European Aviation Safety Agency. Report. Technical issues in the implementation of Regulation (EC) No 29/2009 (Data Link) Version 1.

Transcription

1 Report Technical issues in the implementation of Regulation (EC) No 29/2009 (Data Link) Version 1.1 In response to the EC letter ref. DG MOVE E2/GO/cd D(2013), Ares(2013) Page 1 of 193

2 Report Technical issues in the implementation of Regulation (EC) No. 29/2009 (Data Link) Document ref. Status Date 2014_03_24_E4_D_51431_REP_DLS_1.1 Version /04/2014 Contact name and address for enquiries: Catherine Gandolfi European Aviation Safety Agency Postfach Köln Germany Information on EASA is available at: Authorisation : Version 1.0 Name Signature Date Prepared Catherine Gandolfi signed 24/03/2014 Prepared Emilio Mora-Castro signed 24/03/2014 Reviewed 1 Jussi Myllarniemi signed 27/03/2014 Reviewed 2 Frédéric Copigneaux signed 28/03/2014 Report Distribution List: 1 European Commission History of versions: 1.0 Initial version 1.1 Addition of templates of questionnaires and clarifications Page 2 of 193

3 Table of Contents Table of Contents Executive summary Introduction Factual Objectives of the investigation Scope and investigation method Investigation team Stakeholders Analysis of technical issues Potential causes for the Provider Abort Technical investigation areas Problem characterisation Airborne equipment ANSP/ACSP ground equipment Air/Ground and Ground/Ground communication ATN Technical Baseline SESAR Validation Exercises Representativeness of bench test Technology considerations Human factors aspects (pilots and ATCOs workload) Other aspects Occurrence reporting Process Analysis Problem characterisation Airborne equipment ANSP/ACSP ground equipment Air/Ground and Ground/Ground communication Page 3 of 193

4 4.5 ATN Technical Baseline SESAR Validation Exercises Representativeness of bench test Technology considerations RF Channel Usage VGS coverage Security aspects Human factors Other aspects Regulatory aspects White list Process Conclusions Recommendations Recommended actions based on the analysis stemming from this investigation Recommendations for further investigations Appendix A: Acronyms List Appendix B: References Appendix C: Investigation Evidences Appendix D: EASA Investigation Team and Eurocontrol CRO focal points Appendix E: Stakeholders and focal points Appendix F: Analysis of Technical Issues Appendix G: RF Channel Usage Statistics Appendix H: Details of evidences Appendix I: Additional clarifications Appendix J: Templates of questionnaires Page 4 of 193

5 1 Executive summary This report consolidates the findings related to the technical investigation requested by the European Commission for the identification of problems observed in the deployment of Regulation (EC) No. 29/2009 laying down requirements on data link services for the Single European Sky (also known as data link services (DLS) regulation). Abnormal numbers of ATN disconnections (Provider Aborts) were already reported by Maastricht Upper Area Control Centre in late Despite several corrections to the airborne and ground systems since 2008, the average number of Aeronautical Telecommunication Network (ATN) disconnections continues to exceed the specified level by 10 times. The ATN network is thus far from meeting its availability performance target. This degraded performance is currently observed with a limited number of aircraft using the services required by the DLS regulation. Many more aircraft are using the same frequency and infrastructure for other services or are just connected to the system. European data link communications are based on ICAO VDL mode 2 technology. This technology can be used for the purpose of ATN data link and of enhanced airlines data communications (ACARS); nevertheless, its proper operation is constrained by the number of frequencies used which must match the data volumes. The original design anticipated one Common Signalling Channel (CSC) for the network management and distinct channels for data transmission. However, the current infrastructure has deployed a single channel, which is acceptable for limited data volumes. When the bandwidth is constrained, problems will first materialise in ATN data link. Furthermore, ground stations have been primarily implemented at airports to support ACARS. This dense topography of ground stations creates radio interferences for the flights to which the DLS regulation obligations apply, and thus is a contributing factor to the problems experienced. It is important to note that the implementation of enhanced ACARS has been successful: airlines were able to use ACARS services with increased data volumes for airlines data communications using a single VDL mode 2 radio and a single frequency. The saturation level resulting from the increased demand on data volume on a single frequency has now been reached. A main conclusion of this report is that acceptable ATN data link performance levels may only be recovered by fielding a multi frequency infrastructure which should also be optimised for radio frequency interference prevention. For all these reasons, it would be advisable to reconsider the applicability timeframes of the DLS regulation [ ] in the sense whether they should be aligned with the deployment plan of the multi frequency infrastructure. Although this is not yet completely documented, the implementation of the ATN data link is likely to also require changes to the airborne segment. It is recognised that for example Airbus and major manufacturers of VHF radios have initiated such changes. The remaining issues with the airborne and ground systems should be investigated in parallel with the multi frequency deployment, in order to make sure that the service is fully operational after redeployment in a multi frequency configuration. Page 5 of 193

6 This report also elaborates and proposes a draft action plan which could be further developed and validated within the scope of SESAR. This draft plan would also embed activities to facilitate subsequent deployment by avoiding other less significant problems of the initial deployment. It is also suggested that large scale deployment of the plan, as possibly refined within the scope of SESAR, should preferably be performed by the to-be-nominated deployment manager. Finally, the reporting of the technical issues and of the mitigation means to maintain safety and to address concerns related to interoperability did not reach the Competent Authorities, the European Commission and/or EASA. Although not being the root cause of the technical issues, this lack of notification has delayed the early identification of the magnitude of the problem. The deployment of such a collaborative network not only requires coordination and well defined design but also continuous monitoring and global error reporting with rectification enforcement until the decommissioning of the system. Page 6 of 193

7 2 Introduction By the letter addressed to EASA (ref. DG MOVE E2/GO/cd D(2013)) dated on 9 December 2013, the European Commission expressed its concern on the lack of adequate progress of the data link implementation due to the technical problems affecting the correct operations of data link services. Taking into account this situation and notably the potential safety impacts related to the operations of the data link services as currently implemented, the Commission requested EASA to launch a technical investigation on the frequency of disconnections on the deployed ATN B1 (Aeronautical Telecommunication Network Baseline 1) network and if possible determine the root causes. The first Data Link services started in Europe in 2003 within the frame of the EUROCONTROL LINK programme (LINK pioneer phase). Maastricht Upper Area Control Centre (MUAC) already identified the necessity to act on ATN B1 disconnections (provider aborts) in The Eurocontrol Central Reporting Office (CRO) that has been established to support stakeholders with the implementation of Commission regulation (EC) No 29/2009 has been managing a central repository on data link performance, problems and deployment status 1. Despite corrective actions in all areas, ATN B1 deployed network does not meet the performance predicted by simulations conducted in Europe at the beginning of the last decade and suffers from massive disconnection issues. Therefore, EASA opted for adopting a holistic approach taking into account all possible contributing factors when conducting the requested technical investigation. Moreover, the proposed action plan has been designed with consideration for the most contributing factors as well for their feasibility and financial impact. Regarding the financial impact, it is important to note that the Eurocontrol Draft Rule for the Provision and Use of Data Link Services estimated a total cost of 831M by 2020 and 979M by The airborne investments represent the most significant part. Moreover, avionics retrofit cannot be performed at any time. For most airlines, aircraft maintenance and modifications take place in the low season period. Finally, corrections and enhancements in the avionics have not led to an acceptable level of performance. The recommended solutions resulting from this technical investigation aim initially to focus on the ground infrastructure, trying to keep the impact on airborne modifications within the applicable technical standards. Note: the recommendations contained in this report do not address additional long-term needs of the ATM Master Plan deployment. 1 Cf. DLS Central Reporting Office, Provision of ANSP data to the CRO, Edition 4.0 and see also value of Euro, EUROCONTROL Draft Rule for the Provision and Use of Data Link services 21/02/2007, Ed. 0.5, see figure 13 Page 7 of 193

