Iteration of eVTOL Airworthiness Certification System, Certification Difficulties and Restraint Mechanisms for Model‑Based Commercialization
Authors: BUCKHOUSE Intelligent Technology (Suzhou) Co., Ltd., BUCKHOUSE Low‑Altitude Economy Research Institute, BUCKHOUSE Global Low‑Altitude Economy Industry Network, BUCKHOUSE China Low‑Altitude Economy Industry Network, BUCKHOUSE International Low‑Altitude Economy Cooperation Network, BUCKHOUSE Low‑Altitude Manufacturing Platform, BUCKHOUSE Low‑Altitude Flight Platform, BUCKHOUSE Low‑Altitude Support Platform, BUCKHOUSE Low‑Altitude Infrastructure Platform, BUCKHOUSE Low‑Altitude Industry Supporting Platform, BUCKHOUSE Low‑Altitude Cross‑Boundary Integration Platform
Abstract
As the core carrier of Advanced Air Mobility (AAM), electric Vertical Take‑off and Landing (eVTOL) aircraft represent a critical direction of new‑quality productive forces within the global low‑altitude economy, with diversified application values including urban three‑dimensional transportation, emergency rescue, logistics and transportation, as well as cultural‑tourism consumption. Differing from traditional helicopters and fixed‑wing aircraft, eVTOL features distributed electric propulsion, fully electrified power architecture and high‑level autonomous flight capability, which bring brand‑new safety propositions. Airworthiness certification constitutes an institutional threshold that cannot be bypassed for models to evolve from prototype R&D to commercial operation. This report systematically sorts out the iterative context of the global eVTOL airworthiness certification system, compares regulatory logics and technical approaches among the three major airworthiness authorities of China, the United States and Europe, and conducts in‑depth analysis of practical difficulties during model certification covering system safety verification, battery power, software airworthiness, simulation‑based equivalent verification and supply‑chain airworthiness. From six dimensions including airworthiness chain, airspace operation, low‑altitude infrastructure, industrial supporting facilities, commercial‑economic models and public social acceptance, this report analyzes restraint mechanisms for the commercialization of eVTOL models, judges the future evolution direction of the certification system, and provides objective references for industrial entities, regulatory authorities and investment institutions. The analysis draws on public documents issued by ICAO, official regulations of civil aviation authorities in China, the United States and Europe, industry white papers, public technical documents of leading enterprises and industrial research data.
Keywords: eVTOL; Airworthiness Certification; Powered‑Lift Aircraft; Certification Difficulties; Low‑Altitude Economy; Commercialization Constraints; Advanced Air Mobility
Chapter 1 Introduction
1.1 Research Background
The global low‑altitude economy industry has entered a development cycle driven by policies, capital and technologies. As a new aircraft category, eVTOL has witnessed dozens of enterprises worldwide completing the development of principle prototypes and engineering prototypes. Some models have entered critical stages of airworthiness certification, while a small number have obtained model certification and achieved demonstration operations. Integrating multiple disciplines such as aeronautical engineering, power batteries, automatic control, artificial intelligence and air traffic operation, eVTOL belongs neither to traditional fixed‑wing aircraft nor helicopters, so helicopter airworthiness regulations cannot be fully applied. Its innovative design represented by distributed electric propulsion, multi‑rotor compound configuration, fully‑autonomous flight and battery‑based primary energy has created regulatory gaps within the traditional airworthiness system.
Essentially, airworthiness certification is a statutory procedure to verify that aircraft design and manufacturing meet minimum safety standards. Only after obtaining a complete Type Certificate (TC), Production Certificate (PC), Aircraft Certificate (AC) and Operating Certificate (OC) can an aircraft qualify for legal commercial operation. Civil aviation regulatory authorities across the globe keep iterating certification rules adapted for eVTOL, shifting gradually from the case‑by‑case special conditions model for individual prototypes to generalized and systematic airworthiness standards. Nevertheless, the updating of standards lags behind product R&D iteration. Long certification cycles, high verification costs and undefined compliance methodologies have become common bottlenecks for most eVTOL models. Even after completing airworthiness certification, multiple constraints including airspace resources, vertiport infrastructure, operation‑maintenance systems, cost‑benefit models and public acceptance will still hinder large‑scale commercialization. Technical prototypes are not equivalent to certified models, and certified models do not equal commercially mature products.
