ETSO-C146e A1

1.SCOPE

This Appendix describes the required supplementary equipment level testing, in addition to the environmental testing of RTCA document DO-229E, Section 2.4, that the manufacturer of end-use equipment is required to conduct to receive an ETSO-C146e Class Delta-4 authorisation when using an ETSO-2C205a Delta CCA functional sensor.

To perform functional tests and to measure the performance in the environment, the applicant will use the detailed functional test procedures delivered with the ETSO-2C205a CCA. These test procedures are intended to streamline and simplify the ETSO-C146e authorisation process for the manufacturer of the end-use equipment by allowing credit for the design and for selected testing performed at the Delta CCA functional sensor level. However, the manufacturer of the end-use equipment remains fully responsible for the design and control of the article per their ETSO-C146e ETSOA.

2.GENERAL PRINCIPLES

(a)Testing methods for GPS/SBAS equipment have been standardised by RTCA document DO-229E, and serve as the basis for ETSO-C146e. RTCA document DO-229E was written to cover equipment that can be installed on aircraft. Section 2.4 specifically addresses the issues of the environment in which the equipment operates, and provides the approved test methods to validate its performance in this environment. Section 2.4 represents the RTCA consensus in identifying which RTCA document DO-229E requirements are sensitive to environmental effects. These requirements are listed in the environmental tables referenced in Section 2.4.1.

(b)The determination that a MOPS requirement is susceptible to the environment does not depend on whether or not the implementation is a CCA installed within ETSO-C146 article. This is the same concept as an equipment enclosure that is designed to protect against a benign environment compared with one designed for a severe environment; the identification of the susceptible requirements is the same.

(c)Therefore, this Appendix uses the tables of RTCA document DO-229E, Section 2.4.1, to identify the MOPS requirements that are susceptible to environmental conditions for a Delta CCA functional sensor in the end-use equipment. The focus is on the change in environment seen by the Delta CCA functional sensor as a result of its installation in the end-use equipment. For example, other components inside the end-use equipment may radiate RF energy that could interfere with the GPS functions; therefore, the ambient testing performed at the CCA level is not equivalent to tests performed in the end-use equipment. This is the basis for defining the RTCA document DO-229E Section 2.5 performance tests that need to be repeated by the manufacturer of the end-use equipment.

(d)The Class Delta-4 environmental table referenced in RTCA document DO-229E, Section 2.4.1, is the prime source to determine the MOPS performance requirements that are susceptible to environmental conditions. Based on that table, Class Delta-4 has the same susceptible requirements as Class Beta, but adds two additional requirements for navigation displays and databases that are optional capabilities for Class Delta-4. Those Delta-4 requirements that are similar to those for Class Beta can be grouped in two categories: those that are susceptible to most types of environmental conditions (described in Section 3) and those that are susceptible to only a few (described in Section 4).

(e)The options for databases and navigation displays in Delta-4 equipment do not present any repeat MOPS testing requirements for a manufacturer who incorporates an ETSO-2C205a Delta CCA functional sensor in its ETSO-C146e article. The environmental qualification performed by the end-use equipment manufacturer according to ETSO-C146e is sufficient. The rationale is stated below.

(1)The database requirement testing in the environment is meant to ensure that the database storage hardware, which may be separate, is fully functional during the environmental testing. As the pass criterion for such testing is that the retrieved data is correct, the test procedures in the environment are as sensitive to hardware issues as any ambient environment test. Therefore, nothing justifies repeating the tests under ambient conditions in the end-use equipment.

(2)Manufacturers of end-use equipment that includes a database must perform the environmental qualification specified by ETSO-C146e and MOPS Section 2.4 irrespective of whether the database is hosted in the Delta CCA functional sensor or elsewhere in the equipment.

(3)It is impossible for the Delta CCA functional sensor to incorporate a display or to be a display.

