AAE5304 Chap.8 Containment, OSOs and the Safety Portfolio
Containment, OSOs and the Safety Portfolio
Translate risk into assurance
Containment addresses fly-away beyond the operational volume and considers SAIL, adjacent exposure and assemblies.
Operational Safety Objectives translate SAIL into robustness across competence, manufacture, maintenance, design, links, procedures, crew and environment.
Match evidence to the claim
A real document can still be insufficient when its scope, configuration, acceptance criterion or assurance does not match the requirement.
The operator owns compliance while other organisations may supply evidence.
Close with a linked portfolio
The comprehensive safety portfolio joins the operational description, safety claims, derived requirements, compliance proof and document links.
Change control keeps those links valid after approval.
Separate containment layers
Prevention controls seek to keep the aircraft inside the operational volume, detection controls reveal a developing deviation, and recovery or termination limits the consequence. Grouping all three under one label hides different failure modes.
State which layer acts first, how failure is detected and what remains available afterward. Adjacent exposure and assemblies then determine the robustness required of the complete containment argument.
Test evidence with three questions
Does the item address the correct requirement? Does it represent the installed configuration and operating environment? Is its assurance strong enough for the required robustness?
A manufacturer range statement can be relevant while omitting antenna orientation, obstruction, interference, latency and lost-link thresholds.
A genuine certificate or manual remains inadequate when it answers another configuration, role or acceptance criterion.
Assign ownership without losing operator responsibility
Designers, manufacturers and training organisations may produce evidence, but the operator must show how it closes the operational requirement.
Each compliance row should identify requirement owner, evidence producer, reviewer, configuration reference and acceptance criterion.
The roles prevent a supplier from assuming integration was checked while the operator assumes the component report already covers the installed system.
Make the portfolio navigable in both directions
From each credited control, trace to risk reduction, operating procedure, responsible role, training or maintenance record, acceptance evidence and change trigger.
Then reverse the test: every claimed reduction should lead back to a controlled implementation. Presence of all expected documents is not enough when names, configurations or assumptions conflict. Broken links identify gaps that a document checklist cannot.
What this chapter covers
- 01
Fly-away containment
- 02
Adjacent area exposure
- 03
Operational Safety Objectives
- 04
Integrity and assurance
- 05
Comprehensive Safety Portfolio
- 06
Compliance matrix and change control
Worked example · free
Reject incomplete command-link evidence
- 3State the operational command-link claim.
- 3Identify scope and assurance gaps.
- 3Name the evidence needed for closure.
Key terms
- Containment
- The controls that limit consequences when an aircraft departs its intended volume.
- Safety Portfolio
- The linked operational, technical, personnel and organisational evidence supporting a safety case.
- Change Control
- The process that identifies which safety claims must reopen after an approved change.
Containment, OSOs and the Safety Portfolio FAQ
What happens if containment needs a larger buffer?
A larger buffer can change population exposure and therefore the ground-risk classification used earlier. Return to the geometry and GRC analysis, update the inputs and carry any revised result through SAIL and containment. Updating only the map breaks the dependency chain.
Who supplies Operational Safety Objective evidence?
The operator remains responsible for showing compliance, while designers, manufacturers, maintenance providers and training organisations may supply specific evidence. The matrix should name each dependency, configuration and acceptance criterion so supplier material is not mistaken for automatic closure.
What belongs in the Comprehensive Safety Portfolio?
It contains the final operational description, all safety claims and credited mitigations, derived GRC, ARC, SAIL, containment and OSO requirements, compliance evidence and the links between them. A final matrix maps each requirement to proof at the demanded robustness.
What does a stale evidence link mean?
It remains an open compliance gap even when the named document exists, because the current operation is no longer supported by that revision or configuration baseline.
Exam move
Take one mitigation and trace it from risk credit through configuration, procedure, training, maintenance and record. Then change the aircraft software or route and list the claims that reopen. This builds the change-control judgement that a document checklist cannot supply. Add columns for evidence relevance, configuration match and required assurance, and refuse closure when any column is unsupported.
Finally run the trace backward from each risk credit to confirm that the implementation is controlled. Build one OSO row with requirement owner, evidence producer, reviewer, configuration reference, acceptance criterion and closure decision. Divide containment into prevention, detection and recovery, then name a test or record for each layer.
Close by versioning the index against the operational description and checking that every link points to current rather than superseded evidence. The portfolio is complete only when both forward and reverse traces remain intact.
