ETSO-2C205a

CIRCUIT CARD ASSEMBLY (CCA) FUNCTIONAL CLASS DELTA EQUIPMENT USING THE SATELLITE-BASED AUGMENTATION SYSTEMS (SBASS) FOR NAVIGATION APPLICATIONS

1 Applicability

This ETSO provides the requirements which circuit card assembly (CCA) functional Class Delta4 equipment using the satellite-based augmentation system (SBAS) for navigation applications, that are designed and manufactured on or after the date of this ETSO, must meet in order to be identified with the applicable ETSO marking.

The standards in this ETSO apply to equipment that is intended to accept a desired flight path and provide deviation commands that are keyed to that path. Pilots and autopilots will use these deviations to guide the aircraft.

An ETSO-2C205a article has a limitation that requires the end-use equipment manufacturer to repeat selected detailed functional tests in the end-use equipment and complete the environmental qualification tests in RTCA document DO-229E (see paragraphs 3.2.2.1 and 3.2.2 below).

2 Procedures

2.1 General

The applicable procedures are detailed in CS-ETSO, Subpart A.

- 2.2 Specific

None.

3 Technical Conditions

3.1 Basic

3.1.1 Minimum Performance Standard

The applicable standards are those provided for functional Class Delta-4 equipment in RTCA document DO-229E, Minimum Operational Performance Standards for Global Positioning System/Satellite-Based Augmentation System Airborne Equipment, dated 15 December 2016, Section 2, as amended by Appendices 1 and 3 to this ETSO standard. Class Delta-4 equipment is defined in DO-229E, Section 1.4.

3.1.2 Environmental Testing and Test Procedures

3.1.2.1 Environmental Testing

For the applicable environmental standards, see CS-ETSO, Subpart A, paragraph 2.1.

Nevertheless, not all types of environmental test are required for this ETSO standard, as the ETSO article for this ETSO standard is a CCA that will be later integrated into an item of ETSO equipment. Therefore, a minimal set of the environmental test conditions of EUROCAE ED14/RTCA document DO-160 has been defined (refer to Table 1) in order to verify the performance of the ETSOA article under this minimal set of conditions. The required performance under a particular environmental test is defined in the related test section in RTCA document DO-229E, Minimum Operational Performance Standards for Global Positioning System/Satellite-Based Augmentation System Airborne Equipment, dated 15 December 2016, Section 2.4.

This minimal set is defined in Table 1 below. The chosen test category, associated with the selectable parameters in the test conditions per EUROCAE ED-14/RTCA document DO-160, should be documented in the installation manual as limitations for the installation.

The test sections that are identified as optional are not required for an ETSO-2C205a application. Nevertheless, the ETSO CCA article can be subjected to these test conditions by the applicant on a voluntary basis. When optional sections are not tested, they shall be marked with 'X' in the environmental testing summary.

Table 1 -Environmental Qualification Testing minimum set for ETSO-2C205a

3.1.2.2 Environmental Test Procedures for End User

The end user of this ETSO article will be required to verify its performance after integration, and complete the environmental qualification testing after integration of the ETSO-2C205a CCA. In order to allow the end user to properly test the functionality of the CCA functional Class Delta equipment in environmental conditions, the applicant for the 'functional Class Delta ETSO article' shall provide the detailed functional test procedures to evaluate the required performance of the functional Class Delta equipment in compliance with RTCA document DO-229E, Minimum Operational Performance Standards for Global Positioning System/Satellite-Based Augmentation System Airborne Equipment, dated 15 December 2016, Section 2.4.

3.1.3 Software

See CS-ETSO, Subpart A, paragraph 2.2.

3.1.4 Airborne Electronic Hardware

See CS-ETSO, Subpart A, paragraph 2.3.

3.2 Specific

3.2.1 Failure Condition Classification

See CS-ETSO, Subpart A, paragraph 2.4.

A failure of the function defined in paragraph 3.1.1 of this ETSO is a:

- -major failure condition for a loss of function and malfunction of en route, terminal, approach lateral navigation (LNAV), and approach LNAV/vertical navigation (VNAV) position data; - -major failure condition for a loss of function of approach localiser performance without vertical guidance (LP), and approach localiser performance with vertical guidance (LPV) position data; and - -hazardous failure condition for a malfunction of approach (LP and LPV) position data that results in misleading information.

