10 for ATN B1 and FANS 1/A+ (i.e., different air-ground data link technologies). ICAO is planning to incorporate message elements defined for Baseline 2 into a later version of the GOLD Manual, with plans to amend Doc 4444 after 2020.
6.1.3 Aircraft system developers and data suppliers intending to use a database (within the data link communication system); such as a database containing addressing information of Air Traffic Control Centers (ACCs) to allow the flight crew to perform a LOGON, should provide database assurance.
6.1.3.1 The certification plan should define the design assurance method for the database (i.e., DO-178C or DO-200B, or approved alternative means) with the hazard effect. The safety assessment in Appendix B of DO-350A/ ED-228A may be a useful tool to identify the hazard and the effect contributing from the database. For instance, this safety assessment indicates the inability to complete a LOGON is a minor safety effect;
hence a database used to perform a LOGON should provide design assurance commensurate to a minor hazard. We recommend you seek concurrence from the certification authority early in the program.
6.1.3.2 AC 20-153B, Acceptance of Aeronautical Data Processes and Associated Databases, provides guidance related to FAA acceptance for all safetyrelated aeronautical databases. For this type of database, a database Letter of Acceptance (LOA) is the preferred means to gain FAA acceptance of the design assurance method. This method of approval allows database updates without going through the type design approval change management process.
6.1.4 Seamless CPDLC connection at FIR boundaries may not occur in some situations, requiring the flight crew to perform a manual logon. Flight crew procedures are needed to ensure transfer of CPDLC connections between ATSUs with different data link systems.
Table 4. Interoperability Criteria for the Aircraft Data Link System Interop Designator Applicable Standards Criteria applicable to aircraft means of compliance Single Capability - Aircraft Configuration:
ACARS ATS Varies The applicant identifies any of the following data link services and meets the associated standards:
a) DCL: ED-85A, Chapter 7 (section 7.1) and Appendix A.
b) D-ATIS: ED-89A, Chapter 7 (section 7.1) and Appendix A.
c) OCL: ED-106A, Chapter 7 (section 7.1) and Appendix A.
d) DCL, D-ATIS, TWIP and/or OCL: ARINC 623-3.
Sub-network Designator(s) See sub-networks of FANS 1/A+ of this table for applicability.
11 Table 4. Interoperability Criteria for the Aircraft Data Link System (continued Interop Designator Applicable Standards Criteria applicable to aircraft means of compliance Single Capability - Aircraft Configuration:
ATN B1 DO-280B/ ED-110B, as modified by Eurocontrol Specification on Data Link Services (EUROCONTROL SPEC 0116) Annex B, para. B.2.1 of DO-280B/ED-110B, Airborne System CM P/OICS, at least all items identified as “M” (i.e., Mandatory) for column titled “Profile Status”.
Annex B, para. B.4.1 of DO-280B/ED-110B, Airborne System CPDLC P/OICS, at least all items identified as “M” (i.e., Mandatory) for column titled “Profile Status”.
Sub-network Designator Viable sub-network associated with ATN B1:
VDL M2
a) TSO-C160a for (Class X) or (Class Z and Y).
b) ARINC 631-6.
B2 DO-351A/ED-229A Interoperability requirements (Denoted by “Aircraft System”) applicable to CPDLC Version 3 and ADS-C Version 2.
Sub-network Designator(s) Viable sub-networks associated with B2 VDL M2
a) TSO-C160a for (Class X) or (Class Z and Y).
b) ARINC 631-6.
12 Table 4. Interoperability Criteria for the Aircraft Data Link System (continued) Interop Designator Applicable Standards Criteria applicable to aircraft means of compliance Single Capability - Aircraft Configuration:
FANS 1/A+ DO-258A/ED-100A Section 6, Allocation of interoperability requirements (Denoted by “Air”).
Functional Integration Requirements The aircraft must provide the flight crew with automation for FMS Flight Plan modification based on data received in UM79, UM80 and UM83.
1) If the [position] in UM79 matches a fix in the active flight plan, the aircraft replaces all fixes before that fix with the specified [route clearance].
2) If the [position] in UM79 does not match a fix in the active flight plan the aircraft inserts the [position] and [routeclearance] before the existing route, followed by a discontinuity and the existing route.
3) UM80 replaces the entire active flight plan, beginning at the departure airport (when on the ground) and present position (when in the air).
4) If the [position] in UM83 matches a fix in the active flight plan, the aircraft replaces all fixes subsequent to that fix with the specified [route clearance].
