Type Certification

Before an aircraft type can carry passengers, its design has to be shown to meet a published airworthiness code. Type certification is that process: the manufacturer proves compliance by analysis, ground tests and flight tests, the authority of the State of Design checks the evidence, and when it is satisfied it issues a type certificate (TC). Every aircraft later built to the approved design then receives its own certificate of airworthiness from the State in which it is registered.

For pilots the process is not remote. The limitations in the flight manual, the maximum number of passengers, the approval to fly in icing or to autoland in fog, and even the scope of a type rating all come from the type certificate and the data sheet that summarises it. The codes also explain why aircraft of one type can differ: a design certified in the 1980s keeps its original basis, amended only where later changes required it.

ICAO Annex 8

ICAO Annex 8, Airworthiness of Aircraft, contains the international Standards on which national airworthiness codes are built. It deals with airworthiness from the engineering side, and it is complementary to Annex 6, which covers the operation of aircraft: an aircraft's airworthiness is fully defined only by the two together.

Annex 8 divides the responsibilities between States. The State of Design issues the type certificate, which defines the design and applies to all aircraft later produced to it, and for aeroplanes over 5,700 kg it must ensure that a structural integrity programme, including corrosion control information, is maintained. The State of Registry issues the certificate of airworthiness when it has evidence that the individual aircraft complies with the appropriate airworthiness requirements, and it decides whether a damaged aircraft remains airworthy. When a State first registers an aircraft and issues or validates its certificate, it informs the State of Design.

The detailed Standards for large aeroplanes apply to aeroplanes of more than 5,700 kg maximum certificated take-off mass intended for the carriage of passengers, cargo or mail in international air navigation. Annex 8 sets broad objectives rather than a complete design code; each State, or in Europe EASA, publishes the detailed code.

Certification specifications

In the European Union the procedures for certifying designs are in Part 21, Annex I to Commission Regulation (EU) No 748/2012, and the technical standards are EASA's certification specifications (CS). The CSs are soft law, issued by EASA decision, and each covers one kind of product: CS-22 for sailplanes, CS-23 for normal-category aeroplanes, CS-25 for large aeroplanes, CS-E for engines, CS-ETSO for equipment and CS-AWO for all weather operations. Newer codes cover operational suitability data, such as CS-FCD for flight crew training data and CS-MMEL for the master minimum equipment list.

In the United States the same split exists within Title 14 of the Code of Federal Regulations: Part 21 sets the certification procedures, and airworthiness standards follow in separate parts, among them Part 23 for normal category aeroplanes, Part 25 for transport category aeroplanes and Part 33 for engines. Unsafe conditions found in service are corrected by airworthiness directives under Part 39.

Codes are amended over time, and a design is not moved automatically to each new amendment. Its certification basis is fixed by a reference date, normally the date of application: for the A320 family the TCDS gives the application date of the first model, the A320-111. A manufacturer may elect to comply with a later amendment, and some later changes to a design must meet newer standards, as described below.

From BCAR and JAR to CS

Before common European codes, each State certified to its own requirements. In the United Kingdom these were the British Civil Airworthiness Requirements (BCAR), published by the CAA, and ATPL textbooks still quote them: the duplicate inspection of vital points in flight control systems, where a single incorrect assembly could lead to catastrophe, and the requirement that no single failure in the air conditioning system may reduce the fresh air supply below 0.5 lb per seat per minute.

The Joint Aviation Authorities (JAA) then produced common Joint Aviation Requirements (JARs). For large aeroplanes this was JAR-25, which kept the paragraph numbering of the US FAR 25, so that JAR 25.1309 and FAR 25.1309 dealt with the same subject. The A320 was certified in February 1988 by the French DGAC under its type certificate 180. The basis of its production models is JAR-25 at Change 11, as elected by the manufacturer, together with A320 special conditions, and JAR-AWO at Change 1 for automatic landing and low visibility operations.

When EASA took over design approval, the JARs became certification specifications, and EASA issued its own type certificates in place of the national ones. For the A320 family, EASA TCDS A.064 was first issued on 21 December 2005 and replaced DGAC TC 180, which remains a valid reference for the certificates of airworthiness of aircraft produced before that date.

Type certificate and data sheet

The type certificate approves the type design: the drawings, specifications, materials and processes that define the product, together with its airworthiness limitations. It is held by the design organisation, for the A320 family Airbus S.A.S. in Blagnac. Its public summary is the type certificate data sheet (TCDS). EASA's A.064 lists each model with its application and certification dates, the certification basis, the special conditions, the equivalent safety findings, environmental protection standards, and the main limitations, among them the minimum flight crew, ETOPS approval, emergency exits and maximum passenger seating.