3.2.2 Additional Specific

If the CCA functional Class Delta equipment can satisfy the requirements of RTCA document DO-229E only when used with a particular antenna, the use of that antenna (by part number) shall be a requirement on the installation.

This requirement shall be included in the installation manual as a limitation.

The applicant shall have all the data necessary to evaluate the geostationary (GEO) satellite bias as defined in RTCA document DO-229E, Section 2.1.4.1.5, available for review by EASA.

If the functional Class Delta equipment uses barometric-aiding to enhance the availability of FDE, then the equipment shall meet the requirements in RTCA document DO-229E, Appendix G.

The applicant shall provide to the end user the detailed functional test procedures of the functional Class Delta equipment for the end user to complete the environmental testing.

The intended installation environment and the associated installation constraints should be documented in the installation Manual.

Limitations:

The following specific limitations shall be documented in the IM and in the DDP of the CCA functional Class Delta equipment :

- -'The manufacturer of the end -use equipment, using the <insert equipment model> Class Delta CCA, is required to perform the testing described in ETSO-C146<latest revision> Appendix 1 with the Class Delta CCA installed in the enduse equipment.' - -'the manufacturer of end -use equipment is required to complete full environmental qualification at the enduse equipment level.'

4 Marking

4.1 General

See CS-ETSO, Subpart A, paragraph 1.2.

4.2 Specific

The functional Class Delta equipment must be permanently and legibly marked with the operational equipment class (e.g. Class 4) as defined in Section 1.4.2 of RTCA document DO-229E. A marking of Class 4 indicates compliance with the Delta-4 requirements. The functional equipment class (e.g. Delta) defined in Section 1.4.1 of RTCA document DO229E is not required to be marked.

It is sufficient to declare the proper functional equipment class in the declaration of design and performance (DDP).

5 Availability of Referenced Documents

See CS-ETSO, Subpart A, paragraph 3.

[Amdt ETSO/16]

APPENDIX 1 TO ETSO-2C205A ADDITION TO RTCA DO-229E

ED Decision 2020/011/R

This Appendix describes the modifications and additions to RTCA document DO-229E that are required for compliance with this ETSO.

This Appendix adds a new Section 1.8.3, on cybersecurity and GNSS spoofing mitigation, to RTCA document DO-229E, and corrects a long-standing mistake in the Section 2.4 environmental requirement tables. The new section provides information for cybersecurity and GNSS spoofing mitigation to make RTCA document DO-229E consistent with the new RTCA MOPS template and RTCA document DO-253D, Minimum Operational Performance Standards for GPS Local Area Augmentation System Airborne Equipment, dated July 2017.

1.8.3 Cybersecurity and GNSS Spoofing Mitigation

This section contains information to address intentional interference with the GNSS. Spoofing is caused by RF waveforms that mimic true signals in some ways, but deny, degrade, disrupt, or deceive the operation of a receiver when they are processed. Spoofing may be unintentional, such as effects from the signals of a GNSS repeater, or may be intentional and even malicious. There are two classes of spoofing:

- -Measurement spoofing introduces RF waveforms that cause the target receiver to produce incorrect measurements of the time of arrival or the frequency of arrival, or their rates of change; - -Data spoofing introduces incorrect digital data to the target receiver for its use in the processing of signals and the calculation of positioning, navigation and timing (PNT).

Either class of spoofing can cause a range of effects: from incorrect outputs of PNT to receiver malfunctions. The onset of effects can be instantaneous or delayed, and the effects can continue even after the spoofing has ended. Improperly used or improperly installed GNSS re-radiators act like spoofers. Re-radiators, replay and GNSS emulator devices can present misleading information to GNSS equipment and/or could cause lasting effects.

Equipment manufacturers should implement measures to mitigate the processing of erroneous data. Cross-checks of GNSS sensor data against independent position sources and/or other detection monitors using GNSS signal metrics or data checks can be implemented in the antenna, receiver, and/or through integration with other systems at the aircraft level. Data validity checks to recognise and reject measurement and data spoofing should be implemented in the receiver. Additional guidance and best practices related to GNSS equipment can be found in the U.S. Department of Homeland Security document 'Improving the Operation and Development of Global Positioning System (GPS) Equipment Used by Critical Infrastructure' 1 and GLOBAL POSITIONING SYSTEMS DIRECTORATE SYSTEMS ENGINEERING & INTEGRATION: INTERFACE SPECIFICATION, IS-GPS-200, Navstar GPS Space Segment/Navigation User Interfaces, Revision H, IRN-IS-200H-003, 28 July 2016.

