The safety case behind a declaration: kinetic energy, CONOPS and the DAL

Know what Standard 922.07 requires a declarant to produce — the Notional CONOPS, the worst-case kinetic energy, the reliability targets from Table 1, and the design assurance levels — and know which operations have to go through that process at all.

• You know the operation's class: medium RPAS near and over people, or BVLOS that is not isolated. That is the line the standard is drawn on. Std 922.07
• You know the maximum operating mass of the aircraft, because the whole process starts from the energy it would carry in a worst-case failure. Std 922.07
• You know what a declaration is asserted against: the Standard 922 requirements named in it. CAR 901.194

Two families of operation: VLOS with a medium RPAS near and over people, and BVLOS that is not isolated — the standard names BVLOS over sparsely populated areas, between 5 and 25 people per square kilometre. Std 922.07

At a high level it requires a formal system safety assessment on the RPAS. The reasoning is stated plainly and is worth carrying: a contact above 25 kg with a person or a manned aircraft can be assumed to cause serious injury or death, so a VLOS operation that does not have an adequate standoff distance from people not involved has to demonstrate, through that assessment, that the probability its RPAS creates a hazard to those people is sufficiently low. Std 922.07

Being closer to people is also why the failures matter more here: understanding their probability and criticality is what drives the operational limitations and the mitigations the operation needs. Std 922.07

Compliance begins with a Notional Concept of Operations. It fixes the expected average operation, informs the criticality classifications of the system, and assists the failure effects analysis. Std 922.07

Two properties of it are exam material. It should be the superset of all permitted operations with the RPAS, and a copy is required in the data package when an applicant applies for a pre-validated declaration. Std 922.07

If specific assumptions from the CONOPS are used to lower the hazard classification, those assumptions must appear as operational limitations in the RPAS operating manual. The example given is exact: if the CONOPS assumes that a flight termination system, a parachute system or an independent battery is available for certain operations, a limitation is required for those operations requiring those systems to be installed and operational when the RPAS is flown. Std 922.07

That is the thread back to the paperwork: an assumption the safety case leans on cannot stay inside the analysis. It has to reach the person flying. Std 922.07 CAR 901.200

The specific safety objectives of the standard are based on the RPA's maximum kinetic energy, and the applicant determines the maximum the system is likely to reach after a worst-case failure — in general through an aircraft-level functional hazard assessment that finds which failure or combination produces the highest velocity. Std 922.07

The measure is defined, and the definition is the question: the maximum linear velocity of the aircraft at maximum operating mass. It can exclude the rotational kinetic energy in rotating parts and the chemical potential energy in fuel tanks and batteries. Std 922.07

Why those are excluded is worth one sentence, because it is the reasoning the distractors attack: injury potential from spinning rotors and from fuel or batteries is hard to quantify and depends on the crash, rotors are light and shed their energy over a short distance, and chemical sources release theirs slowly by burning rather than explosively. Linear kinetic energy alone is therefore used as a standardised measure of damage potential, on the intent that the safety criteria themselves cover the other energy sources. Std 922.07

Two limits sit on that measure. The kinetic energy categories used for the standard have an upper limit at 1084 kJ, and applicants are encouraged to contact Transport Canada if their aircraft exceeds it or if other energy sources raise special considerations. Unconventional designs — heavy rotating parts, pressurised fuel tanks, dangerous goods — can invalidate the assumption that linear energy alone is enough, and the safety case then has to be reviewed. Std 922.07

Once the worst-case kinetic energy is known, Table 1 in CAR Standard 922.07 gives reliability targets for the various failure criticality categories. An RPAS-level functional hazard assessment identifies the specific hazard and the failure classification of the aircraft's systems, and a System Safety Assessment then demonstrates that the RPAS as designed meets or exceeds those Table 1 requirements. Std 922.07

The demonstration is not limited to one method: depending on the system's complexity it can rest on in-service experience, accelerated life testing, engineering analysis, fault tree analysis, or other quantitative and qualitative reliability tools. Std 922.07

