhanced (up to 5 passengers, commercial air transport operations and / or flight over congested areas)
EASA defines two key terms.
- Congested area means "in relation to a city, town or settlement, any area which is substantially used for residential, commercial or recreational purposes."
- Commercial air transport (CAT) means "aircraft operation to transport passengers, cargo or mail for remuneration or other valuable consideration."
Both of these definitions are quite expansive (at least, by their plain wording). The definition of commercial air transport, in particular, is broad enough to almost certainly encompass any foreseeable Uber-style UAM system. It may not be broad enough to include a private owner renting out their personal aircraft for pay as long as they aren't doing the flying.
There are important differences in the rules between the Basic and Enhanced categories.
What the new rule isn't
This proposed special condition is not a set of certification standards to allow unpiloted/autonomous manned aircraft. It is not the operational plan for getting hundreds or thousands of these aircraft to avoid each other in dense urban environments. The rule governs the design of the aircraft and its associated systems (except autonomy systems). As EASA says, this proposed rule is merely a first step on the roadmap towards UAM.
System safety requirements
The change that stuck out to me the most is the table with system failure rate requirements versus passenger count (AMC VTOL.2510). I've copied the table below for reference. A summarized definition of the terms is:
- Catastrophic - A failure condition which results in multiple fatalities (usually loss of the aircraft)
- Hazardous - A failure condition which results in very reduced safety margins, greatly increased crew workload, or a serious injury / fatality to a few passengers
- Major - Flight crew discomfort, significantly reduced safety margin, injury or distress to passengers
- Minor - Slight reduction in safety margin or increased crew workload that is well within their capability to manage
The current CS-23/14 CFR 23.1510 safety standards use the same probability vs. consequence table, but with different cutoff points for passenger count. ASTM F3061 and F3230 (the consensus standards in question) sets category breaks at 0 to 1, 2 to 6, 7 to 9, and 10 to 19 passengers and depends on whether the aircraft in question uses a single reciprocating engine, multiple engines, or turbine engines. The previous amendment level of the FAA rules had a weight-based breakdown as well.
Do you find that confusing? So did I, so I made this helpful chart for you making a direct comparison between the proposed special condition and the existing Part 23 rules.
The big news here is that commercial eVTOLs carrying just 1 passenger will need to meet the same level of safety as commuter airliners carrying 19 passengers.
I expect a lot of pushback from the startups about this in particular. On the other hand, if we have hundreds of thousands or millions of these things flying around in big cities, they need a high level of safety assurance to prevent a big risk to the public on the ground.
The good news for people interested in purchasing an eVTOL for personal use is that the barrier is a lot lower. A basic category vehicle needs a level of safety equivalent to a Cirrus. More safety is great, but it comes at a cost in both development and equipment capability that owners may not need. The bad news is that these aircraft won't normally be allowed to operate in congested areas, which rules out a lot of important use cases.
Fire protection
One of the biggest potential pitfalls in certifying electric aircraft is the as-yet poorly understood failure characteristics of battery packs. The well-publicized X-57 battery pack thermal runaway illustrates that even technically sophisticated teams can get the pack design wrong. The safety analysis for the X-57 includes battery fire as a critical hazard requiring mitigation since it may be unrecoverable for the pilot.
The proposed special condition requires designating "fire zones" and incorporating fire protection systems to ensure that a fire does not preclude a controlled emergency landing. Above and beyond the specific design requirements for fire prevention / suppression, the top-level probability of a catastrophic failure needs to consider thermal runaway as part of the chain of possible events.
Extinguishing lithium ion battery fires is notoriously difficult and has already (almost certainly) downed two freighter aircraft. Designing compliant aircraft with appropriate safety performance, especially commercial aircraft, will be extremely challenging. Even estimating the probability of thermal runaway per flight hour will be very challenging by itself.
Another requirement (2430a1) demands that fire in one battery (or any other component) not result in the release of stored energy in some other component. In other words, the battery packs need to be redundant electrically and physically separated enough that there is very little chance of a fire in one spreading to the other.
Foreign object threats
The special condition requires propulsion systems to account for "foreign object threats" specifically. I have often wondered about what will happen when a multirotor aircraft flies through a flock of birds. This type of common-cause failure sometimes produces failure conditions that are far outside the bounds of what the designers intended. For example, the Miracle on the Hudson involved an extremely rare dual engine failure as a result of a bird strike. Like fire protection, aircraft designers will need to incorporate this threat into their safety analysis, and the challenge will be much greater for Enhanced aircraft.
Additional requirements for Enhanced category
In addition to the most stringent top-level safety requirements, Enhanced (commercial / urban) category aircraft will need to demonstrate continued safe flight and landing after a "critical malfunction" of thrust / lift. Continued safe flight and landing is defined explicitly here and requires landing at an "operating site". In other words, a forced landing away from an operational vertiport is probably not good enough. This also means that ballistic recovery parachutes are not a sufficient design feature to comply with CSFL in the event of a critical failure. "Critical malfunction" wasn't previously a regulatory term I'm familiar with , but from the context we can occur that it is one or more "hazardous" failure scenarios of the propulsion system.
Enhanced aircraft will need some additional handbook data to be calculated (e.g. takeoff performance considering critical malfunction) as well as procedures / systems for monitoring structural health and system reliability. Bird strike protection is only required for Enhanced, but since the speeds will be fairly slow I don't think this will be a terribly difficult challenge.
Autonomy
The special condition is written to allow for forward compatibility with autonomy. Any design requirements specifically relating to the crew will be interpreted as not applicable if the crew is not part of the aircraft's intended operation.
Software
In the safety table from the proposed special condition, there are a number of references to FDAL (functional development assurance level). This refers to a specific set of software quality assurance procedures used by EASA and the FAA to ensure that there are as few errors as possible in flight critical software. The most stringent level, FDAL A, requires independent reviewers to confirm that software meets certain procedural and functional requirements. I'm not a software guy, but my understanding is that FDAL A is a lot more expensive than FDAL D and there's something of a continuum between them. It may not even be possible, with methods we know today, to certify black-box machine learning algorithms with these processes.
Requirements relaxed from CS-23
There are a few odds and ends missing from the special condition that simply don't apply to eVTOL aircraft, such as buffeting constraints and certain stall characteristics.
What Comes Next
This is "just" a proposal, and EASA is currently seeking public input. After the first round of public comment, EASA may propose a revised version for further comment, or the rule may become final. I am not an expert in EASA procedures, but for more information this is a good source on what comes next for this particular measure. It may be a long time before the final rule is published, but this is an important first step, and at the point where a regulator proposes a new rule, they're not likely to just drop it altogether based on public comment.
Conclusion
This proposed Special Condition is a big step forward toward eVTOL certification. I think the safety requirements will help ensure that the high level of safety that consumers have come to expect from commercial aviation will be maintained in the urban air mobility space. However, I wouldn't be surprised to see a lot of pushback, particularly on the stringent requirements for small, 0-2 passenger aircraft operated for profit or over congested areas. I'm not sure it's even possible at this point for any electric aircraft to meet the Enhanced safety requirements, since we know so little about how to design absolutely reliable battery packs. In the few thousand hours of total electric flight time so far, we have one fatal hull loss and several near misses.
The heavy emphasis on quantitative safety analysis will demand new and innovative simulation and analysis tools to help engineers keep track of all of the potential hazards, and how they might interact in complex ways. Even though the top-level performance requirements are rigorous, developers have a great deal of freedom to meet those requirements in the way they see fit. The design space in eVTOL is huge, and there's nothing (to my eye) in the proposed special condition that limits that creativity unnecessarily.