1.2 Research Significance
Theoretically, existing domestic research on eVTOL mostly focuses on technological R&D and market‑scale forecasting, while systematic studies on the evolutionary logic of airworthiness systems, engineering pain points in certification and full‑chain commercialization constraints remain insufficient. This report clarifies the internal logic behind airworthiness‑rule iteration, distinguishes between “airworthiness certification constraints” and “commercialization constraints”, and improves the analytical framework for domestic eVTOL‑industry research.
In industrial practice, numerous domestic low‑altitude manufacturers, operators and local governments underestimate the complexity of airworthiness. Some market opinions equate prototype test flights and demonstration flights with commercial operational capacity. This report objectively restores full‑process certification difficulties, identifies rigid constraints for commercialization, and provides factual basis for enterprise R&D planning, local low‑altitude‑economy policy formulation and investment judgment.
1.3 Research Scope and Boundaries
This report targets crew‑carrying commercially‑operated eVTOL aircraft, namely powered‑lift aircraft for Urban Air Mobility (UAM) scenarios with a maximum take‑off weight below 5700 kg, distributed electric propulsion and vertical take‑off‑and‑landing capability. It excludes consumer‑grade small‑size UAVs, large‑cargo UAVs and retrofitted electric helicopters.
The research scope covers iteration of major global airworthiness regulatory systems, engineering difficulties in model certification, and full‑chain commercial‑operation constraints post‑certification. This report does not conduct technical evaluation of any single enterprise or model; all analyses are based on publicly‑available regulatory documents and industrial data.
1.4 Data Sources
1. ICAO research reports and working documents on Advanced Air Mobility;
2. EASA SC‑VTOL, MOC‑2 series airworthiness specifications and VCA vertical‑take‑off‑and‑landing aircraft policy documents;
3. FAA AC‑21.17‑4 and SFAR Powered‑Lift Advisory Circulars;
4. CAAC Airworthiness Standard for Powered‑Lift Aircraft AC‑21‑AA‑2026‑45, Interim Regulations on Unmanned Aircraft Flight Management and supporting advisory circulars;
5. Public technical white papers and investor‑disclosed documents released by leading eVTOL enterprises;
6. Public industrial survey statistics published by domestic low‑altitude‑economy websites and industry think tanks;
7. Public papers from domestic and international aeronautical‑engineering academic journals and industry conferences.
Chapter 2 Iteration of the Global eVTOL Airworthiness Certification System
The iteration of the eVTOL airworthiness system can be divided into three phases: case‑by‑case exploration, special‑condition framework construction and formal generalized‑standard implementation. Starting from different premises, civil aviation authorities in China, the United States and Europe adopt divergent regulatory philosophies and form three sets of certification systems that draw lessons from one another while retaining notable differences.
2.1 Three Phases of Global Airworthiness‑System Evolution
2.1.1 Phase 1: Case‑by‑case Exploration (2015‑2018)
At this stage, no dedicated airworthiness regulations for eVTOL existed worldwide. Most eVTOL prototypes remained in R&D and prototype‑verification phases. Regulatory authorities adopted existing helicopter and light‑aircraft regulations and granted exemptions or experimental permits for innovative designs. The core contradiction lay in the fact that traditional airworthiness regulations were built for fuel‑powered aircraft with mechanical manipulation and pilot‑centered control. A large number of clauses were inapplicable to distributed electric propulsion, fully‑autonomous flight and battery power. Without unified compliance methodologies, only experimental flight permits could be issued for individual prototypes, and commercial manned operation was not supported.