3.PERFORMANCE REQUIREMENTS THAT ARE SUSCEPTIBLE TO MOST ENVIRONMENTAL CONDITIONS The RTCA document DO-229E requirements for accuracy (Section 2.1.5.1), and sensitivity and dynamic range (Section 2.1.1.10) are sensitive to most environmental conditions. However, these requirements are linked to the message loss rate requirement in Section 2.1.1.3.2. Sections 3.1 and 3.2 below identify the testing that manufacturers of end-use equipment are required to repeat to demonstrate that the Delta CCA functional sensor continues to meet the accuracy, dynamic range and message loss rate performance requirements after installation in the end-use equipment. All the tests shall be run under conditions in which the functions of the end-use equipment are fully enabled to create the worst-case environment.

3.1. RTCA document DO-229E — 2.5.8 Accuracy Test

(a)The accuracy test described in Section 2.5.8 is actually a joint test that covers accuracy, sensitivity and dynamic range. This joint testing also applies in the environment as stated in Section 2.4.1.1.5, with the environmental adaptations as described in Section 2.4.1.1.1.

(b)The demonstration of accuracy is performed in accordance with Section 2.5.8.1 only for the test case with broadband external interference noise. This test must be repeated when the CCA is installed in the end-use equipment, and it is sufficient to perform it using broadband interference.

(1)The environmental testing is limited to broadband interference, as it represents the worst-case signal-to-noise condition, which is the most sensitive to environmental effects. This applies equally to the environment for the CCA that is created by the end-use equipment.

(2)Section 2.5.8 contains a measurement accuracy test in Section 2.5.8.1, with the detailed test procedure in Section 2.5.8.2. The Section 2.5.8.1 test must be run under the worst-case environment identified in the section on ‘Additional considerations for internal interference sources’ below. The measurement accuracy testing can be combined with the message loss rate testing in Section 2.5.2.1.

(3)Section 2.5.8.3 is a 24-hour actual satellite accuracy test. The Section 2.5.8.3 test exposes the equipment to a variety of signal conditions and data-processing conditions over varying satellite geometries that will increase the confidence that no unforeseen interactions between the components within the end-use equipment and the Delta CCA functional sensor will go undetected. The 24-hour testing in Section 2.5.8.3 can be combined with the 24-hour message loss rate testing in Section 2.5.2.4 (see the section on ‘Additional considerations for internal interference sources’).

(4)Section 2.5.8.4 (SBAS Tracking Bias) is an analysis of the GPS hardware, and it is therefore not necessary to repeat it at the end-use equipment level provided that no extra RF components that affect the RF filtering response are inserted into the RF path. Otherwise, the manufacturer of the end-use equipment must also repeat the SBAS Tracking Bias test.

(c)The test threshold is relaxed from 110 % to 125 % as specified in Table 2-25 of the Section 2.5.8.2.1 test procedure to shorten the duration of the test. However, the Section 2.5.8 testing (excluding the SBAS Tracking Bias test in 2.5.8.4) for the CCA in the end-use equipment shall be under ambient conditions per Section 2.5, with the 110-% test pass threshold for maximum test sensitivity.

(d)The Section 2.5.8 testing (excluding the SBAS Tracking Bias test in Section 2.5.8.4) should be repeated against the accuracy requirement in Section 2.1.5.1.

(e)Only the test case for broadband external interference noise using minimum satellite power will be executed in most cases to shorten the duration of the test. The Section 2.5.8.1 testing will be repeated for both the minimum and the maximum satellite power only for the worst-case environment.

3.2. RTCA document DO-229E — 2.5.2 Message Loss Rate Test

(a)Section 2.5.2 specifies the message loss rate test for the 2.1.1.3.2 message loss rate requirement. This test is conducted in conjunction with the Section 2.5.8 accuracy testing. Section 2.5.2.2 defines the test procedure to collect data that verifies the SBAS message loss rate in the presence of interference using the test cases in which the SBAS satellite is at minimum power. Section 2.5.2.3 defines the pass-fail criteria.

(b)The test in Section 2.5.2.2 will be performed during the measurement accuracy broadband interference test case described in paragraph 3.1.

(c)The test procedure in Section 2.5.2.4.1 is run in conjunction with the 2.5.8.3 24-hour accuracy test. Section 2.5.2.4.2 defines the pass-fail criteria for the test case described in paragraph 3.1(b)(3).