8 3 Factual 3.1 Objectives of the investigation The aim is to identify the nature of the technical problems affecting the implementation of Regulation No 29/2009 and to find the appropriate solutions and follow-up measures to address them. 3.2 Scope and investigation method The scope is the investigation of problems in the below areas which could result in technical shortcomings or which could impair safety: Problem Characterisation Airborne Equipment ANSP/ACSP ground equipment Air/Ground and Ground/Ground communication ATN technical baseline Current deployments and validations Representativeness of bench test Technology limitations Human factors aspects (pilots and ATCOs workload) Regarding the investigation method, the European Commission requested the Agency to apply, where appropriate, the methods for inspections as laid down in Regulation (EU) 628/ Additionally, and depending of the findings, the European Commission would request the SJU to support tests in order to solve the identified problems. The investigation process has been based on the analysis of the information received from selected stakeholders. For collecting this information, specific questionnaires have been prepared for each of the stakeholders, depending on their area of involvement. The particular questions have been chosen taking into account the results of an initial identification (problem characterisation) of the potential causes of the Provider Abort. The answers in the questionnaires have been carefully reviewed by the investigation team members and further interactions with the selected stakeholders have been performed, either through meetings, teleconferences or other exchanges (e.g., s). Records of all these additional discussions are also kept as evidences of the investigation process. Additionally, specific review activity on the applicable standards has been performed by EASA for some of the topics, as found relevant. 3 COMMISSION IMPLEMENTING REGULATION (EU) No 628/2013 of 28 June 2013 on working methods of the European Aviation Safety Agency for conducting standardisation inspections and for monitoring the application of the rules of Regulation (EC) No 216/2008 of the European Parliament and of the Council and repealing Commission Regulation (EC) No 736/2006 (OJ L p. 46) Page 8 of 193

9 3.3 Investigation team Appendix D includes the list of the EASA staff who have participated in one or several areas of the technical investigation, including the preparation and review of the resulting reports. Additionally, this investigation has been conducted in close coordination with staff from the Eurocontrol Central Repository Office (CRO), also listed in Appendix D. 3.4 Stakeholders The information about all the stakeholders (and the identified focal points) which have been involved in the investigations carried-out is included in the Appendix E. 3.5 Analysis of technical issues Once all the information had been reviewed, specific effort was devoted to the synthesis of the different analyses so as to consolidate a set of conclusions/recommendations for the European Commission. A risk-based approach was taken, with the aim to ensure that all possible causes are treated in a systematic manner, allowing also for the possibility of determining conclusions, not only on the main causes of the Provider Aborts but on other possible causes that may be currently dormant or hidden. For this purpose, two different parameters were established: one for the possible effect of the technical issue and the other one for the probability of occurrence. Technical Issue effect: it is intended to describe the potential effect(s) associated to the potential causes. In order to ensure a homogeneous treatment, three types of effects have been identified: o Provider Abort: it corresponds to a sustained loss of ATN connectivity greater than 6 minutes leading to loss of CPDLC communication between controller and pilot. In this case, the flight crew gets an indication and has to revert to voice communications. o User Abort: it corresponds to a loss of the communication link between controller and pilot. This corresponds to the situation in which the airborne or ground application terminates the connection. This may occur due to several reasons like corruption of messages (Protected Mode). In this case, the flight crew gets an indication and has to revert to voice communications. o Transmission delays: it corresponds to the situation in which there are transmission delays but without exceeding the allocated timers (thus not triggering User Abort). These transmission delays are included as they could have some operational impact. Contribution: this term does not correspond to the probability of the technical issue but to the likelihood that the particular technical issue leads to one of the potential effects. Three values have been considered in the analysis: o High: when it is highly likely that the technical issue would lead to the identified effect. o Low: when it is quite unlikely that the technical issue would lead to the identified effect. o Medium: intermediate situation. Page 9 of 193

10 It is noted that the purpose of using the term Likelihood is to give some grading in the potential contribution of each of the technical issues to the above described effects. An important remark is that one likelihood grading has been given for each technical issue and for each type of effect. After applying this approach to all the potential technical issue, it was possible to identify the main contributors to the Provider Aborts, User Aborts and Transmission delays from all the analysed causes. This provided the criteria to establish the possible action plans that can be applied in short- and medium- terms. A summary of this analysis can be found in the Appendix F. 3.6 Potential causes for the Provider Abort During the first phases of this investigation, the main efforts were focused on the identification of the potential causes for the Provider Abort, taking into account the different actors that participate and the system/equipment involved. This initial list served as a basis for the identification of the investigation areas; it took into account the available information from the Eurocontrol CRO webpage and other available sources. For this purpose, a generic functional architecture depicted in Figure 1 was used. Procedures Flight Deck Flight Crew Aircraft Domain Aircraft Avionics System HMI ATN ES Airborne Router End-to-end Dialog ANSP Domain Air Traffic Service Unit (ATSU) ATN G/G Router ACSP Domain ATN G/G Router ATN A/G Router Procedures (ATSU) Controller ATSU Data Processing System HMI ATN ES ACSP Network Figure 1: ATN Data Link System Functional Architecture (source [LINK_GGI]) Page 10 of 193

11 The following aspects were initially identified: Problems in the airborne equipment implementation. These may come from implementation errors in the avionics software, the airborne router, the Communications Management Unit (CMU), the VHF Data Radio (VDR) or any other equipment involved in the data link chain. According to the available information, some problems had already been detected and corrected by some of the avionics manufacturers (e.g., Rockwell Collins). Nevertheless, some aircraft equipped with corrected or enhanced avionics continued to experience provider aborts. Other aspect to be taken into account is that PA problems were experienced by aircraft equipped with equipment from different manufacturers. This indicated that, despite that this could be a potential contributor, it would not be the only one. For that reason, specific investigation area was dedicated to the airborne equipment. On the other side, these implementation errors would not have been detected during the testing activities performed by the different manufacturers. Hence, aspects related to the way in which the data link verification/testing activities (and associated environment) were included in a dedicated investigation area. Problems in the ground equipment implementation. This would cover the implementation errors in any of the ground equipment in the data link communication chain: o o o o VHF Ground Station (VGS) ATN Air/Ground Router ATN Ground/Ground Router ATN End System (either standalone or integrated within the Flight Data Processing) Main difference with respect the airborne part may come from the limited number of manufacturers as, in most of the cases, the ground equipment (with the exception of the End System) are supplied or rented by the Air-Ground Communication Service Provider (ACSP). As in the previous case (airborne), the implementation errors not detected during the testing activities may be an indicator of limitations in the testing approach, either coming from a limited number of test cases or from the environment in which tests are performed. Interoperability aspects. Even with airborne and ground equipment fulfilling their respective requirements, the currently experienced data link problems may come from some inconsistencies of the airborne and ground equipment requirements under particular scenarios. The situation found was as follows: o o Airborne is based on ED documents, and on the [LINK_SPEC] (which defines the subset of ED standard that has to be implemented). For ground equipment, it may use the [ETSI] document (converted into Community Specification), based on ED document, and on the [LINK_SPEC]. Page 11 of 193

