Application platform: eVTOL and electric conventional takeoff and landing (eCOTL) — propulsion-battery packs Last verified: 28 August 2026 Governing standards and references:
- RTCA DO-311A — equipment-level battery safety and containment testing; written for avionics and equipment batteries, not scoped for large propulsion systems
- EASA MOC-3 SC-VTOL Issue 2 — propulsion-battery thermal-runaway characterization, non-propagation, and containment evidence under VTOL special conditions
- FAA Draft AC 20-184A — draft guidance on rechargeable lithium battery testing; acknowledges propulsion-battery limitations of DO-311A but not yet in force
- ASTM F3830-26 — propulsion EESS design, installation, and qualification for light-sport-category aircraft under the Part 22 consensus-standard route
- EUROCAE ED-328 and ED-333 — eVTOL-specific crashworthiness and rechargeable-battery standards; both in draft, target December 2026
- NASA NTRS 20250002599 / 20250002767 — zero-SOC module drop-test series producing deformation and forensic data; not crash-safety evidence for charged or installed systems
The prior standards map card established which standards govern eVTOL propulsion-pack qualification and where the gaps are. This card addresses a different problem: inside the territory those standards cover, what does each piece of evidence actually prove?
Scope here is limited to the evidence areas where losing conditioning detail during DVP transcription creates the most qualification risk — thermal-runaway containment, non-propagation, and crash. Energy density, power capability and C-rates by mission phase, cycle life, operating envelope, EMC, and transport remain mapped in the prior card and were confirmed current as of the Q3 update (21 August 2026).
A test report generates a DVP row. During transcription, the conditions that gave the result its meaning — trigger method, SOC, article age, observation period, population coverage — can drop out. The row that survives cites a real source and may still misrepresent what was demonstrated. A qualification rejection on that basis costs program years.
Five evidence sources are mapped below. For each: what the test establishes, what it excludes, and which conditioning fields must reach the DVP row intact.
DO-311A §2.4.5.5: equipment-level containment under prescribed trigger
DO-311A's thermal-runaway containment test offers two trigger routes — overcharge and overheating — each designed to force the entire battery into thermal runaway. One article is tested. The test objective is met if thermal runaway occurs in at least two cells. A 16-hour observation period follows (per CAAC CTSO-C179b, which reproduces the original DO-311A wording in its side-by-side comparison).
The protocol was written for equipment-level batteries. EASA's comment-response document — regulatory guidance interpreting DO-311A's applicability to propulsion batteries — identifies what breaks when it is applied to them. Forcing the entire battery into thermal runaway can, depending on configuration, produce near-simultaneous failure of every cell, an event EASA considers beyond any credible in-service scenario. In other configurations, cell-to-cell variability means only a few cells fail, and a two-cell event on one unaged article may understate the containment challenge the pack will actually face. The same protocol overstates or understates the evidence depending on pack design and cell population, which means its relationship to realistic worst-case behavior is configuration-dependent and cannot be assumed from the citation alone.
Three further limits: the test does not require cell-level parameter characterization before the trigger condition is selected. It does not require degraded or aged articles. And it does not address degradation of the containment system itself from aging or environmental exposure (EASA MOC-3 SC-VTOL Issue 2).
What the evidence establishes: Equipment-level containment response under a prescribed battery-wide overcharge or overheating trigger, observed for 16 hours, for one new article.
What it excludes: Realistic worst-case propulsion-battery behavior. Installed-aircraft risk closure. Non-propagation across service life. Crashworthiness. Acceptance of a large propulsion pack where forcing the entire battery may be infeasible — a limitation FAA's draft AC 20-184A acknowledges by permitting modularized or sub-pack designs, though that accommodation remains draft guidance not yet in force.
DVP conditioning that must survive:
- DO-311A edition and clause
- Trigger route (overcharge or overheating)
- Initial SOC
- EUT configuration
- Protection-function state
- Venting configuration
- Number and location of cells that entered thermal runaway
- Observation period
- §2.2.2.4 acceptance outcomes
The complete initial-SOC, EUT-configuration, and acceptance requirements sit behind RTCA's paywall. Licensed verification is required before populating those fields.
MOC-3: the characterization matrix is the evidence
MOC-3 restructures the evidence chain, and the restructuring changes how the DVP is built. Cell-level characterization has to happen before the battery-system test case is selected, and the rationale for that selection becomes part of the qualification record.