4.PERFORMANCE REQUIREMENTS PARTIALLY SUSCEPTIBLE TO ENVIRONMENTAL CONDITIONS

(a)The Class Delta-4 Table 2-20 in Section 2.4.1 of RTCA document DO-229E indicates that the requirements for initial acquisition time (2.1.1.7) and satellite reacquisition time (2.1.1.9) are sensitive to four environmental conditions: icing, lightning-induced transient susceptibility, lightning direct effects, and normal/abnormal operating conditions. The requirements for loss of navigation (Sections 2.1.1.13.2, 2.1.5.12.2, and 2.3.6.2) are sensitive to low and high operating temperatures.

Note: Class Delta-4 provides deviation guidance only during the final approach segment of an LP/LPV approach, in which a loss of integrity is treated as a loss of navigation capability.

(b)The lightning-induced transient susceptibility, lightning direct effects or icing environmental conditions are not pertinent to the environment created by the end-use equipment relative to the Delta CCA functional sensor. However, the manufacturer of the end-use equipment remains responsible for meeting the overall environmental qualification at the end-use equipment level.

(c)Loss of navigation indications are limited to temperature testing, and the information in RTCA DO-229E, Sections 2.4.1.1.2 and 2.4.1.1.3, is appropriate. The purpose is to ensure that the interface that is used to indicate the loss of navigation is functional under the environmental conditions that are present after the Delta CCA functional sensor is installed in the end-use equipment. Sections 2.4.1.1.2 and 2.4.1.1.3 indicate that any source that generates the indication can be used, since it is the interface, and not the detection mechanism, that is verified. The temperature testing performed at the end-use equipment level is the worst-case scenario. It is not necessary to repeat the CCA level test at room temperature in the end-use equipment since the environmental qualification adequately addresses testing for these requirements.

Note: The Class Delta table requires more than just temperature testing under environment to support the optional display component of Class Delta. Since a CCA cannot be a display or incorporate a display, the additional testing in the environment does not apply.

(d)EUROCAE ED-14 Section 16 relates to aircraft power supplies (refer to ETSO paragraph 3.1.2 for the environmental qualification requirements). Sections 16.5.1.2 and 16.6.1.2 are for supply voltage modulation (AC)/ripple (DC). Given the potential susceptibility of the Delta CCA functional sensor to power supply noise, it is prudent to repeat the tests at the end-use equipment level on this basis.

(e)Sections 4.1 and 4.2 identify the testing that manufacturers of end-use equipment are required to repeat to demonstrate that the Delta CCA functional sensor continues to meet the acquisition time and reacquisition time performance requirements relative to the normal/abnormal operating conditions after installation in the end-use equipment.

All tests shall be run under conditions where the functions of the end-use equipment are fully enabled to create the worst-case environment.

4.1. RTCA DO-22 z9E — 2.5.4 Initial acquisition test procedures

The information in RTCA document DO-229E, Section 2.4.1.1.4, on the initial acquisition test in Section 2.5.4 applies. The manufacturer of the end-use equipment shall repeat the initial acquisition testing described in RTCA document DO-229E, Section 2.5.4.

4.2 RTCA DO-229E — 2.5.6 Satellite reacquisition time test

The manufacturer of the end-use equipment is required to repeat the satellite reacquisition time testing in RTCA document DO-229E, Section 2.5.6.

5.ADDITIONAL CONSIDERATIONS FOR INTERNAL INTERFERENCE SOURCES

(a)Installing a Delta CCA functional sensor into end-use equipment that also includes other functions requires a careful evaluation of the potential internally radiated and conducted interference. The manufacturer of the end-use equipment must evaluate each operating mode to determine whether the mode changes the environment for the installed Delta CCA functional sensor. If there is only one environment or there is clearly one worst-case environment, then the accuracy and message loss rate testing in Section 3 can be run in that operating mode only. For example, if the end-use equipment includes an RF transmitter that radiates at one frequency, one could reasonably argue that setting the transmitter at full power with maximum data throughput would generate a clear worst-case environment in which to run all the testing.

