BVLOS Safety Assurance: What Standard 922 Means for Drone Manufacturers Under Transport Canada’s New BVLOS and Medium Drone Rules

Another timely goal for Transport Canada: The publication of the revised Standard 922. Of course, today is April 1st, and some may think this is a joke. However, it is not.

So, in the summary below, we’ve provided the reader with an overview of the previous Standard 922 self-declaration process and then detailed the revised version.

VLOS Advanced Operations – Self Declaration Summary:

For drone manufacturers looking to sell under the Advanced Category of drone operations in Canada, declaring your drone safe for controlled airspace, near people, and over people was simple. The process? Simply go to the declaration page, fill out a few lines, and you are added to the list.

However, as mentioned in the previous article, this process has been problematic for end users and manufacturers.

For end users, they assume that Transport Canada – Transports Canada has looked at the paperwork in advance. In reality, it is a self-declaration process whereby “you do not need to submit the results of the AC 922-001 Remotely Piloted Aircraft Systems Safety Assurance verification tests along with your declaration of RPAS Safety Assurance. However, you may be asked to produce the results of verification tests at a later date. Failure to produce the results of verification tests when requested may impact the declaration status of your RPAS.”

This has been problematic for end users as they’ve now experienced life when Transport Canada completes an audit and removes the expensive drone you just bought from the list. For example, in 2024, Transport Canada released their oversight report results.

In the image below, you can see how many drone declarations (110) and pilots (1905) were affected by the faulty paperwork. Imagine waking up and finding out you can’t drive your truck to work? This, perhaps, is a joke that should be addressed more proactively.

BVLOS Small & Medium Drones – Self Declaration Summary:

This revised standard “describes the technical requirements that persons making a declaration are required to meet in accordance with section 901.194 of the CARs.” (P.1)

To comply with the new regulations, drone manufacturers must complete declarations and “acceptance letter requirements must be satisfied as listed in Table 1 below.” (P.1):

So, what does this mean? Well, for those manufacturers wishing to sell small or medium drones for BVLOS missions, they must start the Pre-Validated Declaration (PVD) process.

More about the PVD process can be found here and here.

To comply with the PVD declaration process, key points to be aware of are listed below for the three PVD considerations.

901.87(b): Small – BVLOS – Uncontrolled Airspace and Over a Sparsely Populated Area, or 1km From Populated Areas

Sparsely Populated Area:

• means an area with more than 5 but not more than 25 people per square kilometre. (zone peu densément peuplée)

922.07 – Safety and Reliability:

• Must meet reliability targets in the table below, (a) “based on the maximum kinetic energy that can be achieved by the RPA; (b) catastrophic failures conditions are extremely improbable and do not result from a single failure; and, (c) The probability of a failure condition resulting in a severe injury to persons not involved in the operation is shown to be extremely remote.” (P.6-7)
• Structures and components shall be designed to allow for safe operations throughout the operational envelope
• Systems for monitoring and warnings used to notify the crew must minimize any hazard from unsafe conditions and be designed to minimize pilot error
• “Non-safety critical systems, equipment, and payload shall not adversely affect any safety critical system.” (P.7)

922.09 Command and Control Link Reliability and Lost Link Behaviour:

• The drone must be designed so that (a) “probability of occurrence of any combination of failures which may result in a loss of control of the RPA at any point in flight is shown to be remote or less” and the drone “behaves predictably and consistently if positive control is lost and in a manner that assists pilots in minimizing the probability the RPA will create a hazard” (P.8)

922.10 Detect, Alert, and Avoid Systems:

• Annunciated loss of function shall be shown to be remote.
• Un-annunciated loss of function or hazardously misleading shall be extremely remote.
• “The means to detect conflicting occupied air traffic and take action to avoid them must be shown to meet the following system risk ratios” (P.9)
• “*When an operation is performed in atypical airspace as defined in AC903-001, or if an operation is performed in accordance with Standard 923 – Vision Based DAA (as per CAR 901.97(2)), then a declaration against standard 922.10 is not required.” (P.4)

922.11 Control Station Design:

• This section is focused on systems and equipment for crew members.
• This section intends to ensure safe operations by the crew members and has the four requirements that can be summarized by (1) Controls must allow for safe operations, (2) Controls must be clear, accessible, and enable crew awareness, (3) Equipment operations must be predictable and allow for pilot intervention, and (4) Crew must be able to manage reasonable/practical errors.

922.12 Demonstrated Environmental Envelope:

• This section describes the environmental envelope in which the drone can be safely flown. For Canadians, it is great to see that Transport Canada recognizes that some drones may not cut it in our sparsely populated environments in winter months.
• This part of the regulations requires ground and flight testing.
• Testing shall include the following minimum requirements: “(a) account for all configurations and for all phases of flight of the RPAS, including acceptable failures or degradation of components and systems and any environmental factors specific to the concept of operation(s, (b) include the operationally safe range for: (i) meteorological conditions, (ii) any other external factors specific to the concept of operations that may adversely affect safety of the operation, (iii) EMI and HIRF, and (iv) external factors that may adversely affect safety such as g-loading, aircraft attitudes, crosswind, night, operating latitude, urban airflow, proximity to items of inspection or to infrastructure, (c) account for inadvertent exceedance of the demonstrated environmental envelope before detection can be realized and corrected and where the limiting condition cannot be prevented, and (d) any safety related limitations for storage and transportation.” (P.11-12)

901.69(f): Medium – VLOS – Operation at a Distance of Less than 500ft (152.4m) But More than 100ft (30m) From Any Person Not Involved in the Operation.

922.07 – Safety and Reliability:

• Must meet reliability targets in the table below, (a) “based on the maximum kinetic energy that can be achieved by the RPA; (b) catastrophic failures conditions are extremely improbable and do not result from a single failure; and, (c) The probability of a failure condition resulting in a severe injury to persons not involved in the operation is shown to be extremely remote.” (P.6-7)
• Structures and components shall be designed to allow for safe operations throughout the operational envelope
• Systems for monitoring and warnings used to notify the crew must minimize any hazard from unsafe conditions and be designed to minimize pilot error
• “Non-safety critical systems, equipment, and payload shall not adversely affect any safety critical system.” (P.7)

901.69(g): Medium – VLOS – Operation at a Distance of Less than 100ft (30m) From Any Person Not Involved in the Operation.

922.07 – Safety and Reliability:

• Must meet reliability targets in the table below, (a) “based on the maximum kinetic energy that can be achieved by the RPA; (b) catastrophic failures conditions are extremely improbable and do not result from a single failure; and, (c) The probability of a failure condition resulting in a severe injury to persons not involved in the operation is shown to be extremely remote.” (P.6-7)
• Structures and components shall be designed to allow for safe operations throughout the operational envelope
• Systems for monitoring and warnings used to notify the crew must minimize any hazard from unsafe conditions and be designed to minimize pilot error
• “Non-safety critical systems, equipment, and payload shall not adversely affect any safety critical system.” (P.7)