Lilium’s CPO on the massively expensive challenge of eVTOL certification

Before electric VTOL air taxis have a chance to start changing modern life as we know it, any company that wants to manufacture one has to go through the extremely expensive and exacting process of commercial aircraft certification with one or more flight authorities, during which many different parts of their business will have to meet the same stringent safety and process standards that, say, Boeing does when it's making an airliner.

The two key flight authorities in question are the United States Federal Aviation Authority (FAA) and the European Aviation Safety Agency (EASA); achieve certification with these two and your aircraft are likely to be accepted worldwide. But this is a huge mountain to climb – we've heard estimates as high as a billion dollars to get a single eVTOL aircraft fully certified and into commercial use. With most eVTOL companies popping up as startups, that's going to be tough to find – we're not aware of any company with funding in place for more than a billion dollars at this point.

That doesn't seem to be putting anybody off – indeed, many companies are confident they'll have certification sorted by 2024, so we lined up a chat with Lilium's Chief Program Officer Yves Yemsi, who formerly led the quality team for the highly successful A350 at Airbus, on what certification is all about, where that money goes and Lilium's certification plans for its seven-seat air taxi.

One key thing people need to understand, says Yemsi, is that type certification of a particular aircraft design is only one piece of the puzzle here. Entire departments of your company need to be brought up to aerospace industry standards and certified in their own right. "You have to realize that you're not only developing the aircraft," Yemsi tells us over a video call. "You're transforming the company from a disruptive startup, into an established, normal aerospace company. Creativity is great. You came up with a new architecture. But now you're facing aerospace rigor, and yeah, that's a change. It's fundamental."

So on top of the costs of creating expensive prototypes of your aircraft, powertrain, flight control systems and everything else, you've also got to certify things like your entire design team. "We need to secure a Design Organization Approval, a DOA, from EASA," says Yemsi. "A status which says you have published processes, and you respect these processes, so you have the right aerospace rigor in your design."

And then there's the production side of things. Any eVTOL startup that wants to manufacture its own aircraft for commercial air taxi use will be held to the same manufacturing standards Boeing and Airbus are. "It's called POA," says Yemsi. "Production Organization Approval. It certifies that you can take a design, and make sure that every single part produced is conformed to the applicable design data. The conformity of your manufacturing to the design."

For eVTOLs to really drive the kind of transformative change we expect them to, they'll need to be manufactured in huge numbers – unprecedented numbers for the aerospace industry, as Serge Cecutta pointed out in our recent AAM Reality Index interview. Does that mean the aviation authorities will need to adjust their processes? "I really like that question," says Yemsi. "The answer is no. The air authorities will not lower their standard. It is the industry, which will have to learn how to deal with aerospace. There will be no exemptions. You will have to meet the rigor in production and design. That's why, if you come to visit us, you will see a lot of grey hair. It's a complete misconception that this industry is going to go with automotive processes. Of course, we will increase our production rate and use automation. But every single process will have to be approved, will have to be qualified according to aerospace standards."

On the other hand, while the aircraft themselves will likely be produced in record numbers, the simple nature of electric propulsion systems should streamline things considerably – even despite the next-level capabilities of a vectored thrust eVTOL like the Lilium jet.

"Our aircraft is super simple," says Yemsi. "Thirty-six electric ducted fans, you tilt them, and that's how you achieve your maneuverability. So we go with a simple concept, which enables us to reduce the number of components. So if you take an A350 for example, they have around three million parts. Ours will be a hundred times simpler, I don't think we'll have more than 100,000 single components. So, it's less complexity to assemble. But you still have the challenge that each of these components, even at high volume, must be fully compliant with all the production and design standards."

So the certification process can really be looked at much more as a company-wide quality system than just a simple type approval of an individual aircraft design. And even once you take that in, there's the additional challenge of certifying everything for multiple aviation authorities, which may end up having different standards. The United States FAA and Europe's EASA are the two most important, says Yemsi, because other authorities worldwide generally recognize these standards.

Lilium is taking on an early burden, says Yemsi, because it's decided to go for concurrent certification with both EASA and the FAA from the outset. It'll be more effort up front, but it rules out the risk that the aircraft passes one with flying colors and then requires a redesign to achieve the other standard.

So, realistically, how much is this whole thing going to cost? There are literally hundreds of companies jostling for a slice of the investment pie as money comes pouring into this segment. The fundraising leader at the moment would appear to be Joby Aviation, which has raised close to US$800 million. An impressive figure, for sure, but as stated above, we've heard some industry insiders speculating that a single aircraft could cost as much as a billion dollars just to certify.

