Table 4-9. Data Communications Network Services (DCNS) Performance Baseline Performance Metric System Requirements Packet Error Rate (Network Service) 10(-5) Availability – Reliability, Maintainability, and Availability (Network Service)
0.9999 Mean Time Between Outages (MTBO) – Reliability, Maintainability, and Availability (Network Service) 1,344 Hours Network Service Restoral Time – Reliability, Maintainability, and Availability 30 Seconds* En Route Capacity 0.0010 bps per km3 One-Way Latency at 95% (uplink or downlink) < 10 sec One-Way Latency at 99% (uplink or downlink) < 45 sec *Reliability, maintainability, and availability restoral time applies except for catastrophic processor failures and force major events, in which case the maximum restoration time must be within 3 minutes.
4.6.3 Operator Agreement with CSP. Operators using an alternate subnetwork qualified by the FAA have similar responsibilities as when using data link communications for oceanic and remote continental operations. The CSP must meet the specifications in paragraphs 4.6.3.1 through 4.6.3.3.
4.6.3.1 Transfer Delay.
1. The CSP uplink transfer delay must be less than or equal to 10 seconds for 95 percent of all ATSU data messages.
2. The CSP downlink transfer delay must be less than or equal to 10 seconds for 95 percent of all ATSU data messages.
3. The CSP uplink transfer delay must be less than or equal to 45 seconds for 99 percent of all ATSU data messages.
4. The CSP downlink transfer delay must be less than or equal to 45 seconds for 99 percent of all ATSU data messages.
4.6.3.2 Data Integrity. The Packet Error Rate at the CSP Network Service Delivery Point (SDP) must be less than 1x10-5. The packet error rate is the number of incorrectly received data packets divided by the number of received packets.
A packet is declared incorrectly received if at least one bit is erroneous or if it is delivered to an incorrect recipient. This metric excludes packets lost in transmission due to connection failure or excessive latency, as those are accounted by other metrics.
4-7
4.6.3.3 Reliability, Maintainability, and Availability. The reliability, maintainability, and availability performance requirements presented in this section apply to the specific CSP subnetwork seeking qualification and should not take into account the availability of additional subnetworks in order to achieve the required performance levels. A network service thread includes all equipment between the CSP SDP and aircraft users, excluding any aircraft components. This would include the relevant emitting or receiving ground station antenna(s) as well as transmitting/receiving the necessary radio frequency (RF) signal levels across the entire ordered service volume in question. Signal levels need to account for terrain impacts, as applicable to the service volume in question. For the purposes of availability, utilization of diverse ground station sites and other means of redundancy are included to provide the required level of availability for the ordered service volume.
1. The service availability for each network service thread must be at least 0.9999.
2. The minimum calculated service availability must be measured over the latest 12-month period. Availability is calculated as follows:
• Available Time: Total time during the latest 12-month period the service was under contract.
• Total Outage Time: The total unapproved service interruption or degradation time during the Available Time. It includes any unapproved degradation in which the service failed to meet all performance requirements of this specification. It includes any length of time exceeding the duration of a FAA-approved interruption or degradation.
4.7 CSP Monitoring. For oceanic and remote continental operations and for the use of alternate subnetworks for U.S. data communications, the operator must be aware of their CSP performance. The operator and CSP agreement should address performance monitoring and the performance data as necessary to remain in compliance.
4.7.1 U.S. Domestic Data Communications. If the CSP performance fails to satisfy the allocated requirements, the FAA will notify the CSP and operators. In this case, the alternate subnetwork authorization for operations is suspended and the operator should not file or use the associated performance standard (if prescribed) until the FAA indicates the alternate subnetwork performance is compliant.
4-8
CHAPTER 5. OPERATIONAL USE OF DATA LINK COMMUNICATIONS
5.1 Operational Use.
5.1.1 Application Process. Operators must contact their principal operations inspector (POI) to begin the application process for an OpSpec/MSpec/LOA A056 authorization.