2.1.2 Phase 2: Construction of Special‑Condition Frameworks (2019‑2025)
In 2019, EASA released SC‑VTOL Special Conditions, the world’s first certification framework dedicated to powered‑lift VTOL aircraft. It differentiates between the Basic Category and the Enhanced Category. The Enhanced Category is designed for urban commercial passenger transportation and sets stringent catastrophic‑failure‑probability indicators. Supporting MOC Means of Compliance documents specify reference paths for industry standards including DO‑178C (software), DO‑254 (hardware) and DO‑160 (environmental testing).
The FAA classifies eVTOL as Special‑Class Powered‑Lift aircraft and applies a “building‑block” certification approach. It extracts clauses from Part 23 light fixed‑wing‑aircraft rules and Part 27 rotorcraft rules. Enterprises work together with authorities to negotiate certification bases for each design feature, granting high design flexibility while imposing heavy requirements on corporate airworthiness‑engineering capabilities.
In the early stage, CAAC had no general‑purpose eVTOL airworthiness standards and adopted a special‑conditions model. For each TC‑application model, special conditions were formulated item‑by‑item according to unique design features. The EHang EH216‑S obtained the world’s first manned‑eVTOL Type Certificate through this special‑conditions pathway and realized unmanned‑manned demonstration operations.
Common features of this phase include the absence of unified formal regulations, model‑specific negotiated certification bases, unpredictable certification cycles and high communication costs. The model fitted a small number of pilot models but could not support batch certification for multiple products.
2.1.3 Phase 3: Formal Implementation of Generalized Standards (2026‑Present)
In February 2026, CAAC officially issued Airworthiness Standard for Powered‑Lift Aircraft AC‑21‑AA‑2026‑45, establishing China’s general certification basis for eVTOL. It applies to powered‑lift aircraft with a maximum take‑off weight ≤ 5700 kg and no more than 9 seats. A dedicated Chapter H for electric engines sets complete airworthiness requirements for motors and electric‑control power systems. Enterprises no longer need to negotiate all special‑conditions from scratch for each model, substantially reducing institutional costs for multi‑model certification and marking the arrival of the era of regular eVTOL standards in China.
EASA updated the complete VCA Vertical‑Take‑off‑and‑Landing‑Aircraft Regulation, upgrading SC‑VTOL from special conditions to formal regulatory rules and completing supporting rules for operations and personnel licensing. The FAA keeps improving advisory circulars for powered‑lift aircraft and promotes the adoption of industry consensus standards. All three major global airworthiness authorities have completed main‑framework construction for generalized standards. However, cross‑national standard gaps persist, and certificate mutual‑recognition has not been realized. Certification in one country does not grant automatic market access in another jurisdiction.
2.2 Underlying‑Logic Comparison of Chinese, U.S. and European Airworthiness Systems
The EASA system follows the philosophy of “demonstrate safety first, then permit operation”. Enhanced‑Category commercial passenger services shall meet safety levels for transport‑category aircraft, with a catastrophic‑failure probability of 10⁻⁹ per flight hour. Safety‑target thresholds are rigorous, documentation‑verification workload is massive, rules are highly granular, corporate discretionary space is limited, and certification cycles are long.
The FAA adopts a performance‑based safety‑continuum mindset. It does not enforce fixed failure‑probability values and allows enterprises to argue safety targets according to operational scenarios. Existing regulatory clauses are assembled in a building‑block fashion. Enterprises enjoy greater innovation freedom yet depend heavily on their airworthiness‑negotiation competence, resulting in divergent certification bases across different models.
CAAC’s Powered‑Lift‑Aircraft Standard draws on the FAA’s performance‑oriented thinking while benchmarking key safety indicators against EASA safety baselines. It fully considers domestic‑industrial‑chain realities and establishes an independent chapter for electric power systems covering unique risks of motors, batteries and electric‑propulsion systems. Both piloted and unmanned configurations are supported, including remote‑monitored autonomous‑flight modes adapted to China’s UAM scenarios.
ICAO promotes global‑standard coordination yet only releases guiding documents without binding force. Sovereign states retain airworthiness‑certification jurisdiction. Long‑term fragmentation of global airworthiness will objectively persist and directly affect cross‑border commercial expansion by eVTOL manufacturers.