"I've heard the same numbers as you did," says Yemsi. "I think they're a bit north of what I think is required, but you have to always ask, what's included in those numbers? Because it's not only engineering costs, it's production costs; you have to produce some demonstrators initially – potential technology. More importantly, you have to produce a conforming prototype. There are a lot of things flying around, which look great. But that's not the question. The question is: is it conforming, have you done it with a production controlled environment? Have you designed it in a design controlled environment? And is the aircraft conformed and similar to what you will type certify? That's not a demonstrator, that's a conforming prototype. How many conforming prototypes are flying now? Today around the world, there are not that many.

"So, this is where you invest a lot of money, because you have to invest in first the teams that are going to do your conformed design, then the team that are going to produce these parts according to aerospace-grade standards, and then you need many of them doing the flight test campaign. And our approach there has been: let's partner with external suppliers. And it's a conscious choice for us to take existing, qualified, competent, experienced aerospace suppliers. We don't have to invest in all the test equipment, facilities, we don't have to invest into production equipment, and we don't have to invest in the time to qualify according to aerospace standard, because they're already qualified. That's why we partner with aerospace players, because in terms of time to market, imagine the amount of resources you save by doing that. So we will keep what is core for us, but for the rest we will leverage heavily on aerospace suppliers."

Hence the many partnerships Lilium has been announcing lately: Honeywell for fly-by-wire flight controls, avionics, cockpits, sensors, communications and transponders, Toray for carbon composites, Aciturri for fuselage and wing manufacturing, and so on. These partners are heavily experienced in aerospace-grade design, engineering and production, and partnerships like these allow eVTOL companies to effectively outsource a lot of that certification cost.

Finally, a little about redundancy. Multirotor electric VTOLs can't glide down for a soft landing if the power goes out, or use a large top rotor to autorotate softly to the ground like a helicopter can if it loses its motor. Not even a ballistic parachute can save these things in the case of total failure below a certain height. And yet, to achieve type certification, these radical new aircraft will have to prove that they're just as safe as a commercial airliner. That means the probability of failure needs to be incredibly low: one in a billion hours of flight – about 1,500 times safer per kilometer (0.6 miles) traveled than driving.

Every manufacturer I've spoken to has had the same answer for how they're going to achieve this: redundancy. Multiple concurrent systems at every point of failure, so that the aircraft can continue to fly safely even if one or more systems go down. And not only that, but multiple concurrent systems with completely different hardware and software, to reduce the chances of a single issue taking down more than one system.

Yemsi elaborates on what this means for Lilium: "Imagine if you take the same microcontroller and it's sensitive to vibration. Well, you're vibrating both of them in flight. So when you introduce redundancy, you want to also introduce dissimilarity. This has to be a different computer, and different software. So you are sure that it cannot fail with a common cause.

"And in our case, we have triple dissimilarity. In fact, we have three different computing routes, running three different software systems, on three different hardware systems. And this concept that Honeywell has developed is the one they have actually implemented on the 787. So this is the level of safety we're talking about: 787 Dreamliner. You can imagine, for a startup to develop that on your own, it would take a while. Our approach is to be humble: we buy it."

With three flight control computers making every decision separately and comparing results, the chances of malicious remote hacking also become that much more remote. Where one system disagrees with the other two, the majority decision wins.

The same approach will be replicated all over the aircraft. With 36 ducted fans providing propulsion, the odd single unit failure won't make much of a dent in the thrust available. The battery pack, too, is separated into more than 10 separate modules, each of which is designed to be able to burst into flames and burn itself into a black puddle within a mechanically contained shell, venting heat and toxic gases safely outside the aircraft while the rest of the batteries automatically redistribute energy to cover for the one that's fried itself.

Indeed, this new battery design is one key reason why we haven't seen much in the way of flight testing from Lilium lately, says Yemsi. The old tech demonstrator aircraft had an "on-the-ground incident, as you can imagine with new sources of energy," last year, and demonstration flights were stopped so the team could redesign the battery system to elegantly handle a full-scale thermal runaway in any one module without impacting the others at all.

So there's some perspective on certification; it's probably not the most exciting part of the whole eVTOL endeavor, but it's of utmost importance, and a certification-friendly approach is something that needs to permeate an eVTOL company from the ground up if it's likely to get a product out there into the mass market. It's one of many reasons why the AAM Reality Index looks closely at eVTOL companies to see how many highly experienced aerospace industry personnel are in senior management positions.

To learn more about Lilium's specific path to certification, check out Yemsi's step-by-step breakdown and timelines in the video below.

Source: Lilium