A compliance guide is available at: https://www.faa.gov/about/office_org/headquarters _offices/avs/offices/afx/afs/afs400/afs470/datacomm/. This guide expedites the compliance process as it condenses into one location the information required for data link operations.
5.1.2 Minimum Equipment List (MEL) and Master Minimum Equipment List (MMEL).
MELs and MMELs must include any revisions necessary for data link communication operations. These provisions must be approved by the FAA. Operators must specify the required dispatch conditions. A sample MEL is provided in Appendix B, Data Link Communications Minimum Equipment List (MEL) and Master Minimum Equipment List (MMEL) Provisions.
5.1.2.1 MEL procedures, limitations, and requirements should consider the system as a whole and also may consider subfunctions and other system interdependencies. Communications Management Unit (CMU) inoperative may render all Controller-Pilot Data Link Communication (CPDLC) virtually inoperative, while loss of Very High Frequency (VHF) Data Link (VDL) Mode 2 (M2) may render the system unacceptable for KUSA domestic but may be acceptable for en route oceanic operations provided satellite communications (SATCOM) or alternate media is available and meets performance requirements. Other systems with inter-relations such as Global Positioning System (GPS) function inoperative may not affect CPDLC operations, but depending on airplane design may affect Future Air Navigation Systems (FANS) Automatic Dependent Surveillance-Contract (ADS-C) operations. MMEL and Operator MELs should consider all functions and system relationships to the greatest extent possible.
5.1.2.2 For operations where communication equipment is required to meet a Required Communication Performance (RCP)/Required Surveillance Performance (RSP) specification, the performance must be included in the MEL.
5.1.3 Flight Plans. Dispatchers and pilots intending to conduct operations using data link communication must file an accurate flight plan (see Appendix D, Flight Planning).
Air Traffic Service Unit (ATSU) automation relies on correct flight plan codes to determine aircraft and operator data communication eligibility for various services
(e.g., reduced separation). If operators defer data link equipment before flight, a new flight plan must be filed reflecting the revised capability codes. The flight plan must always accurately reflect the aircraft’s current capabilities.
5-1
Note: Part 91 operators filing “J” codes for U.S. domestic data link services must have a data link authorization to file J5–J7 in oceanic and remote continental airspace (see Appendix D).
5.2 Data Link Operational Guidance. Pilots must be proficient with the equipment and procedures used for data link communication. Training must be based on operating guides from the manufacturer or approved operational procedures for operators with a FAA certificate. The NAS Data Communications Guide is available to provide general data communication procedure guidance in the United States but is not a substitute for Original Equipment Manufacturer (OEM)/Airplane Flight Manual (AFM) procedures.
For international operations, operators should reference International Civil Aviation Organization (ICAO) Doc 10037, Global Operational Data Link (GOLD) Manual, ICAO Doc 9869, Performance-Based Communication and Surveillance (PBCS) Manual, and state Aeronautical Information Publications (AIP).
5.2.1 Crew Resource Management (CRM). When operating aircraft with more than one pilot, the pilot flying and pilot monitoring (not flying) should individually review each CPDLC uplink message (UM) prior to responding to and/or executing any clearance and individually review each CPDLC downlink message (DM) prior to transmission. Reading a message individually is a key element to ensuring that each pilot does not infer any preconceived intent different from what is intended or appropriate. Reading the message aloud would bias the other pilot and could lead to the error of “reading” what was read aloud as opposed to what was actually displayed.
5.2.1.1 UMs. Some UMs, such as complex or conditional clearances, require special attention to prevent the pilot from responding to a clearance with ROGER (DM3)/WILCO (DM0) but not complying with that clearance. To minimize errors, when responding to a clearance with ROGER (DM3)/WILCO (DM0), each pilot should read the UM individually (silently) before initiating a discussion about whether and how to act on the message.
5.2.1.2 DMs. In a similar manner, each pilot should individually review CPDLC DMs before the message is sent.
5.3 Logon/Notification.
5.3.1 Departing U.S. Domestic Airports. The logon/notification should be approximately 30 minutes prior to proposed departure time. Pilots should maintain KUSA until logged off/disconnected by air traffic control (ATC). If leaving U.S. domestic airspace, the automatic transfer from KUSA to the next data authority (NDA) may not be possible.