12 Then, it was considered necessary to get the confirmation from the different stakeholders (airborne and ground) about the standards used as the source of the requirements for the testing and qualification activities. Additionally, some investigations were carried-out in order to assess the consistency of the airborne and ground behaviours, as requested by the requirements, under some particular scenarios, selected by its complexity and sensitivity to potential loss of connection. CPDLC fragmented coverage: Provider Aborts errors may come from the situation in which an airplane is leaving the ACC sector and entering into a sector without operational CPDLC. Current fragmentation level and limited deployment status may contribute to that. VHF Ground Stations Coverage holes. Provider Aborts errors may come from the impossibility for the airborne equipment to reply because they are not within the coverage area of any VHF Ground Station. This may correspond to two possible situations: o o Errors in the VHF ground station coverage analysis for a particular sector. Such errors are not related to the possible coverage limitations inherent in the communication technology used 4. Unreported (via NOTAM) problems or maintenance operations in the VHF ground stations Degradation of data-link performances. This may come from the loss of the connectivity (or excessive delays messages transmission) provided by the ATN network (including the A/G and G/G routers) between the VHF Ground Stations and the ATSU End System. This would be under the responsibility of the organisation for the data-link connectivity. Main factors contributing to this item might be: o o o o Inadequacy of the Service Level Agreement (SLA) with the organisation responsible of the data-link service. Inadequate management of the potential safety implications coming from deviations from the SLA Insufficient supervision/oversight of the organisation responsible for ensuring the data-link connectivity. Existence of technical problems on the ATN network not adequately managed by the responsible organisation. Specific investigation area was identified with the ACSPs for this purpose. 4 See Article 4 in DLS regulation [ ] Page 12 of 193

13 Inappropriate management of multiple connections. An aircraft flying at high flight level is expected to have 200 NM VHF radio coverage (in all directions). Therefore it is most likely that several (many) VDL Mode 2 ground stations are visible to the aircraft. The avionics has to take decision whom to contact and to whom to transfer. The high number of ground stations and even independent sub-networks in some areas may have an important contribution to this issue. ACARS - VDL Mode 2 conflicts. ETSO-C160A is pointing to EUROCAE ED-92B, Minimum Operational Performance Standards for Aircraft VDL Mode 2 Physical, Link, and Network Layer, dated 21/03/2012 for the transport layer. That layer is shared with the ACARS system (AOA, ACARS over AVLC). According to the available information, it seems that there are no such problems with the AOA traffic (AOC/FANS). Considering that the same AVLC encapsulation 5 is used for AOA and ATN B1 which have different needs, this situation could create conflicting requirements or at least conflicting optimal connections for the transmission of AOA or ATN data packages. Then, it was necessary to assess if there could be interferences between both services and if there were specific elements in ATN B1 that could contribute to the Provider Abort scenario. Other potential causes: as result of the on-going investigations in the frame of the Data Link Implementation Support Group (DLISG), several stakeholders (ANSPs, equipment manufacturers, Eurocontrol) were presenting some additional potential causes for the Provider Abort (PA) : o o o o Shared VHF frequency between several service providers. Airborne equipment behaviour provoked ATN ground router to send many IDRP updates. Transport retry is started before the VDL mode 2 completes its retransmissions. Security aspects (e.g., jamming, deny of service) During these initial investigations, EASA was informed about a new deployment in the frame of SESAR ATC Full Datalink demonstration (AFD) project. A specific investigation area was identified in order to assess the similarities and differences with respect to the operational implementation that could provide some clarifications on the root causes for the Provider Aborts Technical investigation areas As result of the independent analysis carried-out, 8 investigations areas were identified together with the potential affected stakeholders. 5 Cf. Figure 56 in Appendix H Page 13 of 193

14 Investigation Area Problem Characterisation Airborne Equipment ANSP/ACSP ground equipment Air/Ground and Ground/Ground communication ATN technical baseline Current deployments and validations Representativeness of bench test Technology limitations Human factors aspects (pilots and ATCOs workload) Stakeholders Eurocontrol CRO Airborne equipment manufacturers Aircraft manufacturers Air Navigation Service Providers Air-Ground Communication Service Providers Air-Ground Communication Service Providers None Air Navigation Service Providers Air-Ground Communication Service Providers SESAR Joint Undertaking Test Support Facilities None (transversal analysis) Airlines Air Navigation Service Providers Table 1: EASA Data Link investigation areas On the other side, a specific investigation area was launched to evaluate the operational consequences of the Provider Aborts, both on pilots and air-traffic controllers. As stated in the EC mandate to EASA ([MAN_EC]), some operators decided not to operate, for safety reasons, the data link services due to the occurrence of the Provider Aborts. This required a specific analysis from EASA in order to evaluate the cockpit and operational effects, and the claimed safety impact, with the purpose of identifying if other actions are necessary in the frame of EASA area of competence (e.g., release of a Safety Information Bulletin). The description of the investigation areas and of the activities which were carried-out is described in detail in the following subsections Problem characterisation ATN is an internetworking design which connects mobile nodes systems (aircraft) via A/G routers (with RF broadcasting) to a distributed ground architecture of G/G routers (connected via IP or X.25). Page 14 of 193

15 Figure 2: Honeywell presentation [DLISG] PA ad-hoc meeting #2 The deployment of such an internetworking design is technically challenging and is normally performed with tight control of interoperability and performance. The ATN protocol provides positive feedback on the status of the connection even when no operational messages are transmitted, a feature not implemented for AOA or FANS. Therefore the ATN protocol is more demanding in terms of performance of the network (cf. evidence [EV_08_01] in Appendix H). Such a deployment is also complex since it connects airborne and ground systems which have interactions from operators. A provider abort is a sustained loss of ATN end-to-end connectivity (technical network) for at least 6 minutes. MUAC already reported provider aborts in 2008 and stressed the criticality of this problem to the Eurocontrol Data Link Implementation Support Group [DLISG]. Page 15 of 193