2.3 Internal Contradictions in the Iteration of Certification Systems
The iteration of eVTOL airworthiness systems revolves around a core tension: rapid technological innovation versus statutory stability of airworthiness regulations.
Regulatory revisions require rigorous legislative workflows with long lead times, while eVTOL batteries, electric propulsion and flight‑control algorithms keep evolving rapidly. Over‑rigid rules stifle technological innovation; overly permissive rules undermine public‑safety baselines. Regulatory authorities worldwide generally adopt performance‑based regulation: instead of mandating specific technical implementations, they define safety objectives to be achieved and reserve sufficient flexibility for engineering realization. The trade‑off is that Means‑of‑Compliance require repeated negotiation between enterprises and authorities, increasing certification workload.
A second contradiction exists between efficiency in case‑by‑case certification and regulatory demands for batch‑processing multiple models. The special‑conditions model works for a small number of pilot prototypes. When dozens of eVTOL models enter certification simultaneously, the manpower and time costs of case‑by‑case review become unsustainable. This is the key driver behind the global push for generalized airworthiness standards.
Chapter 3 Core Difficulties in eVTOL Model Airworthiness Certification
The complete eVTOL‑certification chain comprises the Type Certificate (TC), Production Certificate (PC) and Aircraft Certificate (AC). Subsequent operational‑qualification review is required to obtain operating credentials. Industry statistics show that full certification generally requires investment of RMB 1‑2 billion and cycles of 3‑5 years or longer for certain models. The Type Certificate is merely an intermediate milestone in the certification chain. Many enterprises underestimate challenges arising from the Production Certificate and continuing‑airworthiness systems. This chapter decomposes certification difficulties across six dimensions: establishment of certification bases, power‑battery systems, software and autonomous flight control, simulation‑and‑flight‑test verification, manufacturing‑and‑supply‑chain airworthiness, and unique unmanned‑configuration challenges.
3.1 Difficulties in Establishing Certification Bases
The certification base serves as the overall framework for airworthiness work, covering applicable regulations, special conditions, exemptions and equivalent‑safety arguments. Traditional aircraft draw directly on mature, complete regulatory provisions. Numerous innovative eVTOL designs lack ready‑made clauses.
Even with the promulgation of China’s Airworthiness Standard for Powered‑Lift Aircraft, highly‑innovative configurations still require applications for equivalent‑safety arguments or special conditions for novel design features. Difficulties manifest in three respects. First, argumentation for failure‑probability safety targets. Whole‑aircraft and key‑system failure probabilities cannot rely solely on corporate claims. They must be supported by complete evidence chains including operational scenarios, Fault‑Tree Analysis (FTA), Functional Hazard Assessment (FHA) and System Safety Assessment (SSA). Safety targets of 10⁻⁷, 10⁻⁸ and 10⁻⁹ correspond to vastly different verification workloads, costs and cycles. Blind pursuit of excessively high safety targets triggers exponential growth in R&D expenditure. Second, high barriers for equivalent‑safety demonstration. When existing regulatory clauses cannot fit innovative configurations, enterprises must prove that their solutions achieve equal or superior safety levels. Argumentation documents are voluminous, and authority‑review cycles are unpredictable. Third, differentiated certification pressures for distinct configurations. Tilt‑rotor, compound‑wing and multi‑rotor layouts exhibit entirely different failure modes. No universal verification template exists; safety assessments must be rebuilt for each new configuration.
3.2 Certification Bottlenecks for Power‑Battery and Electric‑Propulsion Systems
Batteries constitute the highest‑risk source for eVTOL and represent one of the major engineering bottlenecks in certification. Aviation‑grade power batteries face multiple hazards including thermal runaway, fire‑explosion risks, high‑altitude low‑temperature conditions, high‑rate charge‑discharge cycles, crash‑impact loads and short‑circuits caused by humid environments. Consumer‑electronics and automotive battery standards cannot substitute aviation‑battery airworthiness requirements. Aviation batteries must incorporate fault‑tolerant design: upon single‑cell thermal runaway, battery packs shall prevent fire propagation and reserve sufficient time for emergency landing.