In such cases, the pilot must terminate the CPDLC connection(s) and then initiate a logon/notification to prompt the new Current Data Authority (CDA) to establish a CPDLC connection.
Note: Intermittent NO COMM annunciations may occur and do not necessarily mean the ATC connection is lost. Pilots should delay logging off/disconnecting to allow the annunciation to end as the system may reestablish the connection.
5-2
Logging off/disconnecting and logging back on/notifying will cause the ATC connection to end and may block future connections.
5.3.2 Blocked List. In rare instances for security and safety reasons, an aircraft may be blocked from any logon/notification attempt until it is manually removed by the Flight Data Communications Specialist (FDCS). This occurs automatically via the system or manually by the FDCS. The following reasons may cause an aircraft to be blocked from logon/notification:
1. Number of logon/notification attempts received from an aircraft exceeds the maximum allowable number within the adapted time period. This is to prevent denial of service attacks against the data link communication service.
2. Suspected duplicate aircraft registration. This is to prevent messages which are addressed by aircraft registration from going to the wrong aircraft.
5.3.2.1 Pilot Action. The pilot experiencing a blocked logon/notification should either contact clearance delivery or their Aeronautical Operational Control (AOC) to resolve the issue.
5.3.3 Outside Data Link Airspace. The pilot should initiate a logon/notification 10 to 25 minutes prior to entry into airspace where data link communication services are provided or prior to entering oceanic and remote continental airspace.
Note: Departing from a foreign airport close to or within oceanic and remote continental airspace may require the logon/notification to be initiated prior to departure.
5.3.4 Required Data for Logon/Notification. To perform an initial logon/notification request, the pilot enters the four character ICAO identifier of the ATSU and enters/verifies the following flight-specific information:
1. Aircraft identification (same as item 7 of the flight plan);
2. Aircraft registration, if applicable, and/or aircraft address (same as item 18 of the flight plan); and
3. Departure and destination airports, when required (same as items 13 and 16 of the flight plan).
Note 1: When the aircraft identification includes a numeric component, this component must exactly match what is listed on the flight plan.
In other words, “ABC3” does not match “ABC003.”
Note 2: While the ATSU identifier is only four characters, Aeronautical Telecommunications Network (ATN) Baseline 1 (B1) is capable of supporting up to eight characters.
Note 3: If applicable, ensure ADS-C is on or armed prior to logon/notification.
5-3
5.3.5 Data Must Match Flight Plan. To avoid an automatic rejection of the logon/notification request, the pilot must ensure the flight-specific information entered into the aircraft system is the same as the corresponding details filed in the flight plan.
5.3.6 Possible Reasons for Failed Logon/Notification. The following are possible reasons for receiving an indication of logon/notification failure:
1. Logon/Notification information does not exactly match flight plan
(e.g., incorrect tail number and/or call sign/flight ID);
2. Ground or air system anomaly;
3. Data corruption;
4. Suspected duplicate aircraft registration;
5. Aircraft intentionally blocked from logging on/notifying (i.e., on blocked list due to problem reports with the aircraft); and/or
6. There is no flight plan for the flight or the flight plan did not transfer from one ATSU to the next.
5.3.7 Failure of Data Link Communication Connection. When failure of a data link communication connection is detected (downlink message fails to send), the pilot should terminate the connection and then initiate a new logon/notification with the current ATSU. If another failure occurs, revert to voice communication.
5.3.8 Logon/Notification Response. The logon/notification response message provides information to the aircraft system concerning whether:
1. The logon/notification request was successful (e.g., could be correlated with a flight plan); or
2. The logon/notification request was unsuccessful (e.g., could not be correlated with a flight plan).
5.4 En Route. Normally, response to CPDLC messages should be via CPDLC and response to a voice message should be via voice. However, if a CPDLC message is unclear or conflicting, always clarify with voice and then close the CPDLC dialog.