16 The following observations can be made [DLISG]: some symptoms 6 or issues 7 which were solved can re-appear; all aircraft and all airlines are affected but potentially more in some areas or during some periods; FANS aircraft are also impacted (although less) by VDL2 ground network instability 8 ; Issues with some VHF Ground Stations (VGS); Enhancements and fixes in avionics did not solve all the provider aborts problems Since 2008, lots of issues resulting in provider aborts symptom have been solved. Such issues were related to ACSP (both SITA and ARINC), ANSP end systems and avionics [DLISG]. However, the analysis of provider aborts often involves cascading factors and requires resources from all stakeholders for the analysis and the correction. The target availability for the ATN network should be % according to [GOLD] 9. This would equate to 0.01 % of loss of availability. The number of provider aborts provides an acceptable indication of the actual Availability of Use 10. The degradation of the Availability of Use should not be worse than that of the ATN availability thus 0.01%. With this simplification, this would mean that a maximum of 1 provider abort per 100 hours would be observed. The average PA rate measured over Quarter 1 to Quarter was 34 PAs per 100 hours, with some much higher peaks in the summer period. This has improved since the introduction of the white list 11 to 10 PAs per 100 hours but it still exceeds the specified level by 10 times Airborne equipment Most of the avionics problems have already been identified although not necessarily characterised. The primary objective of this part of the investigation is to identify the ones directly contributing to the provider aborts. Most of the data has been received under Company Confidentiality clause since they contain important design information and as such design data cannot be distributed within this report. The general architecture of the VDL system is described in ICAO document [9776] 12 and is depicted below: 6 like for example VDL8208 Call solved in 2008 and found again in late Like for example IDRP (Inter-Domain Routing Protocol) addressing anomalies on A/G router 8 This was observed during EASA visit to MUAC control room (failure of transfer of 2 FANS aircraft to next sector via data link) [EV_04_02] 9 D Figure D D in ICAO GOLD document 11 on November the 7 th See Chapter 1 Page 16 of 193

17 One of the ATN needs is to use the same address independently on the underlying network to identify a user (the address does not identify the aircraft but for example the CPDLC application of the aircraft). Sending the address in each PDU would represent an enormous overhead. For these reasons, two different protocols are used: Connectionless Network Protocol (CLNP) and Sub-Network Dependent Convergence Function (SNDCF). The CLNP protocol is a datagram oriented protocol that permits to use an address independently from the underlying network. However, the length of the address is too long for being useful in an aeronautical network so it is used over the SNDCF protocol. The SNDCF protocol is an adaption layer that modifies the received data to reduce its length, i.e. it permits to send only once the complete address of the application for a session and it is able to negotiate the compression for the TP4 protocol. The TP4 protocol is the transport ISO layer and aims to overcome the deficiencies of the CLNP protocol. It is able to warrant the delivery of data from one system to another independently on the underlying network. Three types of airborne systems are to be considered: the Communication Management Unit, VDL2 radios and the airborne routers. It is important to note that 2 equipment suppliers have not been exposed to operations in the European airspace. Page 17 of 193

18 The VHF Data Radio (VDR) component provides the system physical layer functionality. A typical VDR in a commercial installation might support analogue voice and ACARS as well as VDL2 (cf. [Grappel] reference in Appendix B). Regarding the radio deafness problem, it must be stressed that the tests performed for interoperability were not exercised in the dense VHF environment of the core European airspace. Nevertheless, the tests confirm that the equipment meet or exceed the applicable technical standards. For example, specifications include receiver performance when in the presence of interfering signals within, and outside the VHF band. Therefore, interference on a voice channel should not disrupt data communications unless it exceeds the specifications, which were applied across the entire VHF band. The radio deafness enhancements solved around 60% of the observed provider aborts. However, the number of provider aborts still remains far too high (average of 10 per 100 hours compared to a target of 1 per 100 hours). All the avionics manufacturers confirmed that tests were done in an environment, which was not as congested as the core Europe for VHF Data traffic. Congestion could be a source of PA issues. All the stakeholders designed their systems in accordance with the same standards, starting with [LINK_SPEC] and EUROCAE standards. The same ICAO SARPS were also identified. No significant difference in the minimum required technical basis could be identified for the avionics suppliers. The interoperability tests with the Eurocontrol Experimental Centre (EEC) were successful; however, connection to the ATN network took place through the ARINC and SITA test infrastructure. Since the provider aborts are not related to a specific geographical area, altitude, time of day or ACSP, it was suggested that the quality and quantity of the signal RF signals received play a major role in the disconnections. Connection-oriented with positive feedback protocol of ATN is pointed as a factor increasing the probability of disconnections. Avionics manufacturers report that specific requirements are included in order to make the unit perform per ACSP expectation in congested situations (cf. evidence [EV_02_06] in Appendix H). Some specific requirements such as the ISO 8208 address field have been adapted by SITA in order to manage interoperability of connected systems not fully compliant to the agreed interoperability standard; however this is not documented. More generally, Link specifications were developed with 1 ANSP, 2 ACSPs and 2 VDR radio manufacturers. As a result of this development work, some of the selected operating modes have not been translated into requirements (cf. evidence [EV_02_06] in Appendix H). Page 18 of 193

19 Both SITA (VHF AIRCOM Qualification or VAQ) and ARINC (ARINC GLOBALink Avionics Qualification or AQP 13 ) qualify the avionics for interoperability on their respective networks (cf. evidence [EV_02_06] in Appendix H). Such tests also aim to exclude malfunctioning or incorrectly designed avionics that could consume an excessive amount of system resources, making communications for other aircraft very difficult and/or impacting the cost to operate the networks 14. General Aviation or Business aviation operators are not yet exposed to data communications. The operational effects of disconnections could be different than for transport category aeroplanes. The possibility for non-aoc operators 15 to connect to SITA or ARINC networks is not obvious (cf. [Garmin_non-AOC] reference in Appendix B) despite the obligations stated in the DLS regulation [ ]. Therefore, the level of operations for General Aviation or Business Aviation with data communications could anyhow be reduced initially. There would be no additional impact on the Provider Aborts. By mid-march 2014, one avionic supplier started to carry out tests with an instrumented aircraft with several versions of the avionics in the core European airspace. Rockwell Collins and Airbus had already performed similar tests which exposed the deafness problem. The causes of some problems are still under investigation KLM configurations [EV_09_01] KLM has approximately 100 aircraft equipped (KLM, Transavia). Problems occur mainly on the 737 NG fleet which is used in the European airspace. KLM reports that provider aborts occur randomly, during all phases of the flight, regardless of the message or service requested. The 737 NG fleet configuration is the following one: Honeywell CMU Mark II with Rockwell Collins VDR for KLM Honeywell CMU Mark II with Honeywell VDR for Transavia KLM has indicated the following: When stopping using CPDLC, resets of CMU (Communication Management Unit) are still numerous De-activation of ATN makes the CMU resets disappear There are some couple of aircraft for which it is even necessary to de-activate AOA. KLM also operates FANS CPDLC on A330, B777 and B aircraft. 13 Cf. ARINC GLOBALink Avionics Qualification Policy, ARINC, Reference Rev. J, published December 17, See an operator that will use VDL Mode 2 connectivity strictly for communication over the ATN; such operator will not have a contract with SITA or ARINC for ACARS Page 19 of 193

