PORTARIA REGULATÓRIA Nº 54, DE 30 DE JULHO DE 2026 (parte 2 de 2)

ANEXO
OBJETIVOS DE SEGURANÇA PARA AERONAVES COM CAPACIDADE DE DECOLAGEM E POUSO VERTICAL
SAFETY OBJECTIVES FOR VERTICAL TAKEOFF AND LANDING CAPABLE AIRCRAFT (VCA)
INTRODUCTION
This ANAC policy establishes the safety objectives for VTOL Capable Aircraft (VCA), including electric propulsion vertical takeoff and landing aircraft
(eVTOL).
BACKGROUND
Certification Levels
The concept of safety continuum provides a balanced approach between the risk and safety benefits for certification of civil aircraft depending on size, mission,
capability, and other aspects. For VTOL Capable Aircraft (VCA), ANAC adopts the VCA Certification Levels according to Table 1.
Table 1 - VCA Certification Levels
. .Maximum Passenger Seating Configuration and Maximum Gross Weight .VCA Certification Level
. .0-1 Passengers & £ 5,670 kg (12,500 lbs.) .1
. .2-6 Passengers & £ 5,670 kg (12,500 lbs.) .2
. .7-9 Passengers & £ 5,670 kg (12,500 lbs.) .3
These certification levels are based on the airplane certification levels defined in requirement §23.2005 of RBAC 23 amdt. 64 (equivalent to FAA 14CFR §23.2005
amdt. 64, and EASA CS-23 amdt. 5), with the exception that ANAC is currently limiting the certification levels for VCA to a maximum gross weight of 5,670kg (12,500
lbs.) or less, which is compatible with the definition of small aircraft in accordance with RBAC 01. Significantly heavier VCA will require the evaluation of additional and
specific characteristics than those currently taken into consideration by ANAC for existing VCA designs.
Reason for This Policy
In carrying out a system safety assessment as required for the certification of civil aircraft, the applicant must show that there is a logical and acceptable
inverse relationship between the average probability and the severity of failure conditions. Safety objectives are then established at means of compliance level as part
of the pass/fail criteria for successful compliance determination. In particular, the safety objectives provide the relationship between the aircraft certification level, the
severity of its failure conditions, and the required average probabilities and Functional Development Assurance Levels (FDALs).
Safety objectives for conventional aircraft such as airplanes and helicopters are defined in well-established and harmonized means of compliance that are issued
(or recognized) by each certification authority. VCA, on the other hand, are heavier-than-air aircraft capable of vertical takeoff, vertical landing, and low speed flight that
depends principally on engine-driven lift devices or engine thrust for lift during these flight regimes and on nonrotating airfoil(s) for lift during horizontal flight.[1] An
electric propulsion, vertical takeoff and landing aircraft (eVTOL) is one type of VCA that typically integrates distributed electric propulsion and flight controls. Due to their
novelty, there's currently no harmonized guidance material defining safety objectives for VCA.
This policy is then needed to establish ANAC's safety objectives for VTOL Capable Aircraft. It applies to ANAC's Type Certification of VCA designs, including TC
validation of foreign designs.
ANAC's Development of Safety Objectives for VTOL Capable Aircraft
The ANAC performed its assessment of safety objectives for VCA leveraging from existing guidance material related to the concept of safety continuum, dialogue
with the industry and certification authorities, and considering key characteristics of these new designs and intended operation. In doing so, published guidance material
for aircraft with similar passenger capacity, payload, design weights and operations were compared for the application of the safety continuum concept to different types
of vehicles, including conventional airplanes and helicopters, powered-lift aircraft including eVTOLs, and Remotely Piloted Aircraft System (RPAS).
Serious/fatal accident statistics pertinent to RBAC/14 CFR Part 135 operations were assessed as the safety objectives associated with each catastrophic failure
condition is related to these statistics by assuming a contribution of system-related design hazards and a given number of failure conditions in the design. This assessment
is consistent with analyses to determine safety objectives presented in FAA AC 25.1309-1B[2] and AC 23.1309-1E[3].
