Joby Aviation and Flow Engineering: Building the Systems Engineering Backbone for eVTOL Certification

Joby Aviation is not building an aircraft that fits neatly into an existing regulatory box. Their five-seat, all-electric air taxi — designed for vertical takeoff and landing in urban environments, with a noise signature quiet enough to operate from city-center locations — is a genuinely novel category of vehicle. That novelty is the engineering ambition. It is also the certification challenge.

FAA type certification for a conventional fixed-wing aircraft is an established, if demanding, process. There are decades of precedent, accepted means of compliance, and a regulatory framework that both applicants and the agency understand. eVTOL aircraft like Joby’s force every assumption in that framework to be re-examined. The propulsion architecture, the flight envelope, the failure modes, the crew interfaces, the noise model — all of it requires either novel means of compliance or deliberate mapping to existing regulations through equivalency arguments the applicant must construct and defend.

That work is not primarily flight test work. It is systems engineering work. And the infrastructure that supports it matters as much as the aircraft itself.

What Joby Is Actually Building

Before examining the systems engineering challenge, the aircraft itself deserves a clear description, because the engineering complexity follows directly from the design choices.

Joby’s production aircraft uses six tilting rotor nacelles mounted on fixed wings and a tail structure, each driven by an independent electric motor. In vertical flight, all six rotors provide lift. In cruise, the forward nacelles tilt to provide thrust while the aircraft transitions to fixed-wing flight, with the rear rotors folded for efficiency. The battery system is purpose-designed for aviation duty cycles, not adapted from automotive cells.

The distributed electric propulsion (DEP) architecture is central to both the vehicle’s capability and its certification complexity. Six independent propulsion units, each with its own motor controller, power bus, and mechanical interface, must all be characterized for failure modes and shown to meet the FAA’s continued safe flight and landing (CSFL) requirements under any credible failure combination. The number of system states that need to be modeled, tested, and traced to regulatory requirements is not additive — it scales combinatorially with the number of independent propulsion channels.

Joby has also made design choices specifically to reduce noise, including blade count, tip speed management, and RPM scheduling during approach. These choices are not just acoustic engineering decisions. They must be documented as part of the environmental certification package and traced to the operational procedures and performance data that V&V will eventually validate.

The aircraft is, in short, a systems integration problem of the first order. And systems integration problems at certification scale require requirements infrastructure to match.

The Certification Demand on Systems Engineering

FAA type certification under 14 CFR Part 23 (as amended and as applied to powered-lift via special conditions) requires the applicant to demonstrate compliance with every applicable airworthiness requirement. For a novel aircraft with no direct precedent, a substantial portion of the certification effort involves establishing what the applicable requirements are, how compliance will be shown, and what evidence will constitute acceptable demonstration.

That process generates documentation that is both voluminous and deeply interconnected:

System requirements must be derived from top-level aircraft-level requirements and regulatory citations. Each system requirement needs a clear parent — a regulatory clause, a safety requirement, or a derived functional need — and a clear child: the subsystem or component requirement that implements it.

Means of compliance (MoC) documentation must specify, for each requirement, whether compliance will be shown through analysis, test, inspection, or some combination. The MoC selection has downstream consequences for the V&V plan, the test program, and the data packages that will be submitted to the FAA.

The V&V plan must map every requirement to at least one verification event, and every verification event must be traceable back to the requirements it satisfies. When test plans change — and they always do — the impact on coverage must be visible immediately, not discovered at the next manual RTM audit.

Safety analysis outputs, particularly the functional hazard assessment (FHA), system safety assessment (SSA), and fault tree analyses, must be integrated with the requirements hierarchy. A safety requirement that changes because a fault tree probability changes must propagate to the system requirements that implement it, and the change must be traceable in both directions.

Document-based tooling — the kind of tooling that stores requirements in Word tables or PDF exports and tracks traceability through manually maintained matrices — cannot support this process at Joby’s scale and pace. The relationships between requirements, MoC entries, verification events, and safety analysis nodes are not a flat table. They are a graph. When any node changes, the impact ripples through that graph. If the graph is maintained as a set of separate documents, those ripples are invisible until someone manually re-reconciles the documents — by which point the design has often moved again.

