Containment: keeping the aircraft inside the volume the operation was planned around

Know what the containment standard requires, which operations have to declare it, which of the two robustness levels they declare against, and why a fly-away is the failure the whole standard exists to answer.

• You know the operational volume of the operation you fly, since that volume is the thing containment is measured against. CAR 900.01
• You can tell the small class from the medium class by operating weight, because the containment declarations are split along that line. CAR 901.87
• You know whether the operation is VLOS or BVLOS, and whether it is conducted more or less than 1 km from a populated area. CAR 901.87

The standard is applied to operations where most of the risk mitigation comes from being far from people — on the ground or in the air. Distance is doing the work, so the thing that destroys the mitigation is the aircraft leaving the place it was supposed to be: a fly-away loses most of the safety margin the operation was built on. Std 922.08

The containment standard exists to give confidence that the operation will keep the RPA inside its operational volume, and it is that sentence the questions are built on. Std 922.08

Containment is not measured against the pilot's intentions but against the volumes the Regulations define: CAR 900.01

Term	What it is
Operational volume	The area composed of the flight geography, the contingency volume and the ground risk buffer CAR 900.01
Ground risk buffer	The area immediately surrounding the contingency volume that, measured horizontally from that volume's perimeter, is at least the planned maximum altitude of the aircraft CAR 900.01

An aircraft that flies out of the operational volume has left all three of those areas at once, and that is the event the standard requires the design to make improbable. Std 922.08

Two VLOS cases are named directly, and both come from the same reasoning: Std 922.08

• VLOS with a medium RPAS, more than 500 ft from persons not involved in the operation. Many of these are design and development flights of prototype systems, and before the first flight the declaration must be made against the low robustness requirements of 922.08(1) and (2). Std 922.08
• VLOS in controlled airspace with an RPA between 25 kg and 150 kg, where the low robustness requirement applies as well. Those flights already need a declaration against Standard 922.04 and a permission and coordination from the airspace controlling authority, and the strategic mitigations that go with controlled airspace — maintaining VLOS, giving way to traditional aircraft, not creating a hazard — are what keep the risk low regardless of size. Std 922.08 CAR 901.71

That second case is the one to read twice: the containment declaration there is a medium-aircraft requirement, not something a small RPAS in controlled airspace has to add. AIM 3.4.4

The standard is not applied where the operation requires the safety and reliability standard, 922.07 — containment is best understood as a subset of the full system safety analysis. Std 922.08 Std 922.07

Not being called out is not the same as not applying, though. For operations that go through 922.07, the analysis of containment capability and of fly-away mitigations is performed inside the 922.07 safety and reliability assessment, with the same kinds of safety assessment and design assurance but with the focus on the specific failure of a fly-away. Std 922.08 Std 922.07

The command and control link standard draws the same line from its side: Basic Operations mitigate the hazard that a lost C2 link leads to a loss of control by their standoff distance from people and by compliance with 922.08, while other VLOS operations — the medium-aircraft operations near and over people — are expected to analyse a C2 link failure in the 922.07 process instead. Std 922.09

Both robustness levels carry the same core rule: no single failure may result in a fly-away of the RPA. The containment means therefore has to be independent of any system that could itself cause a fly-away. Std 922.08

The example the circular gives is the one worth remembering. A flight termination system that relies on the C2 link for activation does not meet the single-failure rule: a failure of that link would remove both the ability to control the aircraft and the ability to terminate it, so the operator is left with no means of ensuring containment. A termination system that safely ends the flight after a link failure can be acceptable, but the analysis then has to exclude common cause failures — the radio and the termination system must not, for instance, share a power source. Software and electronic hardware errors are treated the same way: the systems that prevent a fly-away have to be isolated from faults in the rest of the system. Std 922.08

The two levels differ in what must be shown, not in the single-failure rule. Std 922.08

• Low robustness can be met at the most basic level by limiting the energy the aircraft carries — an RPAS with ten minutes of endurance inside a volume that is more than ten minutes at maximum speed from any edge cannot leave that volume after a failure. More realistically it is met by a system safety analysis focused on failures that could take the aircraft out of the volume with the operator unable to stop it — loss of the C2 link while the system holds heading and altitude, or a navigation-sensor failure flying it out — and by independent redundancy that takes over or terminates the flight safely. Std 922.08
• High robustness adds two things: no single failure may cause a fly-away and any combination of failures that leads to one must be remote, shown through an FMEA and a system safety assessment; and design assurance on the hardware and software whose fault could lose containment, through a design process based on an industry standard such as DO-178/254 or ASTM F3201-16. Std 922.08

The AIM's declaration list is where the levels become concrete for the operations this applies to. For BVLOS in uncontrolled airspace at least 1 km from a populated area — the operation the Regulations describe in paragraph 901.87(a) — a small RPA declares against 922.08(1, 2), the low robustness requirements, while a medium RPA declares against 922.08(3, 4, 5, 6), the high robustness ones. AIM 3.4.4 CAR 901.87

A containment question is answerable from four facts:

• The purpose: confidence that the RPA stays inside the operational volume, because in these operations distance from people is most of the risk mitigation and a fly-away spends it Std 922.08
• The volume: flight geography + contingency volume + ground risk buffer, the buffer being at least the planned maximum altitude measured horizontally from the contingency volume CAR 900.01
• The rule: no single failure may result in a fly-away, and the containment means must be independent of anything that could cause one Std 922.08
• The declaration band for the operation, low or high robustness AIM 3.4.4

Operation	Containment declaration
VLOS, medium RPA, more than 500 ft from uninvolved persons	Low robustness, 922.08(1) and (2), before first flight Std 922.08
VLOS in controlled airspace, RPA 25 kg to 150 kg	Low robustness — medium RPA only AIM 3.4.4
BVLOS more than 1 km from a populated area, small RPA	922.08(1, 2) — low robustness AIM 3.4.4
BVLOS more than 1 km from a populated area, medium RPA	922.08(3, 4, 5, 6) — high robustness AIM 3.4.4
Any operation that requires Standard 922.07	Not applied as a separate declaration; the fly-away analysis sits inside the 922.07 assessment Std 922.08

Symptom	Likely cause	What to do
A question asks what containment gives confidence in	The standard's own purpose sentence	The RPA staying inside the operational volume Std 922.08
A question says a small RPA in controlled airspace needs 922.08	The controlled-airspace containment declaration is medium-only	Check the aircraft class first AIM 3.4.4
Containment is assumed not to apply because 922.07 applies	"Not called out" is not "not applicable"	Perform it inside the 922.07 assessment Std 922.08
A termination system is armed over the C2 link and offered as containment	One failure would remove control and termination together	Make the containment means independent Std 922.08
The ground risk buffer is measured from the flight geography	It surrounds the contingency volume	Measure horizontally from the contingency volume perimeter CAR 900.01

Practise: Containment

• AC 922-001 s.922.08 — Containment
• AC 922-001 s.922.07 — Safety and Reliability
• AC 922-001 s.922.09 — Command and Control Link Reliability and Lost Link Behaviour
• CAR 900.01 — Interpretation (operational volume; ground risk buffer)
• CAR 901.71 — Authorization to Operate in Controlled Airspace
• CAR 901.87 — Application (Division VI)
• TC AIM RPA 3.4.4 — RPAS Safety Assurance Declaration