5.4.1 Contact or Monitor Message. A CONTACT (UM117) or MONITOR (UM120) message instructs the pilot to change to the specified frequency and may include a position or time for when to change to the new frequency. Use of a CONTACT or MONITOR message is as follows:
1. When a MONITOR (UM120) message is received, the pilot should change to the specified frequency upon receipt of the instruction or at the specified time or position. The pilot should not establish voice contact on the frequency.
5-4
2. When a CONTACT (UM117) message is received, the pilot should change to the specified frequency upon receipt of the instruction or at the specified time or position, and establish voice contact on the frequency.
5.4.2 Waypoint Sequencing. The pilot should ensure waypoints are sequenced correctly. If an aircraft passes abeam a waypoint by a distance greater than the aircraft flight management system (FMS) waypoint automatic sequencing parameter, the pilot should manually sequence the waypoints in the FMS. If the pilot does not sequence the waypoints, incorrect information will be contained in ADS-C reports and CPDLC position reports; the next waypoint in these reports will actually be the waypoint that the aircraft has already passed. This may result in a timing error or out of conformance indication on the Air Navigation Services Providers (ANSP) ground system.
5.4.3 Multi-Part Messages. If pilots are unable to comply with any portion of a multi-part message, “UNABLE” (DM1) the entire message. Additionally, pilots should avoid sending multiple requests to the ATSU in a single message.
5.4.4 CPDLC Connection Failure. If a CPDLC dialogue is interrupted by a data link service failure, expect the controller to recommence the entire dialogue by voice communication.
When the controller recognizes a failure of the CPDLC connection, the controller will instruct the pilot to terminate the connection and then initiate another logon/notification.
See Table 5-1, CPDLC Connection Failure Responses, for the voice phraseology in response to a connection failure.
Table 5-1. CPDLC Connection Failure Responses Controller/Pilot Response Controller (or radio operator) CPDLC FAILURE.
DISCONNECT CPDLC THEN LOGON TO [facility designation] Pilot DISCONNECTING CPDLC WITH [facility designation]. LOGGING ON TO [facility designation] Note: Additional voice phraseology is available in Appendix E, Voice Phraseology.
5.5 Voice Monitoring. Pilots must continuously monitor VHF or high frequency (HF) as appropriate and/or maintain a Selective-Calling System (SELCAL) watch.
5.5.1 Pilot Response. As with voice communication, pilots should respond as soon as possible to all data link communication messages (e.g., ROGER (DM3)/WILCO (DM0), UNABLE (DM1), or STANDBY (DM2)). If more time is needed to make a decision and respond, select standby (“STBY”).
5-5
5.6 Free Text Messages. Free text messages should only be used when a standard message element does not exist or is inadequate. When sending a free text message, use standard ATSU phraseology and avoid using non-standard abbreviations. (See Appendix E.)
Note 1: For FANS 1/A implementations, the pilot cannot respond to the free text message element with ROGER (DM3)/WILCO (DM0), UNABLE (DM1), or STANDBY (DM2).
Note 2: When the controller uses free text to ask the crew affirmative/negative questions, the pilot can only respond with ROGER (DM3)/WILCO (DM0), which means they have read and understood the message, but does not answer the question affirmatively. In these cases, the pilot should respond to the question with a separate message (see Appendix E).
5.7 Data Link Communication Failures. The pilot must notify the ATSU as soon as practical of any indications of degraded performance resulting from a failure or loss of connectivity in accordance with 14 CFR part 91, § 91.187. For example, reportable events include:
1. When operating outside of VHF coverage area and the SATCOM data link communication system fails; and
2. When operating in airspace where ATSU surveillance services are provided and the VHF data link communication system fails.
Note: Timely notification is appropriate to ensure the ATSU has time to assess the situation and apply a revised separation standard, if necessary.