New VCA designs, especially eVTOLs, have specific characteristics such as integrated full-fly-by-wire controls and distributed electric propulsion, indirect piloting
and envelope protections, typically higher weight and dimensions, and others that differ them from conventional aircraft. These characteristics, as well as their intended
operation (e.g. urban air mobility for compensation or hire), were evaluated for their potential effect in defining the applicable safety objectives (alleviating or intensifying
factors). Finally, a dedicated analysis was performed to establish appropriate development assurance levels to limit the likelihood of development errors in such
designs.
ANAC submitted its studies on this subject to sectorial consultation and received comments from the industry, certification authorities, and individuals. These
comments were dispositioned and considered by ANAC to improve the assessment, which resulted in this policy. The sectorial consultation and related studies primarily
addressed VCA Certification Level 2. Nevertheless, the findings enabled ANAC to define safety objectives for Certification Levels 1 and 3 as well, considering a Safety
Continuum methodology.
POLICY
The safety objectives are part of the means of compliance for system safety requirements identified in the certification basis of the design, in particular RBAC
§23.2510 and its equivalent for VTOL Capable Aircraft (VCA). They define quantitative and qualitative criteria that are accepted as aids to engineering judgment in a
system safety assessment.
These objectives are applicable to all the aircraft systems and their combinations. They establish availability and integrity safety constraints that should be
achieved at the aircraft, system and item levels. As such, the safety objectives are one of the key aspects for establishing the overall level of safety of the design, along
with other safety-related requirements included in the certification basis.
The Table 2 provides quantitative probabilities and FDALs as safety objectives for each Failure Condition classification for VCA depending on Certification
Level.
Table 2 - Relationship among severity of failure conditions, probabilities, and development assurance levels for VCA
. .Failure Condition
Classification
.No Effect .Minor .Major .Hazardous .Catastrophic
. .Effect on aircraft .No effect on
operational
capabilities or safety
.Slight reduction in functional
capabilities or safety margins
.Significant reduction in
functional capabilities or safety
margins
.Large reduction in functional
capabilities or safety margins
.Loss of aircraft
. .Effect on flight
crew
.No effect on flight
crew .Slight increase in workload that
involves crew actions well within
crew capabilities such as routine
flight plan changes
.Physical discomfort or a
significant increase in workload
or in conditions impairing crew
efficiency
.Physical distress or excessive
workload impairs ability to
perform tasks accurately or
completely
.Fatalities or
incapacitation
. .Effect on occupants
excluding flight
crew
.Inconvenience .Physical discomfort .Physical distress, possibly
including injuries
.Serious injuries or a fatal injury
to a single passenger or cabin
crew member
.Multiple
Fatalities
. .Qualitative
Probability
.No Probability
Requirement
.Probable .Remote .Extremely Remote .Extremely
Improbable
. .VCA Certification
Level 1
.No probability or
FDAL requirement
.<10-3
FDAL D
.<10-5
FDAL C
.<10-6
FDAL C
.<10-7
FDAL B
. .VCA Certification
Level 2
.No probability or
FDAL requirement
.<10-3
FDAL D
.<10-5
FDAL C
.<10-7
FDAL C
.<10-8
FDAL B
. .VCA Certification
Level 3
.No probability or
FDAL requirement
.<10-3
FDAL D
.<10-5
FDAL C
.<10-7
FDAL B
.<10-9
FDAL A
Note 1: Numerical values indicate an order of probability per flight hour of failure range and are provided here as a reference. FDAL and IDAL assignment
methodology should follow a consistent top-down approach methodology (e.g. ARP4754B, §5.2). A qualitative analysis is acceptable to justify minor failure
conditions.
Note 2: No single failure will result in a Catastrophic Failure Condition.
____________________________
[1] Ref.: FAA 14CFR §1.1.
[2] Ref.: FAA AC 25.1309-1B Appendix A
[3] Ref.: FAA AC 23.1309-1E Section 15