Since Regulation (EU) No 69/2014 amended Part 21, EASA type certificates also carry operational suitability data (OSD). For the A320 family these are the master minimum equipment list, the flight crew data that set the minimum syllabus for type rating training, and cabin crew data. The flight crew data section states that the A318, A319 and A321 are variants of the A320, which is the basis for their single type rating. Older operational evaluation reports, such as the 2003 JAA report on the A320 family, were deemed to be OSD at the transition.

An equivalent safety finding accepts a design that does not meet the literal wording of a requirement when compensating factors give an equivalent level of safety. JAR 25.933(a) required that a thrust reverser could be restored to forward thrust in flight or that the aeroplane could land safely with any reverser position. When Airbus deleted the automatic in-flight restow function on some models, the authority accepted it because inadvertent in-flight deployment had been shown to be extremely improbable. Similarly, the A320 was certified with a maximum of 179 passengers, raised to 180 by an equivalent safety finding on its exits.

A design certified by one authority is validated by others before their operators may use it, under bilateral agreements such as the EU–US agreement under which EASA originally validated the Boeing 737 MAX.

Special conditions

A certification code is written around existing technology. When a design has novel or unusual features for which the code contains no adequate standard, the authority prescribes special conditions that give a level of safety equivalent to the code. The A320, the first airliner in service with full fly-by-wire controls and flight envelope protection, needed special conditions for its sidestick and fly-by-wire architecture.

Special conditions also carry lessons from service. The A320neo's certification basis replaces the CS-25 static stability paragraphs, 25.171 to 25.177, with a special condition on stability and low energy awareness, and adds special conditions on flight envelope protection, on fan cowl retention after cowl losses on earlier engines, on water and ice in the fuel system following the 2008 Boeing 777 accident at Heathrow, and on low fuel level warnings. Under another, the centre tank of any A320-family aircraft first flown after 1 January 2012 must have a flammability reduction (inerting) system. EASA records certification issues in certification review items (CRIs), and the special conditions it considers of general interest are published in an annex to the TCDS.

Major changes and STCs

Every change to a type design is classified as minor or major. A major change by the TC holder, such as the A320's sharklet wingtips or the new engine option, is approved as a change to the type certificate. For a major change the authority applies the changed product rule: areas affected by a significant change must meet a later amendment of the code. The certification basis of the A320neo, for instance, is that of the A320 with sharklets, amended to CS-25 Amendment 11 for the paragraphs the new engines and systems affect.

When someone other than the TC holder designs a major change, such as a modification company installing new avionics or reconfiguring a cabin, the approval is a supplemental type certificate (STC). After a major modification an aircraft is normally reweighed, because its basic empty mass and centre of gravity have changed.

TSOs and equipment standards

Equipment is approved separately from the aircraft. A technical standard order (TSO) is an FAA minimum performance standard for a specified article; EASA's equivalents are European technical standard orders (ETSOs) in CS-ETSO. Examples appear throughout operating rules: US airlines need terrain awareness equipment meeting TSO-C151, 1090 MHz ADS-B Out equipment must meet TSO-C166b or later, and a non-WAAS GPS receiver is built to TSO-C129. A TSO authorisation approves the design and production of the article, not its installation, which still needs approval for each aircraft type.

Most performance standards are written by industry bodies: RTCA in the United States and the European Organisation for Civil Aviation Equipment (EUROCAE) in Europe, often jointly. Their minimum operational performance standards (MOPS) define equipment, while a Minimum Aircraft System Performance Specification (MASPS) defines the performance of a whole system as installed; RVSM altimetry, for example, must meet the altimetry MASPS. EUROCAE ED-12, published with RTCA as DO-178, sets the software assurance levels described in failure conditions and system safety.

All Weather Operations (CS-AWO)

CS-AWO is EASA's certification specification for all weather operations, against which automatic landing systems and the equipment for CAT II and CAT III operations are certified. Two classes of automatic landing system matter to pilots. A fail-passive system causes no significant deviation of flight path or attitude after a failure but cannot complete the landing, whereas a fail-operational system can still complete the approach, flare and landing after a failure below alert height.

Certification is only one of the approvals involved. An operator may conduct CAT II or CAT III operations only with aeroplanes certified for a decision height below 200 ft, or no decision height, and equipped in accordance with CS-AWO or an equivalent accepted by the authority; the operator also needs its own specific approval, and the crews need training (see low visibility operations). The flight manual states each aircraft's certified capability, and inoperative equipment can downgrade it.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.