The Systems Engineering Organization

Joby has built a systems engineering function that is, by industry reports and public hiring data, substantial and technically deep. Their SE leadership includes engineers with backgrounds in aerospace systems integration from programs where requirements infrastructure was mission-critical: defense programs, commercial aviation OEMs, and NASA projects where the cost of a requirements gap is not a schedule hit but a vehicle loss.

Their approach, consistent with their public statements and FAA engagement posture, treats the certification basis as a living model rather than a static document. The requirements hierarchy is maintained continuously, not prepared as a submission artifact after the design is frozen. Means of compliance decisions are tracked against the requirements they satisfy. Verification events are planned against the MoC, not specified post-hoc.

This is the correct approach for a program of this complexity, and it is also the harder approach. It requires tooling that can maintain that living model — that can ingest requirements changes, propagate impact assessments, maintain bidirectional traceability, and surface coverage gaps before they become certification findings.

It also requires that the tooling not become a bottleneck. In a program with the scope and pace of Joby’s certification effort, the requirements management system needs to support concurrent work by large teams across systems, subsystems, and domains without imposing workflow friction that causes engineers to maintain shadow copies or bypass the system.

Where Flow Engineering Fits

Flow Engineering has worked with Joby as part of building the requirements and systems definition infrastructure that supports their certification strategy. The relationship is grounded in the specific problem that Flow Engineering was built to address: requirements and systems models that are graph-native, AI-assisted, and designed for the kind of multi-domain technical complexity that eVTOL certification demands.

Flow Engineering’s architecture treats requirements not as rows in a database or lines in a document, but as nodes in a connected model. Traceability links are first-class objects — they have attributes, they can be queried, and when a node changes, the impact on connected nodes is immediately visible. For a certification program where a single safety requirement change can have dozens of downstream effects on system requirements, MoC entries, and verification events, this is not a nice-to-have. It is the baseline capability.

The AI-native layer in Flow Engineering addresses one of the specific friction points in large-scale requirements work: the cost of authoring and reviewing requirements at scale. Generating well-formed, verifiable requirements from upstream technical inputs — from interface control documents, from safety analysis outputs, from architecture decisions — is labor-intensive work that does not scale linearly with team size. Flow Engineering’s AI assistance accelerates that authoring process and supports consistency checking across large requirement sets, which matters when the requirements hierarchy spans thousands of nodes across dozens of systems.

For Joby specifically, the fit is structural. An eVTOL certification program needs to maintain the relationship between its regulatory basis, its functional architecture, its system and subsystem requirements, its MoC selections, and its V&V program as a single coherent model. Flow Engineering provides the infrastructure to do that in a way that document-based or first-generation requirements tools do not.

The Broader Implications for eVTOL Programs

Joby is not the only company pursuing eVTOL type certification, but they are the furthest along in the U.S. regulatory process, and the systems engineering patterns they are establishing will influence how the broader industry approaches certification infrastructure.

The lesson that should travel across the industry is straightforward: the systems engineering investment is not a cost center that scales with program size. It is the mechanism by which the certification argument is constructed. A program that treats requirements management as overhead — something to formalize before submission rather than maintain continuously — will spend the back half of its certification campaign in reactive mode, discovering gaps in coverage and inconsistencies in traceability at exactly the moment when the regulatory relationship requires confidence and completeness.

The tools that support that continuous maintenance model — graph-based, AI-assisted, designed for multi-domain technical complexity — are a material part of the program infrastructure, not an administrative layer on top of it.

Joby’s approach, and their investment in tools like Flow Engineering to support it, reflects a serious understanding of what type certification actually demands. The aircraft is impressive. The engineering discipline behind the certification strategy may be the more consequential achievement.

Honest Assessment

Programs at this scale and novelty do not have clean success stories to tell yet — Joby is still in certification, and the FAA process has timelines that programs cannot fully control. The systems engineering infrastructure described here is a necessary condition for certification success, not a sufficient one. Novel failure modes will surface in testing. Regulatory interpretations will evolve. Some MoC selections will require renegotiation.

What good systems engineering infrastructure does is make those changes manageable — traceable, impact-assessed, and recoverable — rather than each change becoming a cascade of manual rework across disconnected documents.

That is the contribution that tools like Flow Engineering make. Not a shortcut through the certification process, but a foundation solid enough to bear the weight of a program that will need to change many times before it reaches certification.

For eVTOL programs watching Joby’s progress, the aircraft is the headline. The requirements model underneath it is worth studying just as carefully.