20 KLM reports that no such problems had been experienced with AOA prior to the installation of CPDLC 16. Malfunctioning of CPDLC is also impacting AOA on some aircraft configurations. KLM opinion is that the early equipage with CPDLC has been a useless investment because of the lack of ground service and of the technical problems DLH configurations [EV_09_02] The analysis performed by DLH together with MUAC in Q revealed that flights going through EDYY airspace with aircraft departing from or arriving to Berlin showed significantly more provider aborts than flights with aircraft departing from or arriving to Dusseldorf, although having the identical equipment [EV_09_02]. Aircraft equipped with ATSU CSB6.5 show high rate of network delays (no loss of connection but message expiry). There are many VDR FAULT and DATALINK STBY indications when flying within the VDL2 coverage area. Moreover, data link problems were observed when leaving the VDL2 coverage area. In order to improve QoS (quality of service), DLH has decided to deactivate VDL2 on aircraft not equipped with CPDLC: this has reduced the number of technical problems. Reports to be investigated are shared with all stakeholders (via JIRA and CRO) ANSP/ACSP ground equipment This investigation area is focused on the assessment of the potential contribution of the ground equipment at the ANSPs to the Provider Abort occurrences. In addition to that, an evaluation of the role of the ANSPs in the supervision/monitoring of the ACSPs has been performed, what can be considered complementary to the technical investigation activities performed on the ACSP side. The following stakeholders have been contacted: MUAC Skyguide NATS These stakeholders were selected because, at the time of performing these technical investigations, they were the only ANSPs that offered CM/CPDLC data link services in their area of responsibility. The investigation has been based on the following activities/evidences: Replies to the delivered questionnaires ([EV_04_01], [EV_04_03], [EV_04_06]) Teleconferences with each stakeholder ([EV_04_02], [EV_04_04], [EV_04_07]) At the time of performing these technical investigations, some of these ANSPs had already implemented restrictions for aircraft non-equipped with corrected airborne equipment to have 16 To comply with DLS regulation [ ] Page 20 of 193

21 access to the CM/CPDLC data link service (commonly referred as white list 17 ). This was the case of Skyguide and MUAC. NATS implemented a white list during the staggered implementation process of the data link service performed along the summer This restriction was removed in October 2013 after declaring the service fully operational. Due to the implementation of white lists and the decision taken by some airlines, the current number of CM/CPDLC flights is quite low for all the contacted ANSPs 18 : traffic flows oscillate between flights/week depending on the ANSP. This is an aspect to be taken into account in the use of statistical values. Even with these low traffic flows and the introduction of the white list, the average rate of Provider Abort is around 5-8% (previous values were about 13-15%). It is important to note that VDL2 can be used for AOA even without ATN equipage. Moreover, ATN aircraft generate data traffic even when not using the CPDLC service 19. The three ANSPs who replied to the EASA questionnaire (MUAC, NATS and Skyguide) have different setups with the ACSPs, especially with SITA. Also, they may have more flights operating with a particular ACSP. The following table summarises the information received from these ANSPs. MUAC Skyguide NATS Setup with ACSPs SITA and ARINC offer full data link communication service. ARINC offers full data link communication service. SITA and ARINC offer full data link communication service. SITA VGSs and ATN ground routers owned and maintained by Skyguide. Primary/alternative ACSP SITA is primary ACSP and ARINC is the alternative one (that means, connection with ARINC is performed via SITA) SITA network is managed by Skyguide and they have another connection with ARINC SITA and ARINC are primary ACSPs Operating flights Mainly SITA Mainly SITA Mainly ARINC Table 2: Different ACSP setups among contacted ANSPs 17 White List includes aircraft equipped with corrected versions of the Rockwell Collins radio or aircraft equipped with airborne equipment for which there is not any problem detected. By default, newly equipped aircraft are included in the white list. This white list for the reduction of provider aborts is coordinated by Eurocontrol CRO. 18 It is expected that the number of aircraft using CM/CPDLC increases significantly in March 2014 as far as additional aircraft will be included in the white list. 19 keep alive messages Page 21 of 193

22 For the ANSP ground equipment, all the ANSPs contacted use the Data Link Front End Processor (DLFEP) manufactured by Thales (former EGIS AVIA) in different versions, although the differences only refer to the different modules used (e.g., Skyguide uses a DLFEP version that includes the CM/CPDLC application whereas in MUAC this is performed as part of the Flight Data Processing facility). Nevertheless, the elements responsible for the ATN communication management are common in all the implementations. On the other side, some differences have been identified in the ATN ground/ground routers. Some ANSPs are equipped with the ground router from Thales (e.g., Skyguide) whereas others use the one from Pro-ATN (e.g., MUAC). The use of a common equipment has raised the issue about potential differences in the DLFEP technical baseline that could lead to interoperability problems when the aircraft was connecting with or transferring between different ANSPs. Therefore, EASA asked additional details about the technical baseline that had been used to develop the DLFEP. The information received indicates that the technical baseline has been established on the Eurocontrol Datalink Specification [LINK_SPEC]. Regarding the DLFEP testing approach, all the contacted ANSPs have followed a similar approach that can be summarised as follows: Testing at factory level (Thales) using their own test tools. This is performed by Thales during Factory Acceptance Testing and Site Acceptance Testing. Integration/interoperability testing with existing systems (e.g., FDP), performed by the ANSPs using in-house tools or specific tools supplied by Airtel ATN tools. Interoperability testing with Eurocontrol Experimental Centre, with real hardware in the loop (Honeywell and Rockwell Collins). Additional interoperability testing (e.g., NATS) with other airborne manufacturers (e.g., Airbus) beyond the minimum test with real aircraft as specified in the Community Specification [ETSI]. An important remark is that the CM/CPDLC interoperability tests (remote) made, in most of the cases, use of the ARINC/SITA operational ground network. All the ANSPs confirmed that no Provider Abort was detected during these activities. All the ANSPs have a Service Level Agreement (SLA) with each of the ACSPs. The contractual baseline is based on generic requirements for Air/Ground Communications Service Provider [GR_ACSP], with some additional requirements, depending on the particular implementation (e.g., NATS requested more demanding availability performances). The SLA monitoring is performed on a monthly basis through the review (and discussion) of the SLA monthly reported provided by SITA/ARINC. All the ANSPs confirmed the difficulty of establishing correlation between the PA occurrences and the SLA monthly report because the report includes high level information (monthly statistics). None of the ANSPs has explicit evidences of interferences between AOA and ATN traffic as far as they cannot monitor the AOA (AOC) traffic. Nevertheless, after the white list introduction, Provider Aborts are still being detected despite the low CPDLC traffic. All the ANSPs record detailed information on each of the PA occurrences for investigation purposes. Some ANSPs highlighted that several attempts have been done to establish correlations with aircraft equipage or status of the network, without definitive conclusions or even contradictory ones (e.g., correlation is observed for one week but is not observed again for the next week). This leads to the conclusion that the correlation factor may be outside the CPDLC environment (as Page 22 of 193

