Certification effort is not the risk. Underestimating it is. Three programmes make the point at a scale nobody can wave away — and in each, the trouble began in the same unremarkable place: the requirements, and the effort to prove them.
Three programmes, three ways it goes wrong
The failures below are not obscure. Each was investigated in public, and the figures come from official inquiries, regulator filings, and mishap boards.
$7.5bn — spent, never certified
The Mitsubishi SpaceJet, launched in 2008 as the MRJ, was cancelled in February 2023 after roughly ¥1 trillion and fifteen years. Eight test aircraft were built; seven were dismantled. It never carried a paying passenger and never obtained a type certificate.
Mitsubishi Heavy Industries stated plainly that it had underestimated the complexity of the type certification process. Industry analysis went further, concluding the aircraft was effectively uncertifiable as designed — forcing late redesign of crucial elements once the certification requirements were properly understood. Japan's Ministry of Economy, Trade and Industry opened an inquiry into how a trillion yen was consumed without a certificate to show for it.
It is worth being fair about cause: the aircraft also exceeded the weight limits set by US pilot-union scope clauses, which closed off the regional market it was built for. Certification inexperience and a market miss compounded. But the certification story is the one that ran for fifteen years.
$7bn+ — an overrun larger than the contract
Boeing's KC-46A Pegasus tanker was a fixed-price contract originally worth $4.9bn. By the end of 2020, the cost overruns alone had already exceeded that entire original value, and they have kept growing since. The company's own chief executive described it as a bad contract for the last decade.
The persistent driver is the Remote Vision System — the camera, sensor, and display chain the boom operator flies the refuelling boom by. Boeing's own 10-K filings name schedule delays to complete the Remote Vision System among the causes of the losses. The replacement, RVS 2.0, has slipped repeatedly and is now expected around 2027: roughly a decade of rework concentrated in one software-intensive subsystem.
$1bn — avionics rework that outlived the company
Eclipse Aviation filed for bankruptcy in November 2008 with more than a billion dollars in liabilities, and liquidated. It had built 260 aircraft against projections of thousands.
The avionics thread runs straight through the failure. The original avionics suite was abandoned in 2007 and replaced by a successor, then retrofitted across aircraft that had already been delivered — many of them shipped without the avionics capability their customers had bought. An uncommanded engine surge prompted an FAA special review of the certification itself. Eclipse had other problems too — an engine supplier change, price escalation, the 2008 financial crash — but the avionics rework was a significant thread, and it was never finished in time to matter.
Where the money actually goes
Read those three together and a pattern appears. None of them was destroyed by a single dramatic defect. Each was worn down by the sheer cost of producing, reworking, and re-establishing the evidence that a system was safe — evidence that had to satisfy a regulator who was not obliged to take anything on trust.
This is why airborne software is measured in lines per day rather than lines per hour. Writing the code is the minority of the work. The bulk is the evidence around it: plans agreed before development starts, high- and low-level requirements each independently reviewed, requirements-based tests with structural coverage, bidirectional traceability across every layer, and change control that survives audit. Industry estimates put the DO-178 overhead at roughly 30 to 150 percent on top of ordinary development, depending on assurance level and on how well the team was set up to begin with.
And the single most expensive line item is rarely technical. It is rework: evidence rebuilt because it was never captured as the work happened, traceability reconstructed the week before an audit, and reviews repeated because the records did not show what was actually checked. That is where a programme quietly loses the months it cannot get back.
The expensive part, in one sentenceThe programmes that survive are the ones that treated evidence as something to accumulate from day one — not as a document set to assemble once the engineering was done.
It begins at requirement review
The cost does not announce itself as a billion-dollar overrun. It begins much smaller, in a place every team recognises: the requirement review. Each requirement checked by hand against its upstream requirements, its checklists, and the applicable standard — review after review, cycle after cycle, the result depending on who happens to be reviewing that day.
On its own, one review is a morning's work. Multiplied across thousands of requirements, repeated every time something changes, and reconstructed whenever an auditor samples a requirement whose trail has gone cold, it becomes the quiet tax that the programmes above paid until they could not. The failure mode is not exotic. It is ordinary overhead that nobody costed honestly at the start.
The way out is not heroics. It is keeping the requirement, its reviews, its change authorisations, and the evidence that verifies it on a single thread — so review effort accumulates instead of repeating, and a requirement change is a lookup rather than archaeology. That is the problem PES was built around, and it is where the certification cost you can actually control — the rework you never have to do — is won or lost.