Flight crew action is still required to accept or load the clearance (i.e., “Wilco” the clearance via the data comm system and activate the route modification via the FMS). Compliance to 14 CFR parts 2X.771(a) and 2X.1523 must be demonstrated on aircraft without automation.
Aircraft must provide the flight crew with automation to generate DM24, DM40 and DM59 containing the [routeclearance] variable from the route in the FMS. Compliance to 14 CFR parts 2X.771(a) and 2X.1523 must be demonstrated on aircraft without automation.
13 Table 4. Interoperability Criteria for the Aircraft Data Link System (continued) Interop Designator Applicable Standards Criteria applicable to aircraft means of compliance Single Capability - Aircraft Configuration:
Sub-network Designator(s) Viable sub-networks associated with FANS 1/A+:
1) VDL M0/A
a) ARINC 618-7, Section 4.
b) ARINC 750-4.
c) ARINC 758-3.
2) VDL M2
a) TSO-C160a, for (Class V) or (Class W and Y) non-International Standards Organization (ISO) 8208 compliant installations.
Applicants must submit the performance standards that are used to qualify the sub-network access protocol (SNAcP) sub-layer.
b) ARINC 631-6.
c) ARINC 618-7, Section 11.
3) HFDL
a) TSO-C158.
b) ARINC 618-7, Section 8.
c) ARINC 635-4.
4) SATCOM (Classic Aero)
a) TSO-C132a.
b) ARINC 618-7, Section 7.
c) ARINC 741P2-11, Sections 3.2, 3.6, 4.2, and Attachment 2F-44.
5) SATCOM (SBB)
a) TSO-C159c for Equipment Class in Table 1B.
b) ARINC 741P2-11, Sections 3.2, 3.6, 4.2, and Attachment 2F-44.
6) SATCOM (SBD)
a) TSO-C159c for Equipment Class in Table 1A.
b) ARINC 741P2-11, Sections 3.2, 3.6, 4.2, and Attachment 2F-44.
14 Table 4. Interoperability Criteria for the Aircraft Data Link System (continued) Interop Designator Applicable Standards Criteria applicable to aircraft means of compliance Multiple Capability - Aircraft Configuration:
ATN B1 and FANS 1/A+ Baseline ATN B1 criteria FANS 1/A+ criteria DO-305A/ED-154A In addition to baseline criteria, Interoperability requirements IR-207, IR-209, IR-210, IR-211, IR-212, IR-214 and IR-215 to ensure seamless transition between two adjacent ATSUs, one using FANS 1/A+ and the other using ATN B1.
Note: Seamless CPDLC connection at FIR boundaries may not occur in some situations, requiring the flight crew to perform a manual logon.
Operational standards are needed to ensure transfer of CPDLC connections between ATSUs with different data link systems.
ATN B1 and B2 Baseline B2 criteria DO-353A/ED-231A In addition to baseline criteria, Interoperability requirement (Denoted by “Aircraft System”) applicable to CPDLC Version 3.
Aircraft implementation of dual ATN B1 and B2 capability might also be accomplished with independent application of both ATN B1 and B2 criteria.
ATN B1 and B2 and FANS 1/A+ Baseline B2 criteria FANS 1/A+ criteria DO-353A/ED-231A In addition to baseline criteria, Interoperability requirement (Denoted by “Aircraft System”) applicable to CPDLC Version 3.
Aircraft implementation of dual ATN B1 and B2 capability might also be accomplished with independent application of both ATN B1 and B2 criteria.
DO-352A/ED-230A Interoperability requirements NIR-153, NIR-155, NIR-156, NIR-157, NIR-158, NIR-160 and NIR-161 to ensure seamless transition between two adjacent ATSUs, one using FANS 1/A+ and the other using B2 or ATN B1.
Note: Seamless CPDLC connection at FIR boundaries may not occur in some situations, requiring the flight crew to perform a manual logon.
Operational standards are needed to ensure transfer of CPDLC connections between ATSUs with different data link systems.
B2 and FANS 1/A+ Baseline B2 criteria FANS 1/A+ criteria DO-352A/ED-230A Interoperability requirements NIR-153, NIR-155, NIR-156, NIR-157, NIR-158, NIR-160 and NIR-161 to ensure seamless transition between two adjacent ATSUs, one using FANS 1/A+ and the other using B2 or ATN B1.