Current engineering challenges include: first, full‑operational‑envelope verification of battery thermal runaway. Laboratory tests can replicate partial conditions, yet superimposed scenarios such as high‑altitude low‑temperature flight, steep dives, crash impacts and icing‑condensation are hard to reproduce completely. Second, safety after battery cycle‑aging. As cycle counts rise, internal resistance and thermal stability degrade. Airworthiness verification must cover safety boundaries for aged batteries across the full service life, not only for brand‑new cells. Third, component‑level airworthiness for batteries. Airframe manufacturers and battery suppliers must jointly complete extensive verification work. The domestic aviation‑grade‑battery supply chain remains immature. Many components lack approved component‑airworthiness data, forcing airframe manufacturers to undertake substantial component‑level certification activities.
Distributed electric‑propulsion systems with multiple motors and controllers must verify flight safety under single‑point and multi‑point component failures. Upon failure of one or several motors, flight‑control systems shall reconstruct thrust in real‑time to retain aircraft controllability. Failure modes such as motor overheating, permanent‑magnet demagnetization and controller short‑circuits demand tens of thousands of hours of bench tests combined with flight‑test validation. CAAC’s Powered‑Lift‑Aircraft Standard establishes a dedicated Chapter H for electric engines precisely to address these brand‑new risks of electric‑propulsion systems.
3.3 Challenges for Software, Autonomous Flight Control and Development Assurance
eVTOL flight‑control software handles full‑attitude control, fault detection and fault reconfiguration. Unmanned models further undertake route planning, obstacle avoidance and conflict resolution. Software belongs to the highest‑safety‑critical system category and shall comply with DO‑178C software‑airworthiness and DO‑254 hardware‑logic‑device‑development‑assurance requirements. FDAL (Function Development Assurance Level) directly determines documentation, testing and review workload.
Practical certification obstacles include: first, airworthiness challenges brought by AI algorithms and machine‑learning deployed within flight‑control systems. Conventional aviation software executes deterministic code with exhaustively‑testable input‑output relations. Machine‑learning models produce probabilistic outputs. DO‑178C contains no mature Means‑of‑Compliance for large‑model machine‑learning. Proving that AI algorithms remain safe across the complete flight envelope represents a shared technical puzzle for global airworthiness authorities. Second, software‑version‑control conflicts. Prototype‑phase flight‑control code iterates frequently, whereas airworthiness certification mandates full traceability, testing and archiving for every software release. Rapid prototype‑iteration workflows clash inherently with strict airworthiness‑version governance. Third, exponentially‑growing system complexity. Distributed multi‑node flight‑control, multi‑sensor fusion and hundreds of interfaces create coupled faults that are difficult to identify in full, multiplying System‑Safety‑Assessment workload.
3.4 Conflicts between Simulation Validation, Model‑Based Certification and Flight Testing
Traditional aircraft accumulate evidence via extensive real‑world flight tests. However, many high‑risk failure scenarios for eVTOL, such as in‑flight battery thermal runaway and simultaneous multi‑motor failure, cannot be intentionally triggered during flight trials. Validation must rely on simulation plus hardware‑in‑the‑loop testing.
This creates a core industrial dilemma: model‑based‑certification pathways first require proof that simulation models themselves are credible. Not only must aircraft performance inside simulation environments demonstrate safety; simulation‑model error margins must be proven sufficiently small to faithfully reproduce physical reality. Model Verification, Validation and Confirmation (MV&V) incur massive workload. If authorities reject model credibility, all simulation‑generated data becomes inadmissible. Enterprises are then compelled to increase real‑flight‑test sorties and flight hours, extending cycles and raising costs.
Real‑flight‑testing itself faces constraints: flight‑test approval is difficult over densely‑populated urban zones; many hazardous‑fault scenarios cannot be exercised above cities; flight‑test‑site resources are limited; shortages persist for test pilots, flight‑test engineers and authorized representative engineers. Simulation and flight testing are complementary rather than substitutive, yet both demand substantial capital investment.