5.7.1 Failure of Automatic Transfer. If an automatic transfer of the CPDLC connection does not occur at the boundary (CDA to NDA), the pilot should contact the transferring ATSU by sending a CPDLC TRANSFER FAILURE (DM 67) message or voice equivalent, advising them the transfer has not occurred. If this does not resolve the situation, the pilot should logoff/disconnect and logon/notify the NDA. Revert to voice if still unable to logon/notify NDA.
5.7.2 Actions and Phraseology for Data Link Communication Failure. In the event of an aircraft data link communication system failure, the pilot should revert to voice and notify the ATSU of the situation. For example, for a CPDLC failure, the pilot should use the voice phraseology, “CPDLC failure, continuing on voice,” as shown in Table E-1, Voice Phraseology Related to Controller-Pilot Data Link Communication (CPDLC) From Pilot. The pilot continues to use voice until the functionality of the aircraft system can be reestablished.
5.8 ADS-C. Normally, the pilot should leave ADS-C armed for the entire flight. However, in airspace where ADS-C is available, if the pilot switches ADS-C off for any reason, or they receive indication of avionics failure leading to loss of ADS-C, the pilot should advise ATC and follow alternative procedures.
5-6
5.8.1 Airspace Where ADS-C Is Not Available. In airspace where ADS-C is not available, the pilot may switch ADS-C off to cancel inadvertent ADS-C connections. In such cases, the pilot should ensure the ADS-C is armed when reentering airspace where ADS-C is again available.
5.8.2 Emergencies. The pilot may activate the ADS-C emergency mode, which changes all existing ADS-C periodic contracts from normal mode to emergency mode and creates emergency mode ADS-C periodic contracts on any ADS-C connections that do not have a periodic contract already in place. The pilot may also activate ADS-C emergency mode by sending a “MAYDAY MAYDAY MAYDAY” (DM56) or “PAN PAN PAN” (DM55) CPDLC message. ADS-C emergency mode may be deactivated by the ATSU or by the pilot sending a “CANCEL EMERGENCY” (DM58) CPDLC message. In emergencies, pilots may revert to voice communication when able.
5.9 Exiting CPDLC and ADS-C Areas. The ATSU should automatically logoff/disconnect data authority approximately 15 minutes after exiting CPDLC and/or ADS-C areas.
After 15 minutes, if aircraft equipment permits, the pilot should ensure there are no active CPDLC or ADS-C connections. Ensuring connections are not active eliminates the possibility of inadvertent or inappropriate use of the connections.
5.9.1 Contact Current ATSU. The pilot should contact the current ATSU unit prior to the manual termination of any ADS-C contract. This applies even when outside the applicable ATSU and the pilot logs off/disconnects ADS-C because it did not logoff/disconnect 15 minutes after leaving ADS-C airspace.
5.9.2 Connection Termination Failed. In the event the connection termination has failed, the pilot should contact the ATSU via voice or any other appropriate means.
5.10 Logoff/Disconnect. Prior to logoff/disconnect, the pilot should ensure there are no unresolved or open messages. The pilot will logoff/disconnect and confirm CPDLC connection is terminated and continue with voice communication.
Note: Pilots should wait at least 10 minutes after landing before initiating a CPDLC-Departure Clearance (DCL) logon/notification to ensure En Route Automation Modernization (ERAM) and Tower Data Link Services (TDLS) have enough time to clear previous flight information.
5.10.1 U.S. Domestic Logoff/Disconnect. Logoff/disconnect should automatically occur approximately 5 minutes after departure for DCL services. Do not logoff/disconnect until ATC terminates the session. If proceeding to international or oceanic and remote continental airspace and CPDLC services are not terminated, then manually logoff/disconnect prior to a new logon/notification.
Note: When KUSA is active as the domestic U.S. single data authority, CPDLC services will not automatically terminate after departure. Aircraft leaving U.S. airspace must logon/notify the next appropriate NDA.
5-7
5.10.2 International and Oceanic and Remote Continental Logoff/Disconnect. The ATSU should automatically logoff/disconnect data authority approximately 15 minutes after exiting CPDLC and/or ADS-C areas.
Note: For transitions between data link communication systems (i.e., FANS to ATN), follow OEM procedures for logon/notification/logoff/disconnect requirements specific to your avionics system.