Note: Seamless CPDLC connection at FIR boundaries may not occur in some situations, requiring the flight crew to perform a manual logon.
Operational standards are needed to ensure transfer of CPDLC connections between ATSUs with different data link systems.
6.2 Safety and Performance Criteria.
6.2.1 This section provides safety and performance criteria for design approval for aircraft data link systems. To meet 14 CFR 25.1523, 23.1309(a), 25.1302, 25.1301(a)(4) or 27/29.1301(d), as applicable, aircraft data link system installations must meet these criteria.
6.2.2 To meet 14 CFR 23.1309(d) or 25/29.1309(c), as applicable, aircraft supporting multiple performance specifications, depending on the configuration, must include appropriate indications and/or procedures to enable the flight crew to notify ATC when aircraft equipment failures result in the aircraft’s ability to no longer meet its criteria for any of the RCP or RSP specifications. 14 CFR part 27 rotorcraft data link system installations should also meet this standard.
6.2.3 Safety Requirements for CPDLC. CPDLC installations must meet the safety requirements denoted by “Aircraft System” in RTCA/DO-350A/ED-228A Table 5-13, Safety Requirements and Supported Safety Objectives.
6.2.4 Performance Requirements for CPDLC. If seeking an RCP performance designator (RCP 130, RCP 240, or RCP 400), CPDLC installations must meet the following performance requirements specified in RTCA/DO-350A/EUROCAE ED-228A Table 5-14, CPDLC Performance Requirements, for the applicable RCP performance designator being sought:
6.2.4.1 RCTPAircraft (Transaction Time).
6.2.4.2 CAircraft (Continuity).
6.2.4.3 IAircraft (Integrity).
6.2.4.4 MA-1aAircraft and MA-1bAircraft (RCP Monitoring and Alerting Criteria).
6.2.4.5 In lieu of the AAircraft (Availability) requirement shown in Table 5-14, AAircraft must be 0.999 or greater.
6.2.5 Safety Requirements for ADS-C. ADS-C installations must meet the safety requirements denoted by “Aircraft System” in RTCA/DO-350A/ED-228A Table 6-12, Safety Requirements and Supported Safety Objectives.
6.2.6 Performance Requirements for ADS-C. If seeking an RSP performance designator (RSP 160, RSP 180, or RSP 400), ADS-C installations must meet the following performance requirements specified in RTCA/DO-350A/EUROCAE ED-228A Table 6-13, ADS-C Performance Requirements, for the applicable RSP performance designator being sought:
6.2.6.1 RSTPAircraft (Transaction Time).
6.2.6.2 CAircraft (Continuity).
6.2.6.3 IAircraft, Navigation Figure of Merit (FOM), and Time at position accuracy (Integrity).
6.2.6.4 MA-1aAircraft and MA-1bAircraft (RSP Monitoring and Alerting Criteria).
6.2.6.5 In lieu of the AAircraft (Availability) requirement shown in Table 6-13, AAircraft must be 0.999 or greater.
7 DESIGN CONSIDERATIONS FOR AIRCRAFT DATA LINK SYSTEMS.
The following design considerations apply to all aircraft data link systems intended for air traffic services.
7.1 System Design.
To meet 14 CFR 25.1523, 25.1302, 23/27/29.1301(a) or 25.1301(a)(1), as applicable, the aircraft data link system and placement of its controls and displays must meet the following criteria:
7.1.1 Design the flight crew human-machine interface to be consistent with the flight deck design philosophy of the particular aircraft in which you are installing the aircraft data link system.
7.1.2 When the data link functionality is part of an integrated system:
7.1.2.1 Ensure that a lower priority function (e.g., AOC data link) does not interfere with the ATS data link functionality.
7.1.2.2 Ensure that the ATS data link functionality does not interfere with a higher priority function (e.g., navigation).
7.1.2.3 Ensure that there are adequate computer resources to perform the functions necessary for the intended operation in accordance with established continuity criteria (e.g., navigation functions should not interrupt or interfere with essential ATS data link functionality).
7.1.3 If the data link system includes multiple ATS data link applications and sub-networks, provide the crew with the capability to ensure that the different modes of the data link system are available to meet the criteria for the intended operation. For instance, some operations require specific data link applications and/or subnetworks.
7.1.4 Place the display so that each flight crew member can read CPDLC messages.
Placement in the flight crew’s primary field of view is best, as described in AC 25-11B, Electronic Flight Displays, Appendix C, Figure C-2.