The characterization spans four dimensions (EASA MOC-3 SC-VTOL Issue 2): trigger method, distinguishing overcharge from overheating responses; SOC, on the recognition that lower SOC can leave more unreacted material while higher SOC usually produces greater energy release and ejection; internal-short position relative to the venting mechanism, including how heater placement drives venting path, side rupture, or bottom rupture; and heating rate, which EASA requires be investigated between 5°C/min and 20°C/min because flame and smoke behavior differ with rate. For each combination, seven outputs must be recorded:
- Initial SOC
- Time to thermal runaway
- Maximum temperature
- Average total thermal-energy release (joules)
- Initiation temperature
- Temperature-rise rate
- Ejected mass
EASA identifies high variability in cell-level thermal-runaway tests, so the replicate count is not fixed. The applicant defines it in coordination with EASA. The sample must represent expected variability over product life — cells from different lots, manufacturing dates, and manufacturing sites where applicable. Replicate count, represented population, and any exclusions all become part of the evidence record.
The system-level test article must represent life degradation (vibration, thermal cycling, electrical cycling), the type-design configuration, aircraft installation, designated venting, and orientation. Triggered-cell location must account for spacing, heat transfer, and candidate positions: center, wide face, narrow face, corner, edge. Before triggering, the battery system is stabilized at 55°C or the maximum operating high temperature, whichever is higher.
Two distinct evidence claims come out of this structure.
Non-propagation: The target cell enters thermal runaway; for a minimum of eight hours afterward, the following conditions must hold:
- No propagation
- No rupture
- No external fragment release
- No flame or emission escape except through designed venting
- No loss of warning signals or safety functions
EASA described the eight-hour period as a compromise among confidence that cell reactions have stopped, practical test execution, and VTOL operating duration relative to large aeroplanes (per the EASA comment-response document for MOC-3 Issue 1).
Continued-safe-flight-and-landing containment: At least 20% of cells must be driven into thermal runaway using the characterized worst-case combinations, with all targeted cells entering thermal runaway within approximately one minute. The result must show that the event can be managed at battery-system and installation level while preserving continued safe flight and landing. The 20% figure is a minimum event-severity condition for the demonstration, not an allowable in-service propagation fraction.
DVP conditioning that must survive:
- Full characterization matrix (trigger × SOC × position × heating rate)
- All seven measured outputs per combination
- Replicate count and regulator coordination record
- Lot/date/site coverage
- Aging and degradation history
- Selected worst-case combination and the rationale for selection
- Competing cell locations considered
- Type-design and installation configuration
- Venting and orientation
- 55°C-or-higher stabilization condition
- Cells targeted and cells confirmed in thermal runaway
- Observation period
- Applicable acceptance claim (non-propagation or CSFL)
The characterization matrix is what gives the system-level result its scope. A DVP row citing MOC-3 system-level results without the characterization basis — population coverage, conditioning history, selection rationale — has dropped the mechanism by which the test case was chosen, and with it any basis for believing the chosen case was conservative.
NASA zero-SOC module drops: deformation data, not crash safety
NASA's Phase 1 eVTOL ESS drop-test series (Part 1, Part 2) — published technical analyses, not regulatory documents or standards — tested four individual modules, each approximately 24.5 lb and 2.3 kWh, dropped from 50 ft onto a rigid surface, one module per orientation (right-side up, upside-down, sideways, flatwise). Impact velocities ranged from 46.9 to 52.8 ft/s.
The modules were at zero SOC. They carried no BMS, venting hardware, midpoint disconnects, or other pack-level systems, and there was no surrounding aircraft structure or impact attenuation. Each module carried accelerometers and thermocouples; post-impact, the article sat undisturbed for one hour of active temperature monitoring, then 24 hours of passive observation before forensic teardown.
No module entered thermal runaway. Thermocouples showed no significant post-test temperature rise. Two orientations retained diagnostic connectivity; the two higher-damage orientations did not, with the upside-down article showing a positive-terminal-to-chassis short and the sideways article producing a brief spark at impact.
NASA states the limit explicitly: the zero-SOC condition was chosen to minimize energetic hazard so that teardown could be performed, and it prevents definitive conclusions about thermal-runaway or electric-shock effects. Only deformation and component failures can be identified conclusively from this phase. That is unusually clear scoping for a published test series. Preserve it verbatim in any DVP reference.
What the evidence establishes: Module-level impact loading response, orientation-dependent deformation patterns, component damage characterization, and post-impact continuity observations — for zero-SOC modules without BMS or pack-level systems, impacting a rigid surface without airframe attenuation.
What it excludes: Charged-module or charged-pack fire behavior. Propagation. Energetic venting. Post-impact BMS isolation. Performance of pack-level venting or disconnect hardware. Response within representative aircraft structure.