23 it could be the case of AOA, which shares some part of the infrastructure). Additionally, the ANSPs highlighted the difficulties to assess the Provider Abort occurrences due to the lack of logs information at aircraft level and due to low reactivity from the ACSPs. When asked about the VGS coverage, they confirmed that the location and number of VGSs are the result of the discussion with ACSP. However, in some cases, the VGS network has been defined by the ACSP Air/Ground and Ground/Ground communication This investigation area has been focused on assessing the potential contribution of the air/ground and ground/ground communication to the Provider Aborts. The main idea is that there is some underperformance or interoperability aspects at transport layer that could lead to long interruptions of the communication channel between the aircraft and the ground equipment, with the consequent errors (User Abort or Provider Abort). The following stakeholders have been contacted: SITA ARINC The investigation has been based on the following activities/evidences: Replies to the delivered questionnaires ([EV_03_01], [EV_03_03]) Teleconferences with each stakeholder ([EV_03_02], [EV_03_04]) Both stakeholders are responsible for the data link communications (either as primary or alternative) for all the ANSPs where the data link service is declared operational. However, as a result of the answers received, in some cases, the data link communication responsibilities are shared between the ACSPs and the responsible ANSP. Additionally, the feedback received from the ANSPs has been considered for this investigation area as many of the questions were intended to receive information on the ANSP/ACSP arrangements and existing monitoring. Regarding the existing infrastructure, the following table summarises the main characteristics (at least, regarding the aspects that may contribute to the PA occurrences): Page 23 of 193

24 Item SITA ARINC Ground network IP technology IP technology VGS and ATN Ground/Ground Router Air/Ground Router Main suppliers: Rhode&Schwarz (VDLM2 radio) and Thales (ProATN router) VGS and ATN G/G router are owned either by SITA or by the ANSP, depending on the service model. Most common situation is that the VGS and ATN G/G router is owned by the ANSP. A/G router located in Montreal. Some ANSPs (e.g., Skyguide) have purchased A/G routers to SITA but they are not currently operational. Main suppliers: Park Air (VDLM2 radio), COTS components and Airtel ATN (routers software) VGS and ATN G/G routers are owned by ARINC. Depending on the service model, the connectivity is provided by ARINC or by the ANSP. Air/Ground router and ATN Backbone BIS co-located in London and Amsterdam. Pre-defined split of the VGSs connection between these two Air/Ground routers. Table 3: ACSP technical infrastructure overview The technical baseline of both ACSPs is defined by the ANSPs. As expected, the contractual relationship is established between each ANSP and each of the ACSPs. Nevertheless, in both cases, the initial baseline for the ACSP requirements is based on [GR_ACSP]. On top of that, each of the ANSP includes additional requirements. In particular, regarding performances, they have the same performance requirements from all the ANSPs (those listed in Section 2.5 [GR_ACSP] although some target values are more demanding for some ANSPs. According to the information received, each ACSP has a pre-defined compliance matrix against [GR_ACSP] which is used as part of the contractual discussions with the corresponding ACSP. This compliance matrix is applied to all the ANSPs in the same manner. On the basis of this baseline, an SLA is established between the ANSP and the ACSP. The SLA monitoring is performed through monthly reports that are prepared according to the template included in [GR_ACSP]. Nevertheless, some of the ANSPs have highlighted that the current monthly report template only provides a global view of the performances but does not allow having an appropriate correlation between network underperformances and Provide Aborts. Both ACSPs have a trouble ticket system in place. However, according to the ACSPs, the number of tickets in relation to PA occurrences is not significant. PAs do not represent a significant issue compared to the other reported issues. Both ACSPs have confirmed the commonalities in the infrastructure between ACARS over AVLC (AOA AOC, FANS) and ATN-B1 (CM/CPDLC) services. VGSs and A/G router are shared between both services. A VGS station is unable to distinguish between CM/CPDLC and AOC traffic, as there is no means to distinguish such traffic type at the AVLC layer. A VDLM2 radio therefore is unable to grant priority to any traffic type. In order to prevent that the AOA traffic does not adversely impact the CM/CPDLC traffic, both ACSPs have established specific processes for the monitoring of the VDLM2 channel utilization on each VGS station, and for planning bandwidth capacity in consequence. Both ACSPs have replied in their questionnaires that they are not aware about cross-effects between these two services. However, they have highlighted that some issues could arise in the future regarding the RF channel, identified as a limited factor in the capacity of the network. In this respect the needs of AOA and ATN Page 24 of 193

25 diverge: ATN requires low latency and has short messages. This means that the RF channel loading must remain fairly low whereas AOA can have long messages and is far less time sensitive. AOA may still work at higher RF channel loading. The pricing policy 20 for AOA could play a role in the size of the AOA messages. Please refer to Section where specific assessment of the RF channel occupancy is done. Regarding the VGSs location, both ACSPs confirmed that the location and number of VGSs is selected taking into account the AOA and ATN service needs. Preference is given for the location at airports due to the availability of security measures and ground network connectivity. Furthermore, the airports are usually hot points for the AOA traffic. On the other side, the VGSs network is discussed and agreed with each of the ANSPs, meaning that, despite FAB activities, there is not a global coordination of the VGS location across different States/ANSPs. Moreover, there are VGSs which are emitting signals and which are not connected to any of the two ACSPs. Finally, both ACSPs have highlighted the significant divergence in the view on data link from country to country. The differences are located in several aspects of the CM/CPDLC, going from service provision, to certification or to the particular understanding of the link between AOA and ATN, among others ATN Technical Baseline [ ] is based on chapter 6 of [Annex 10]. Chapter 6.1 note 2 of [Annex 10] makes a direct link to ICAO [9776] for the technical specifications of VDL2. [Annex 10] foresees multi frequencies. ICAO [9776] explains the intent of CSC (common signalling channel) and of the other frequencies. The ICAO [9776] designers did not intend to use CSC to transmit data, except in emergencies and in areas of light traffic. EASA believes that the current data traffic Europe does not qualify as an area with light traffic anymore. The shared usage of the single MHz both as CSC and as CPDLC should have been limited to initial deployment. There should have been a deployment plan for multi frequency as anticipated by the original design in ICAO [9776]. The deployment in the European core area should have evolved from this single MHz channel to multiple channels. See also Section and evidence provided in [EV_06_02]. The requirements from the technical standards supporting the implementing rule should have been further specified and allocated to the stakeholders (in particular to the ACSP) in a coordinated deployment plan for the European airspace. EASA has not been able to find adequate performance requirements and assumptions [EV_05_01]. Key requirements arising from the pioneer phase in order to mitigate the deployment risks did not find their way in the ATN B1 technical baseline [EV_05_02]. The safety assessment of the deployment did not consider the management of risks which could arise from the infrastructure as a source of common cause failure [EV_05_03]. Finally, the pioneer phase did not define a method and criteria to customise the flexibility provided by the technical standards to fit the optimisation of the European airspace while ensuring aircraft worldwide interoperability [EV_05_04]. The 20 e.g., price per message or per volume Page 25 of 193