(b)In the case of multiple environments, the accuracy and message loss rate tests can either be run under each environment or the methodology in RTCA document DO-229E, Section 2.4.1.2.3, can be used to run an aggregate test with approximately equal time in each mode. The methodology in Section 2.4.1.2.3 must be used to identify the modes with the greatest susceptibility under which the combined accuracy and message loss rate tests are repeated in addition to the aggregate test. For example, the methodology of Section 2.4.1.2.3 is appropriate for end-use equipment that contains a high-power transmitter that operates on a large number of frequencies such that it is impractical to run a test at each frequency. This is analogous to the large number of frequencies that need to be tested during the EUROCAE ED-14 Section 19 testing on induced signal susceptibility and the Section 20 testing on radio frequency susceptibility, and this is the reason why the methodology of Section 2.4.1.2.3 was developed.

(c)It is sufficient to identify one worst-case environment when performing the acquisition and 24-hour accuracy testing.

6.SUMMARY

(a)The manufacturer of the end-use equipment that incorporates a Delta CCA functional sensor is required to repeat the following RTCA document DO-229E Section 2.5 testing under ambient conditions (see Section 5) after installing the Delta CCA functional sensor in the end-use equipment:

The Section 2.5.8 Accuracy testing (excluding the SBAS Tracking Bias test in 2.5.8.4) adapted per Section 2.4.1.1.1, except that the 110-% test pass threshold is used.

Note: Excluding the SBAS Tracking Bias test is acceptable, provided that the end-use equipment does not insert into the RF signal path any components that affect the filtering response. Otherwise, the manufacturer of the end-use equipment must also repeat the SBAS Tracking Bias test.

The Section 2.5.2 message loss rate test.

The Section 2.5.4 initial acquisition test.

The Section 2.5.6 satellite reacquisition time test.

(b)The manufacturer of the end-use equipment remains responsible for completing a full environmental qualification evaluation (see ETSO Section 3.1.2) at the end-use equipment level. The manufacturer of end-use equipment that incorporates a Delta CCA functional sensor is required to repeat the loss of navigation indication and loss of integrity indication testing as part of the environmental qualification according to RTCA document DO-229E, Sections 2.4.1.1.2 and 2.4.1.1.3.

[Amdt ETSO/13]

[Amdt ETSO/16]

This Appendix describes the required modifications and additions to RTCA document DO-229E for compliance with this ETSO. This Appendix adds a new Section 1.8.3 on cybersecurity and GNSS spoofing mitigation and additional required leg types in Section 2.2.1.3 of RTCA document DO-229E.

The new Section, 1.8.3, contains no new requirements but provides information for cybersecurity and spoofing mitigation to make RTCA document DO-229E consistent with the new RTCA MOPS template and RTCA document DO-253D, Minimum Operational Performance Standards for GPS Local Area Augmentation System Airborne Equipment.

The new 2.2.1.3 leg type requirements are applicable to Class Gamma equipment only and are necessary to properly execute published instrument procedures designed to provide maximum efficiency, flexibility, and aircraft eligibility. These instrument procedure designs may include RNAV components and/or leg types associated with conventional procedures. The modifications and additions to Section 2.2.1.3 are necessary to ensure Class Gamma equipment can properly execute current and future instrument procedure designs.

1.8.3 Cybersecurity and GNSS Spoofing Mitigation

This section contains information to address intentional interference with the GNSS. Spoofing is caused by RF waveforms that mimic true signals in some ways, but deny, degrade, disrupt, or deceive a receiver’s operation when they are processed. Spoofing may be unintentional, such as effects from the signals of a GNSS repeater, or may be intentional and even malicious. There are two classes of spoofing. Measurement spoofing introduces RF waveforms that cause the target receiver to produce incorrect measurements of time of arrival or frequency of arrival or their rates of change. Data spoofing introduces incorrect digital data to the target receiver for its use in processing of signals and the calculation of PNT. Either class of spoofing can cause a range of effects, from incorrect outputs of PNT to receiver malfunction. The onset of effects can be instantaneous or delayed, and the effects can continue even after the spoofing has ended. Improperly used or installed GNSS re-radiators act like spoofers. Re-radiators, replay and GNSS emulator devices can present misleading information to GNSS equipment and/or could cause lasting effects.