Development assurance is the collection of processes through which a design is evaluated and reviewed to ensure it functions as expected under safety-critical conditions, and a structured approach to it is expected of a design that complies with the standard's reliability requirements. Std 922.07

Where traditional aviation Design Assurance Levels are applied, Table 2 assigns a Functional Development Assurance Level by failure classification and energy band: Std 922.07

Classification	Objective	Below 700 J	Below 34 kJ	Below 1084 kJ
Catastrophic	Extremely improbable	FDAL D / Tier 3 Std 922.07	FDAL D / Tier 3 Std 922.07	FDAL C Std 922.07
Hazardous	Extremely remote	FDAL D / Tier 3 Std 922.07	FDAL D / Tier 3 Std 922.07	FDAL D Std 922.07
Major	Remote	FDAL D / Tier 2 Std 922.07	FDAL D / Tier 2 Std 922.07	FDAL D Std 922.07
Minor	Probable	FDAL D / Tier 1 Std 922.07	FDAL D / Tier 1 Std 922.07	FDAL D Std 922.07
No safety effect	No requirement	— Std 922.07	— Std 922.07	— Std 922.07

Two rules sit under that table. The DAL dictates the rigour — the type and amount of validation and verification — and where secondary systems are required in the design to meet the safety objectives, the secondary system must be assigned the same DAL as the primary. A lower DAL for the backup is not what the standard provides. Std 922.07

Standard 922.08 is not specifically called out for operations that must comply with this standard, and that does not mean containment is ignored. The analysis of containment capability and of fly-away mitigations is expected to be performed as part of this safety and reliability assessment, and declarants still have to assess their Notional CONOPS for fly-away hazards and confirm those hazards are sufficiently mitigated. Std 922.07 Std 922.08

The process, in the order the standard states it:

• Notional CONOPS developed first, as the superset of permitted operations; a copy goes in the pre-validated-declaration data package Std 922.07
• Assumptions that lower a classification written into the operating manual as operational limitations Std 922.07
• Worst-case kinetic energy determined from the maximum linear velocity at maximum operating mass, with rotational and chemical energy excludable, and 1084 kJ as the upper limit of the categories Std 922.07
• Reliability targets read from Table 1 once the criticality classification is known Std 922.07
• System Safety Assessment demonstrating the design meets or exceeds those targets Std 922.07
• Design assurance assigned from Table 2, with any secondary system carrying the same DAL as the primary Std 922.07

Question	The answer
Which operations?	VLOS with medium RPAS near and over people; BVLOS that is not isolated, including over sparsely populated areas (5–25 people/km²) Std 922.07
What is the first step?	The Notional CONOPS Std 922.07
What is the energy measure?	Maximum linear velocity at maximum operating mass, rotational and chemical energy excludable Std 922.07
Upper limit of the categories?	1084 kJ Std 922.07
Where do reliability targets come from?	Table 1 of CAR Standard 922.07, applied after the functional hazard assessment Std 922.07
DAL of a secondary system?	The same as the primary Std 922.07

Symptom	Likely cause	What to do
The kinetic energy is computed from the crash speed of a test	The measure is defined	Use the maximum linear velocity at maximum operating mass after a worst-case failure Std 922.07
Rotor energy is added "to be safe"	The measure may exclude it, with reasons	Exclude rotational and chemical energy unless the design is unconventional Std 922.07
A CONOPS assumption is used to lower a classification and left there	Assumptions that lower a classification are limitations	Put them in the operating manual Std 922.07
A secondary system is given a lower DAL than the primary	The standard requires the same DAL	Assign the same DAL Std 922.07
Containment is treated as out of scope because 922.08 is not called out	It is assessed inside this standard	Analyse fly-aways as part of the safety and reliability assessment Std 922.07

Practise: Declaration safety and reliability

• AC 922-001 s.922.07 — Safety and Reliability
• AC 922-001 s.922.08 — Containment
• CAR 901.194 — Declaration
• CAR 901.200 — Documentation