26 allocation of requirements and performance risks areas for the network are not properly documented in the deployment package [EV_05_02]. ATN End Systems implement TP4 transport protocol in order to provide Connection Mode communications over the ATN Internet [9705] 21. Provider aborts indicate a sustained loss of communications for at least 6 minutes. They reflect an issue in TP4 layer. Seamless operation over the ATN requires inter alia interoperability at TP4 layer. Malfunctioning of TP4 layer in a single aircraft can generate a disconnection for the corresponding aircraft (provider abort). Incorrect functioning of TP4 layer in one ATN ES [9705] 22 in an ATSU can impact all aircraft under the authority of this ATSU. The technical standards provide flexibility to adjust TP4 timers and parameters. EASA could only find some recommendations in Eurocontrol guidance material (such as for window W of TP4 timers). Moreover, [9705] 23 has errors impacting the dynamic computation of this Window Timer: these errors are documented in Eurocontrol guidance material [LINK_GGI]. Eurocontrol guidance material suggests that some erroneous settings either in a ground router or in an avionics can create congestion of the ATN/VDL network thus provider aborts resulting from abnormal long delays. The corresponding risk is not managed [EV_05_03]. These TP4 timers are adjusted by the airborne and ground end systems: they are outside the scope of the ACSP. Nevertheless, the importance of timers was already known since the PETAL II trials [EV_05_02]. The necessary customisation for the European airspace and risk mitigation are not properly reflected in the ATN B1 technical baseline [EV_05_04]. The customisation of the TP4 parameters is essential to ensure robust functioning and to avoid saturation of the ATN/VDL network according to Eurocontrol guidance material [EV_05_04] SESAR Validation Exercises SESAR is conducting a demonstration (ATC Full Datalink or AFD) to investigate the possibility to progress toward an operational environment where ATC operations would rely on data communications for the primary means of communication. AFD explores the possibility to use data link below FL285. The objective of AFD is to demonstrate opportunities to maximise the benefit from the ATN B1 infrastructure inherited from the current data link mandate 24. Revenue flights operated by Easy Jet and Air France with Airbus A320 aircraft will fly across the Italian and UK airspace during winter 2013 and spring In November 2013, SAS with Table Regulation No 29/2009 Page 26 of 193

27 Boeing 737 aircraft joined the AFD demonstrations. On these flights 25, data communications will be initiated to request clearances below FL under defined and controlled conditions. The demonstration organises a stepped validation process: simulation of ground and cockpit elements, system readiness test session between ground end system and aircraft end system (on ground or opportunity flight), end-to-end operational tests with selected aircraft. The demonstration will collect data of technical and operational performance indicators. The communication network that is being fielded by ENAV comprises inter alia a network management system (cf. [AFD_Doc]) which is capable of: Fault and configuration management for each network element; Performance management monitoring; Billing of Aeronautical Communication Service Provider traffic flows; Recording of traffic messages. Initial results indicated very good technical performance (latency) for the data communications setup with the AFD platform connected to the SITA PENS network and to the Airbus Cockpit simulator. Several different avionics had been tested during the End to End interoperability Test campaign. At this stage, all problems were solved. AFD [AFD_Doc] reported that ground systems have to be tested for interoperability with as many avionic models as possible, using real aircraft whenever possible. Such tests also enable to test the VDL2 ground stations. Familiarisation sessions helped reducing the distrust from air traffic controllers and flight crews for data link. AFD reported that they had not interpreted all the options provided in [ED-110B] [EV_06_01]. Interestingly, Eurocontrol made the same interpretation error in the OLDI specification and published a corrigendum. This impacted the OLDI messages to support the CPDLC Handover procedures between ATSUs ([DLISG]. Despite a meticulous preparatory work for the deployment of the Multimode Ground Stations with EMC and RF coverage analysis at different FLs, AFD experienced problems with demonstration flights: Aircraft radio switching connection to an antenna that was not announcing ATN services, but that was used just for AOC (case 1); Successive disconnections after twenty minutes of data link usage at FL300 (case 2). Case 1: An Easy Jet A transferred connectivity to a VGS which was only announcing AOA. The aircraft was flying in a multi coverage area and made several handovers. Despite multiple 25 A minimum of 36 revenue flights is foreseen (cf. [AFD_Doc]) 26 Regulation No 2009/29 mandate applies above FL Fitted with Honeywell RTA44D CMU, Airbus FANS B+ CSB6.5 ATSU (not on white list) Page 27 of 193

28 handovers, the aircraft never lost the CPDLC session and the disconnection observed created to a few seconds delay on the delivery of messages. Case 2: currently, in the AFD demonstration, Palermo airport does not have VDL2. The avionics switches to POA (plain old ACARS) scan mode. After the departure, when the aircraft reaches the VGS coverage area, the avionics needs to receive the POA squitter announcing the VD2 availability to shift on VDL2 scan mode. Finally, the avionics has to receive the VGS VDL2 GSIF (Ground Station Information Frame) to attempt a link establishment. During this phase, due to the lack of signal, the process may take more time than the "normal" situation. For those reasons, the CPDLC service is currently started late when departing from Palermo. On one Easy Jet flight (A319), after about 20 minutes of data link usage, two disconnection errors in a row happened. ATCOs reverted to voice. Investigations have been undertaken Representativeness of bench test This investigation area has been focused on the assessment of the representativeness of the test benches used by ANSPs and/or avionics vendors. According to the general principles, a high fidelity and enough capable test environment would allow an early detecting of implementation problems during the testing activities, that means, before implementation. Then, it has been considered necessary to assess characteristics of the test benches in order to see if they would have allowed an earlier detection of the Provider Abort in the laboratory or other verification environment. The following stakeholders have been contacted: Eurocontrol Experimental Centre (EEC), part of Eurocontrol NMD/CRO. Airtel ATN The investigation has been based on the following activities/evidences: Replies to the delivered questionnaires ([EV_07_01], [EV_07_04]) Teleconferences with each stakeholder ([EV_07_02], [EV_07_05]) Both stakeholders are providing support to their customers (airlines, ANSPs, avionics manufactures, ACSPs) in relation with the data link testing activities. In general terms, two types of services are offered: Delivery of test tools/software. In this case, the organisation provides the equipment/tools in order to allow the customer to create its own in-house test environment. They also provide the training necessary to operate the supplied tools/software. This is only applicable to Airtel ATN. Connection of the existing in-house facilities for remote testing (including the support on the tests definition and test execution). In this case, the customer connects its equipment to the stakeholder facilities and performs the necessary testing activities, usually with the support from the stakeholder staff. This service is offered by both EEC and Airtel ATN. Additionally, the test stakeholder is also involved in the definition or review of the interoperability test plan and in the execution of the interoperability tests. Occasionally, they also participate in the analysis and documentation of the results. This depends on the service contracted by the customer. Page 28 of 193