Equipment manufacturers should implement measures to mitigate processing of erroneous data. Cross-checks of GNSS sensor data against independent position sources and/or other detection monitors using GNSS signal metrics or data checks can be implemented in the antenna, receiver, and/or through integration with other systems at the aircraft level. Data validity checks to recognize and reject measurement and data spoofing should be implemented in the receiver. Additional guidance and best practices related to GNSS equipment can be found in the U.S. Department of Homeland Security document ‘Improving the Operation and Development of Global Positioning System (GPS) Equipment Used by Critical Infrastructure’ and GLOBAL POSITIONING SYSTEMS DIRECTORATE SYSTEMS ENGINEERING & INTEGRATION: INTERFACE SPECIFICATION, IS-GPS-200, Navstar GPS Space Segment/Navigation User Interfaces, Revision H, IRN-IS-200H-003 28 July 2016.

Aircraft equipment information vulnerabilities (such as cybersecurity risks) have been present for digital systems since the development of the personal computer (PC) in the late 1970s and even longer for RF systems, and the advent of internet connectivity has substantially increased those risks. Typically, access to navigation receivers has been controlled such that they are considered to be vulnerable only through RF signals and OEM and/or aircraft operator controlled processes for maintenance and updates. In some cases, aircraft GNSS receivers may be field loadable by approved personnel, requiring physical access and physical interface to the ground receivers. However, it is expected that not all aircraft in the future will rely on such physical isolation for the security of avionics. Internet and Wi-Fi connectivity have become popular as a means for aircraft or equipment manufacturers to update installed avionics software, to update databases, or provide an alternate means of communicating with the flight crew or cabin (e.g. in-flight entertainment, weather, etc.).

In most countries, the State provides oversight of safety-of-flight systems (sometimes referred to as ‘authorised services’) which provide information to aircraft, such as ILS, VOR, GNSS, and DME, to name a few. However, the State typically does not provide oversight on ‘non-trusted’ connectivity such as the internet, Wi-Fi, or manufacturer-supplied equipment interfaces which permit the input of externally supplied data into aircraft systems. A manufacturer may expose aircraft information vulnerabilities through the design of the equipment, or the equipment may become vulnerable as a result of being connected to a common interface. Therefore, it is important for manufacturers to consider aircraft information security risk mitigation strategies in their equipment design, particularly when the equipment is responsible for an interface between the aircraft and aircraft-external systems.

Apart from any specific aircraft-information-security-related performance requirements that are contained in the MOPS, it is recommended that manufacturers consider a layered approach to aircraft information security risk mitigation that includes both technical (e.g., software, signal filtering) and physical strategies. From a technical perspective, for example, this could include signal spoofing detection capabilities or more stringent, multi-factored authentication techniques such as passwords, PINs, and digital certificates. From a physical perspective, a manufacturer could consider connectors that require special tools to remove them to prevent passenger tampering — although navigation avionics are typically located in an avionics bay inaccessible to passengers. And finally, but just as important, manufacturers should consider supply chain risk management; for example, if a manufacturer outsources the development of software code, is the contractor and its staff properly vetted?

Civil aviation authorities (CAAs) have a regulatory interest when an applicant’s design makes use of a non-trusted connection through which the installation can potentially introduce aircraft information security vulnerability. This requires the applicant to address not only the information security vulnerabilities and mitigation techniques for the new installation, but to also consider how vulnerabilities could propagate to existing downstream systems. Therefore, it is recommended that manufacturers reference their equipment aircraft information security review and mitigation strategies in the installation manual of the equipment so that the applicant can consider them in meeting the regulatory requirements of the installation.

2.2.1.3 Path Definition

Replace the list of required leg types in the first paragraph after the last sentence as shown:

The desired path shall be defined according to the following leg types:

Holding legs

Note 1: There is no intent to require a heading or altitude source connected to the equipment to automatically execute leg types with heading or altitude components. Manual equipment inputs for heading/altitude with manual aircraft control methods are acceptable for these leg types.

Note 2: Cross-track deviation requirements are not applicable for VA, VI, and VM heading leg types.