5-8
CHAPTER 6. PERFORMANCE MONITORING
6.1 Performance Monitoring. With the implementation of performance based systems, monitoring of those systems ensures compliance. Monitoring provides a higher level of confidence the operational system will continue to meet the Required Communication Performance (RCP)/Required Surveillance Performance (RSP) specification. Operators should incorporate a performance monitoring process and must participate in performance monitoring which includes reporting and addressing problems. The goal of monitoring data link communication performance is to:
• Maintain safe and efficient operations;
• Determine continued compliance and interoperability;
• Investigate problems; and
• Share lessons learned.
Note: There are no established RCP/RSP standards in U.S. domestic airspace as of the publication date of this AC. As Controller-Pilot Data Link Communication (CPDLC) is introduced into en route operations for U.S. domestic airspace, RCP standards will be published.
6.2 Oceanic and Remote Continental Airspace.
6.2.1 FAA Data Collection. The FAA, along with other Air Traffic Service Units (ATSU), has been monitoring CPDLC and Automatic Dependent Surveillance-Contract (ADS-C) transactions since 2009. Analysis of Actual Communications Performance (ACP) for the CPDLC transactions and Actual Surveillance Performance (ASP) for the ADS-C downlink messages (DM) are accomplished on a semi-annual basis with an emphasis on the nominal continuity (95 percent) requirements associated with safety.
6.2.2 RCP Performance Analysis. Data analysis of ACP, including the Actual Communication Technical Performance (ACTP), is compared against RCP standards (see Tables 2-4 through 2-9) to determine whether the CPDLC performance is adequate.
6.2.3 RSP Performance Analysis. ASP is compared against RSP standards (see Tables 2-10 through 2-15) to determine whether surveillance performance is adequate. ASP analysis is based on the calculation of delivery time of the ADS-C periodic and event reports between the aircraft and the ATSU ground system.
6.2.4 Evaluating Operational and Nominal Transaction Times. ACP and ASP are evaluated using operational (99.9 percent) and nominal (95 percent) continuity criteria. Observed ACP and ASP must meet or exceed the nominal 95 percent continuity requirements.
Note 1: If ACP/ASP does not meet the nominal continuity, the operator will be notified and should not continue data link operations at the associated performance level until the issue is resolved (see paragraphs 6.4 and 6.5).
6-1
Note 2: If ACP/ASP does not meet the operational continuity 99.9 percent, the operator is notified to investigate and initiate corrective action. The nominal performance 95 percent is still sufficient for data link communication performance.
6.3 Performance Website. Operators may obtain a Pass/Fail/insufficient data monitoring performance report for their aircraft from the FAA Performance-based Communication and Surveillance (PBCS) Monitoring website.
6.4 Substandard Performance. Operators must address substandard performance whether the source of that report is from the operator’s own monitoring process, Communication Service Provider (CSP), FAA, or a foreign authority. Operators can view aggregate performance observed within FAA oceanic airspace from the PBCS monitoring website in the above paragraph. If the result of the report is “Fail,” the operator should follow the directions on the website to request further details and a corrective action plan. With a “Fail” report, operators may continue to operate at a less stringent performance level
(i.e., RCP 240 to RCP 400) provided they file the appropriate performance flight plan designator.
6.5 Corrective Aircraft Action. The operator may return to the performance stated in their statement of compliance (SOC) provided the corrective action plan is completed.
6.6 Data Link Performance Eligibility. As stated in paragraph 3.3.5, RCP and RSP performance monitoring data should be included to quantify data link eligibility.
If performance monitoring data is insufficient, then the SOC will be the initial basis for compliance with continued monitoring.
6.7 Procedures to Report Problems. The operator should establish procedures to report problems to the regional PBCS monitoring entities identified in Aeronautical Information Publications (AIP) (or equivalent publications) associated with the route of flight on which the problem occurred (see Chapter 8, Reports).
6.8 Performance Monitoring in U.S. Domestic Airspace. Reserved.
6-2