DVP conditioning that must survive:
- Zero-SOC state
- Module identity and omitted systems (no BMS, venting, disconnects)
- One-article-per-orientation design
- 50-ft rigid-surface drop with no surrounding structure
- Orientation
- Measured impact velocity and angle
- Instrumentation channels
- 1-hour active and 24-hour passive monitoring periods
- Teardown scope
F3830-26: Part 22 lane only
ASTM F3830-26 covers propulsion EESS on light-sport-category aircraft. Its publication supports the post-MOSAIC consensus-standard route under Part 22. The document is four pages. The public ASTM page exposes scope and catalog metadata but not the qualification procedures or acceptance criteria.
Do not treat F3830-26 as a general eVTOL propulsion-battery standard. AC 21.17-4 supplies the certification framework for powered-lift type-certificated under 14 CFR 21.17(b). F3830-26's existence in the light-sport consensus-standard lane does not make it governing evidence for a powered-lift project running the type-certification route. Proposed use there requires separate authority acceptance within the project's certification basis.
DVP status: Locator only. Test conditions require licensed-text review. Applicability outside Part 22 requires documented authority acceptance.
ED-328 and ED-333: development clock
EUROCAE WG-112 SG-1 lists ED-328 (crashworthiness test of battery systems for eVTOL) and ED-333 (rechargeable lithium batteries in eVTOL) as drafts targeting 31 December 2026. No public consultation draft, scope description, or test-condition preview has appeared on EUROCAE's public deliverables, catalog, or consultation pages through this research cutoff. Track the dates. Neither document can source a DVP row today.
Gaps: consolidated
This card covers safety (thermal-runaway containment and non-propagation) and mechanical (crash) evidence limits. The full gaps inventory across all parameter classes is in the prior standards map card. Within this card's scope:
Propulsion-battery crashworthiness at operational SOC: No governing standard. NASA's drop series is zero-SOC module data. ED-328 (EUROCAE WG-112 SG-1) targets this gap directly; draft, December 2026 target, no public test conditions available.
eVTOL-specific rechargeable-battery standard: No governing standard. DO-311A was written for equipment-level batteries; MOC-3 layers propulsion-specific requirements on top of it but is a means-of-compliance document, not a standalone standard. ED-333 (EUROCAE WG-112 SG-1) targets this gap; draft, December 2026 target, no public scope or test conditions available.
Propulsion-battery containment for large packs: DO-311A's whole-battery trigger may be infeasible for large propulsion systems. FAA Draft AC 20-184A acknowledges this and permits modularized approaches, but the AC remains draft — not yet in force as accepted guidance.
Containment-system aging and degradation: MOC-3 requires degraded articles for the system-level test, but no standard prescribes a standalone aging protocol for the containment system itself — housing, venting, seals — independent of the cells.
What survives transcription
The failure mode is the same across all five sources: a DVP row that cites the document and drops the conditions under which the evidence was generated. The citation reads as authoritative. The scope it implies is wider than the scope that was demonstrated. DO-311A's containment result is one new article under a prescribed battery-wide trigger. MOC-3's is a characterized worst-case combination drawn from a defined population of degraded, representative articles. NASA's is a zero-SOC module on a rigid surface with no pack systems installed. F3830-26 lives in the Part 22 lane. ED-328 and ED-333 have no evidence to bound yet.
Populate each row with the conditioning fields listed under its section above. With those fields present, the row says what was demonstrated. Without them, the row says less than the engineer writing it believes — and that shortfall tends not to surface until a certification authority asks what the test actually proved.
- FAA AC 20-184A finalization: The draft AC that would provide revised guidance for installed rechargeable-lithium batteries — including the modularized-testing accommodation for large propulsion packs — remained publicly listed as a draft through this research cutoff, with no final issuance found on checked FAA routes.
- EUROCAE ED-328 and ED-333 publication: Both eVTOL-specific drafts — crashworthiness testing and rechargeable-battery technical standard — carry 31 December 2026 target dates on the WG-112 SG-1 deliverables page, but no public consultation draft or scope preview has appeared.
- EASA MOC-5 SC-VTOL disposition: EASA's Comment-Response Tool continued to label MOC-5 SC-VTOL Issue 1 as awaiting responses to comments on 27 August 2026, meaning it should not yet be treated as a final battery compliance layer.
- Operational-SOC crash evidence: A 2026 peer-reviewed study testing commercial cells under eVTOL load profiles found that high-energy cells reached end of life through power limitations while still above 90% SOH, reinforcing that power capability, capacity, and safety limits function as separate retirement criteria — and that crash evidence generated at zero SOC leaves the energetic dimension unaddressed.