7.1.5 The following documents provide FAA policy for when Special Conditions for cybersecurity are required and reference certain industry standards on cybersecurity for aircraft systems installations.
7.1.5.1 FAA Policy Statement PS-AIR-21.16-02, Establishment of Special Conditions for Cyber Security, provides FAA policy on when the FAA requires special conditions for cybersecurity. You can find this Policy Statement online at the FAA’s Regulatory and Guidance Library, http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgPolicy.nsf/0/34e0a 8b89f20a44686257c93006b20e5/$FILE/PS-AIR-21.16-02.pdf.
7.1.5.2 RTCA DO-326A, Airworthiness Security Process Specification, provides process assurance guidance and requirements for the aircraft design regarding systems information security.
7.1.5.3 RTCA DO-355, Information Security Guidance for Continuing Airworthiness, provides guidance for assuring continued safety of aircraft in service in regard to systems information security.
7.1.5.4 RTCA DO-356, Airworthiness Security Methods and Considerations, provides analysis and assessment methods for executing the process assurance specified in DO-326A.
7.2 Flight Deck Annunciation.
The aircraft data link system must have the following annunciation capabilities integrated into the aircraft’s crew alerting systems (refer to 14 CFR 2X.1322 to distinguish between warning, caution, or advisory alert indications):
7.2.1 Indication to the flight crew upon receipt of a new ATS message.
7.2.1.1 Except as indicated in 7.2.4, unless the safety assessment substantiates otherwise, an aural and visual indication must be provided upon receipt of each uplink ATS message intended for display to the flight crew.
7.2.1.2 Such indications must be provided upon receipt of the message even when the system may not display it immediately because of a pending earlier ATS message.
7.2.1.3 The system can use visual alerts alone for uplink of non-ATS messages.
7.2.2 Indication to the flight crew of aircraft data link system failure, including connection failures (e.g., loss of comm), in the pilot’s primary field of view.
7.2.3 Indication when the data link system reaches its memory capacity limits, for example:
18 When the system exceeds its memory capacity such that storage or printing is not possible, or The system cannot process a route clearance request because it contains too many user-defined waypoints.
7.2.4 During critical flight phases (e.g., takeoff and landing), inhibit aural annunciations indicating the receipt of a data communications message until after the critical flight phase. The criteria defining critical flight phases must be consistent with the particular flight deck philosophy.
7.2.5 Indication of the active center with which the aircraft has a CPDLC connection.
7.2.6 Indication of active sub-networks.
7.2.7 Indication of established ADS contracts with the aircraft.
7.2.8 Indication when there are multiple pages of messages for the flight crew. Use a format that enables the flight crew to comprehend this fact in an intuitive manner.
7.2.9 Indication that pending open messages are waiting for a response from the flight crew.
7.2.10 Indication of the presence of a message remainder (i.e., additional message information not capable of fitting on a single page) when a message is greater than the available display area.
7.2.11 Indication of the following for each uplink message, together with the message:
Whether the flight crew has acknowledged the message or not, and The time the originator sent the message.
7.3 Flight Deck Controls.
To meet 14 CFR 23.1309(d), 25.1302 and 25.1309(c), or 29.1309(c) (as applicable), aircraft data link systems must meet the following control capability criteria. 14 CFR 27 rotorcraft data link system installations should also meet these criteria.
7.3.1 Provide a way for the flight crew to activate or deactivate each of the flight deck data communication applications and sub-networks.
Note: Flight crew may need to deactivate a sub-network that does not meet the performance specification for an intended operation. A multimode radio may need to be deactivated when a mode of a multi-mode radio does not meet the performance specification and it is not possible to deactivate that mode individually.
7.3.2 Provide a way for the flight crew to acknowledge receipt of a CPDLC message to the sender, when required. The flight crew should only be able to acknowledge receipt of a CPDLC message after the flight crew has viewed the complete message, such as a multiple-page message.
7.3.3 Provide a way for the flight crew to list, select, and retrieve the most recent CPDLC messages received and sent by the flight crew.
7.3.4 Provide a way for the flight crew to clear a CPDLC message from the display.
7.3.5 Provide a way for the flight crew to create, store, retrieve, edit, delete, and send a CPDLC message.
7.3.6 Provide a way for the flight crew to preview any changes prior to activation or execution of information from a CPDLC message that can be directly loaded into other avionics, such as clearance information into the flight management system or the next ATSU frequency in the radio tuning panel.