3.5 Production Certificate (PC) and Supply‑Chain Airworthiness: Under‑Estimated Certification Links
Market attention focuses heavily on the Type Certificate (TC). Nevertheless, TC only proves that “a given design is safe”. Possession of TC does not authorize mass production and delivery. The Production Certificate (PC) mandates implementation of a complete aviation‑quality system ensuring that every mass‑produced aircraft maintains design consistency with certification‑phase test prototypes.
Many eVTOL developers originating from the technology sector possess strong prototype‑development capabilities yet lack aviation‑grade mass‑manufacturing systems. Prototypes can be hand‑assembled. Mass production requires aviation‑compliant standards for component consistency, supply‑chain governance, batch‑defect control and traceability. Many component suppliers originally serve automotive or industrial markets without aviation‑component‑production qualifications. Drawings, processes and inspection criteria must be comprehensively upgraded, and supply‑chain airworthiness‑transformation cycles are lengthy.
Continuing‑airworthiness‑system construction is equally important. Certification marks not the end, but the starting‑point for full‑life‑cycle management. Enterprises shall establish maintenance schemes, fault‑reporting systems, modification‑management frameworks, airworthiness‑directive release procedures and component‑life‑limit specifications. Review of continuing‑airworthiness systems constitutes an essential certification component.
3.6 Unique Certification Challenges for Unmanned Configurations
For pilot‑on‑board‑absent eVTOL relying on ground remote monitoring, additional certification challenges emerge: air‑ground‑communication‑link safety, degradation‑handling logic upon link loss, remote‑operator qualifications and multi‑vehicle‑simultaneous‑monitoring workload. Communication links shall resist malicious interference and signal dropout, with complete degradation and emergency‑diversion logic defined. Quantitatively evaluating human‑error risks for remote operators and defining workload ceilings for multi‑aircraft scheduling remain areas of accumulating global engineering experience with few mature reference cases.
Chapter 4 Multi‑Layer Restraint Mechanisms for eVTOL Commercialization
Completion of full airworthiness certification only resolves “aircraft‑itself safety”. Large‑scale commercial operation still faces multiple rigid constraints. This chapter categorizes constraints into six groups: airspace‑operation constraints, low‑altitude‑infrastructure constraints, manufacturing‑supply‑chain and operation‑maintenance constraints, commercial‑economic‑model constraints, public‑acceptance constraints and cross‑departmental‑institutional‑coordination constraints.
4.1 Airspace and Air‑Traffic‑Operation Constraints
Commercial eVTOL operation requires high‑frequency, high‑density and regular low‑altitude flight; airspace resources constitute the primary production factor. Current constraints include:
First, low‑altitude‑airspace zoning remains in pilot‑promotion phases. Simplified approval is available within pilot zones. Outside pilot areas, long approval workflows and civil‑military‑coordination complexities prevent high‑frequency regular commercial flights, and cross‑city continuous‑route approval is especially difficult.
Second, large‑scale low‑altitude‑traffic‑management systems for eVTOL are not widely deployed. Conventional air‑traffic‑control serves high‑altitude large civil‑aviation aircraft. High‑density swarms of “low‑slow‑small” aircraft demand low‑altitude internet‑of‑aviation, conflict‑detection‑and‑resolution, non‑cooperative‑target surveillance and dynamic‑route management. Low‑altitude surveillance, communication and navigation capabilities are unevenly distributed nationwide; numerous urban surveillance blind spots exist and cannot support hundreds of simultaneous eVTOL operations in UAM scenarios.
Third, gaps in operational‑rule systems. Airworthiness governs aircraft hardware itself. Commercial operation additionally requires operational specifications: flight‑operation standards, operator qualifications, maintenance‑personnel licensing, accident investigation, insurance rules, night‑operation boundaries, adverse‑weather‑operation envelopes and liability allocation for unmanned‑manned flight. This complete set of operational regulations must iterate synchronously with airworthiness rules.