Replace Section 2.2.1.3.6 as shown and add the following leg type descriptions. Renumber existing paragraphs (starting with 2.2.1.3.7) to account for the newly added sections:

2.2.1.3.6 Fix to Altitude (FA)

An FA leg shall be defined as a specified track over the ground from a database waypoint to a specified altitude at an unspecified position.

[Figure or form omitted from this preview — available in the Avioverse workspace library.]

2.2.1.3.7 Fix to Manual Termination (FM)

An FM leg shall be defined as a specified track over the ground from a database fix until a manual termination of the leg.

[Figure or form omitted from this preview — available in the Avioverse workspace library.]

2.2.1.3.8 Heading to Altitude (VA)

A VA leg shall be defined as a specified heading to a specific altitude termination at an unspecified position. No correction is made for wind.

[Figure or form omitted from this preview — available in the Avioverse workspace library.]

2.2.1.3.9 Heading to Intercept (VI)

A VI leg shall be defined as a specified heading to intercept a subsequent leg at an unspecified position. No correction is made for wind.

[Figure or form omitted from this preview — available in the Avioverse workspace library.]

2.2.1.3.10 Heading to Manual Termination (VM)

A VM leg shall be defined as a specified heading until a manual termination of the leg. No correction is made for wind.

[Figure or form omitted from this preview — available in the Avioverse workspace library.]

2.2.1.3.12 Course to Altitude (CA)

A CA leg shall be defined as a specified course to a specific altitude at an unspecified position. The course is flown making adjustment for wind.

[Figure or form omitted from this preview — available in the Avioverse workspace library.]

2.2.1.3.13 Hold to Altitude (HA)

An HA leg is a holding pattern which terminates at the next crossing of the hold fix when the aircraft altitude is at or above the specified altitude. The altitude is provided by the navigation database. The source of the magnetic variation needed to convert magnetic courses to true courses is detailed in Section 2.2.1.3.12.

2.2.1.3.14 Hold to Fix (HF)

An HF leg is a holding pattern which terminates at the first crossing of the hold fix after becoming established on the inbound course. This is typically after the entry procedure is performed. The source of the magnetic variation needed to convert magnetic courses to true courses is detailed in Section 2.2.1.3.12.

2.2.1.3.14 Hold for Clearance (manual termination) (HM)

An HM leg is a holding pattern which terminates only after flight crew action. The source of the magnetic variation needed to convert magnetic courses to true courses is detailed in Section 2.2.1.3.12.

Table 2-14 to Table 2-20

The tables incorrectly reference and label EUROCAE ED-14/RTCA document DO-160 Sections 16.5.1.2 and 16.6.1.2 regarding ‘2.1.1.7 Acquisition Time’ and ‘2.1.1.9 Reacquisition Time’. Change the table references as follows:

The MOPS Initial Acquisition Time requirement (2.1.1.7) applies to both AC and DC equipment under abnormal operating conditions (EUROCAE ED-14/RTCA document DO-160 Sections 16.5.2 and 16.6.2) and the satellite reacquisition time requirement (2.1.1.9) applies to both AC and DC equipment under normal operating conditions (EUROCAE ED-14/RTCA document DO-160 Sections 16.5.1 and 16.6.1).

[Amdt ETSO/13]

[Amdt ETSO/16]

Reserved.

[Amdt ETSO/13]

[Amdt ETSO/16]

This Appendix prescribes the EASA modifications to RTCA document DO-229E, Section 2.

At Section 2.1.1.2, after the first sentence, add the following:

‘The demodulation of data from the GPS signals shall be restricted to the necessary subset of the data defined in Appendix II to IS-GPS-200D, “Navstar GPS Space Segment/Navigation User Interfaces”, December 2004, provided on RF link L1. The pseudo-ranging shall be performed on RF link L1 utilising the coarse/acquisition (C/A) code.’

This is to ensure that only the L1 NAV data, for which the SBAS provides corrections and integrity, is used, and no CNAV data, which is defined in Appendix III to IS-GPS-200D, is used, for which the SBAS does not provide integrity.

[Amdt ETSO/13]

[Amdt ETSO/16]