7.4 Message Presentation.
To meet 14 CFR 23.1309(d), 25.1302 and 25.1309(c), or 29.1309(c) (as applicable), aircraft data link systems must present messages to the flight crew with the following criteria. 14 CFR 27 rotorcraft data link system installations should also meet these criteria.
7.4.1 Present CPDLC messages, without truncating them, using message element formats defined in the standards identified in Table 4. If the aircraft includes more than one data link system capability, then display messages with the same message intent in the same way for all data link systems.
7.4.2 Present message until it is acknowledged by the flight crew, unless the flight crew selects another message; or selects another display format or function in the case of a multi-function display.
7.4.3 Present the most recent messages the flight crew has received and sent. Messages must be distinguishable from each other.
7.4.4 When the aircraft data link system is sharing a display with other aircraft functions, ensure appropriate priority for presentation of the information.
7.5 Flight Deck Printer.
The flight deck printer should meet integrity criteria appropriate for the intended use.
Printers can be used to retain data communication messages sent or received during a flight; but cannot be used to verify CPDLC messages.
7.6 Data Communication Recording.
The operating rules in 14 CFR parts 91, 121, 125, 135, and 129 define data communication recording requirements. For those aircraft that must record data link messages in crash survivable memory, AC 20-160A, Onboard Recording of Controller- Pilot Data Link Communication in Crash Survivable Memory (or latest revision), describes acceptable means of compliance for recording in terms of the CPDLC message sets identified in 6.1 of this AC.
8 GROUND AND FLIGHT TEST EVALUATION.
Evaluate your aircraft data link system using laboratory, ground, and flight tests that consider the following:
8.1 Interoperability.
Verify system interoperability and performance per DO-264/ ED-78A, section 6. Test with either an appropriate ATS unit or with test equipment that is representative of an actual ATS unit. Retain evidence that the representative ATS ground test equipment demonstrates appropriate interface with the aircraft, in compliance with the interoperability and performance designators identified in Table 4.
8.2 Function.
Evaluate the functional operation of the data link system for consistency with flight deck philosophy and usability without excessive reliance on memory for procedures, the time and number of actions required to access the CPDLC message, meaning of icons, symbols and aural tones.
Note: Aircraft equipped with Iridium and Inmarsat SATCOM systems must ensure electromagnetic compatibility (EMC) or define operational limitations in the Flight Manual defined in 9.1.1 of this AC (e.g., preclude simultaneous operations of Iridium and Inmarsat SATCOM systems).
8.3 Performance.
Evaluate message delivery times for uplink and downlink, long messages that require paging, receipt and acknowledgment of multiple uplink messages sent simultaneously from more than one source, and message queue capacities.
8.4 Failures.
Evaluate aural and visual annunciations for data link system failures for their suitability in conveying the failure mode and flight crew action.
21 9 AIRPLANE/ROTORCRAFT FLIGHT MANUAL (A/RFM).
Provide a description of all the aircraft data link system operational characteristics, including what actions you expect the flight crew to take in each case. You can reduce the material addressed by the A/RFM or A/RFM supplement if the information is in other related references, such as the flight crew operating manual that the operator uses as the basis for flight crew qualification. See AC 120-70C (or latest revision) for guidance.
9.1 Operating Limitations.
9.1.1 Operating limitations are not necessary, if you show that the aircraft data link system operates in accordance with all of the criteria provided in Table 4 for a given Interop Designator.
9.1.2 Use operating limitations if it provides the basis for an alternative to satisfying the criteria contained in this AC.
9.2 Operating Procedures.
9.2.1 Assure the operating procedures in the A/RFM or A/RFM supplement are consistent with the criteria you use to demonstrate the system.
9.2.2 Document the interoperability, sub-networks and performance designators identified in Table 4. Provide a statement such as the one shown in Figure 2 for your data link system, indicating all the data link types the aircraft supports, along with the aircraftallocated RCP and/or RSP performance capabilities and associated sub-networks for each supported data link type. Because the interop designator for FANS 1/A+ does not clarify if the implementation supports automation capability defined in Table 4 (e.g., avionics ability to load routes into the flight management system in lieu of manual entry by the flight crew), FANS 1/A+ data link types must indicate either FANS 1/A+ (with automation) or FANS 1/A+ (without automation). Figure 2 shows an example A/RFM supplement for a multiple-stack data link system meeting various performance criteria to support ATS, including FANS 1/A+ (with automation).