Aircraft equipment information vulnerabilities (such as cybersecurity risks) have been present for digital systems since the development of the personal computer (PC) in the late 1970s and even longer for RF systems, and the advent of internet connectivity has substantially increased those risks. Typically, access to navigation receivers has been controlled such that they are considered to be vulnerable only to RF signals and OEM and/or aircraft operator controlled processes for maintenance and update. In some cases, aircraft GNSS receivers may be field-loadable by approved personnel, requiring physical access and a physical interface to the ground receivers. However, it is expected that not all aircraft in the future will rely on such physical isolation for the security of avionics. Internet and Wi-Fi connectivity have become popular as a means for aircraft or equipment manufacturers to update the software of installed avionics, to update databases, or provide an alternate means of communicating with the flight crew or cabin (e.g. in-flight entertainment, weather, etc.).

1 https://uscert.cisa.gov/sites/default/files/documents/Improving\_the\_Operation\_and\_Development\_of\_Global\_Positioning\_Syst em\_(GPS)\_Equipment\_Used\_by\_Critical\_Infrastructure\_S508C.pdf

In most countries, the State provides oversight of safety-of-flight systems (sometimes referred to as 'authorised services') which provide information to aircraft, such as ILS, VOR, GNSS, and DME, to name a few. However, the State typically does not provid e oversight of 'non -trusted' connectivity such as the internet, Wi-Fi, or manufacturer-supplied equipment interfaces which permit the input of externally supplied data into aircraft systems. A manufacturer may expose aircraft information vulnerabilities through the design of the equipment, or the equipment may become vulnerable as a result of being connected to a common interface. Therefore, it is important for manufacturers to consider aircraft information security risk mitigation strategies in their equipment design, particularly when the equipment is responsible for an interface between the aircraft and aircraft-external systems.

Apart from any specific aircraft-information-security-related performance requirements that are contained in the MOPS, manufacturers are recommended to consider a layered approach to aircraft information security risk mitigation that includes both technical (e.g. software, signal filtering) and physical strategies. From a technical perspective, for example, this could include signal spoofing detection capabilities or more stringent, multi-factored authentication techniques such as passwords, PINs, and digital certificates. And finally, but just as important, manufacturers should consider supply chain risk management; for example, if a manufacturer outsources the development of software code, are the contractor and its staff properly vetted?

Civil aviation authorities (CAAs) have a regulatory interest when an applicant's design makes use of a non-trusted connection through which the installation can potentially introduce aircraft information security vulnerabilities. This requires the applicant to address not only the information security vulnerabilities and mitigation techniques for the new installation, but to also consider how vulnerabilities could propagate to existing downstream systems. Therefore, manufacturers are recommended to reference their equipment aircraft information security review and mitigation strategies in the installation manual of the equipment so that the applicant can consider them in meeting the regulatory requirements of the installation.

Table 2-14 through Table 2-20

The tables incorrectly reference and label RTCA document DO-160 Sections 16.5.1.2 and 16.6.1.2 regarding '2.1.1.7 Acquisition Time' and '2.1.1.9 Reacquisition Time'. Change the table references as follows:

The MOPS Initial Acquisition Time requirement (2.1.1.7) applies to both AC and DC equipment under abnormal operating conditions (DO-160E Sections 16.5.2 and 16.6.2), and the satellite reacquisition time requirement (2.1.1.9) applies to both AC and DC equipment under normal operating conditions (DO-160E Sections 16.5.1 and 16.6.1).

[Amdt ETSO/16]

ED Decision 2020/011/R Reserved. [Amdt ETSO/16]

APPENDIX 3 TO ETSO-2C205A

ED Decision 2020/011/R

This Appendix describes the EASA modifications to RTCA document DO-229E, Section 2.

In Section 2.1.1.2, after the first sentence, add the following:

'The demodulation of data from the GPS signals shall be restricted to the necessary subset of the data defined in Appendix II to IS-GPS200D, 'Navstar GPS Space Segment/Navigation User Interfaces', December 2004, provided on RF link L1. The pseudo-ranging shall be performed on RF link L1 utilising the coarse/acquisition (C/A) code.'

This is to ensure that only the L1 NAV data, for which the SBAS provides corrections and integrity, is used, and that no CNAV data, which is defined in Appendix III to IS-GPS-200D, is used, for which the SBAS does not provide integrity.

[Amdt ETSO/16]