29 Page 29 of 193

30 Both stakeholders offer a great variety of test environment possibilities, with different levels of representativeness. However, the final decision about the test environment is on the customer (ANSP, airline, avionics), final responsible of the element under test. Among the existing capabilities, the following aspects have been highlighted: Real hardware-in-the-loop (real airborne equipment in the Eurocontrol EEC laboratory). Connectivity to the ACSP operational networks (ARINC/SITA). In some cases, the ACSPs can also offer a specific test VPN connection. Representativeness at application (functional) level, including the possibility of emulating abnormal conditions (e.g., insertion of incorrect or corrupted messages). Also, some emulation capabilities on the VDLM2 domain can be provided by both stakeholders: o o Eurocontrol EEC has an ARINC Air/Ground VDLM2 Laboratory Test System (AGTS), with up to 5 VGSs whose signal can be attenuated, to emulate a VGS handover. Airtel ATN has a Mini Portable VDR which can be connected to the airborne receiver, emulating the ground segment, the network and the VGS antenna. Concerning the testing strategies, they are defined by the ANSP/airline/avionics manufacturer. However, based on the information received, it is possible to identify some typical scenarios, depending on the stakeholder: Airlines: Their tests are typically performed in remote mode, meaning that the ANSP ground part is emulated by the stakeholder and connected to the real airborne equipment installed in the aircraft (on-ground). In this case, the operational ACSP network is typically used (VGS antenna, ground network). One additional possibility offered by Airtel ATN is by using the Mini Portable VDR which can emulate the ground part, including the VGS antenna. It is intended to be used in hangars, closely located to the aircraft under test due to the low emitting power. The testing scope is CM/CPDLC interoperability testing but with very limited scope (mainly, non-regression). Avionics manufacturers: In addition to the testing activities at equipment level (performed at their own premises), the interoperability tests are mainly performed in remote mode, namely, with the avionics equipment at the manufacturer laboratory and connected via the ACSP with the stakeholder laboratory where the ground part is emulated. In some cases, especially in case of Eurocontrol EEC, they have performed some dedicated testing campaign in their laboratory with equipment supplied by the avionics manufacturer. In these test campaigns, they could also perform some limited testing activities involving the VDLM2 part, making use of the available emulating facilities. The test scope is mainly focused on CM/CPDLC interoperability testing, although some robustness testing is typically performed (e.g., endurance tests, TP4 level testing) Page 30 of 193

31 ANSPs: In addition to the testing activities at equipment level (performed at supplier premises), the interoperability tests are mainly performed in remote mode, namely, with the data link ground equipment at the ANSP premises and connected via the ACSP with the stakeholder laboratory where the airborne part is emulated. In the case of Eurocontrol EEC, they can also perform some of these tests using the available Avionics Test Bed with avionics equipment from Rockwell Collins (CMU-900) and Honeywell (CMU-Mark2Plus). In other cases, especially in the Airtel ATN, they have installed the testing tools provided by Airtel ATN at the ANSP premises and performed this CM/CPDLC interoperability testing. The test scope is mainly focused on CM/CPDLC Interoperability testing with quite limited robustness testing (mainly at functional level). As it can be seen, most of the activities in which the stakeholders participate are related with the CM/CPDLC interoperability testing (application level). [IOP_AVIONICS], [IOP_ANSP] and [ETSI] are the main references used for the definition of the respective interoperability test plans. However, EASA has noted there are some differences among them as, for example, the [ETSI] document does not include tests at TP4 level, being limited at CM/CPDLC level. Additionally, the resulting interoperability tests plans are not intended to cover in full the ED- 110B. No information could be given by the stakeholders about how their ANSPs or avionics manufacturers show compliance with respect to ED-110B. This question has been addressed as part of the respective questionnaires. Furthermore. according to the information provided by Eurocontrol EEC, some avionics manufacturers have performed CPDLC endurance tests (3 hours with uplink every 10 seconds) in remote mode, using the SITA/ARINC operational ground network. During these demanding tests, no Provider Abort problem was detected despite the high flow rate. Finally, it has also been noted some problems in the interoperability test coverage of those requirements in ED-110B that include the use of options. In some cases, only one of the options is covered by the generic interoperability test cases whereas it should cover the testing of both possible behaviours Technology considerations RF Channel Usage The RF channel is the limiting factor in the capacity of the network [EV_03_01] 28. ATN is more impacted than AOA (AOC, FANS). The needs of AOA and ATN diverge. ATN requires low latency which means RF channel loading must remain fairly low. AOA is far less time sensitive and will work at higher RF channel loading. The main bandwidth limitation is in the RF channel between the VGS and the aircraft. At present there is no mechanism to prioritise ATN messages over AOA messages in the RF link to the aircraft. These limitations come from the technology choices and are explained in [EV_08_01]. 28 See reply to question 4 Page 31 of 193

32 Back in 2007 [MOON_2007], it was measured that 24% of message occurrences only contributed to 14% of overall channel. Thus, despite the overhead added by the various layers, the mean length of an ATN message was significantly less than the mean length of an AOA message. In 1998, deployment scenarios for air/ground sub-networks [ACCESS] initially anticipated AOC ACARS traffic only, and a later parallel implementation of ATS data traffic. The ACARS success had caused the system to reach the limit of its capacity. Coincidently, Europe needed to reduce RTF channel spacing to 8.33 khz in the Upper Airspace Air Traffic Services. This was requiring the fitting of new digital radios. It seemed opportune at that time to build into these 8.33 khz voice radios a VDL Mode 2 capability as well 29. Implementation of a VDL2 subnetwork was recognised as requiring considerable capital expenditure and significant running costs. The business case relied on airline communications (ACARS) with the accommodation of ATS data link services. For the airlines, ACARS was an essential element in maintaining operating capability. Simultaneously, the increase in automation of aircraft systems was generating more ACARS data traffic 30. At that time, it was recommended to accommodate the transition to the ATN within ACARS upgrade strategy. The transit delay experienced over a VDL Mode 2 channel is a function of the amount of channel capacity being used. The TEN-T ATN Compliant Communications European Strategy Study [ACCESS] had determined the following maximum traffic input on the channel ,500 bps VDL-dedicated 25 khz channel 30 e.g., a Boeing 777 generates 4 times as much traffic than older aircraft Page 32 of 193

33 Type of transaction (ODIAC) Maximum traffic input for channel Percentage of VDL2 bandwidth (31.5 kbps) C1: 95% transfer time in 5-8 seconds 6 kbps 19 % C2: 95% transfer time in 10 seconds 7.5 kbps 24 % C3: 95% transfer time in 15 seconds 9 kbps 29 % C4: 95% transfer time in 60 seconds 12 kbps 38 % Table 4: Maximum traffic input per VDL2 channel [ACCESS] indicated that increased VDL Mode 2 capacity could only be accommodated by the use of additional frequencies. [ACCESS] suggested that the use of one single channel would be sufficient at the beginning to accommodate the throughput and transit delay requirements. However, this claim was based on the following assumptions: up to half aircraft would remain on the plain old ACARS; in airports, gate traffic could be transferred to the proposed high-speed Gatelink; ATC data link applications would enter into operation rather slowly; The first operational ATC data link applications would not be the ones with requirements on very short transit delays (Only C3 and C4 transit classes should be required at the beginning [ACCESS] assumed that requirements to use several VDL frequencies would appear progressively after the initial VDL Mode 2 deployment in the core area. [ACCESS] was also suggesting spatial splitting for the use of multiple channels. According to [ACCESS], the following 4 channels would be used for VDL: 1) channel had been allocated to SITA but it should have been reallocated to VDL Mode 2 traffic from 2003 onward. 2) channel had been allocated to ARINC but it should also have been reallocated to VDL Mode 2 traffic from 2003 onward. 3) channel : this channel had been allocated to VDL Mode 4 validation. 4) channel : this frequency was reserved for the Common Signalling Channel (CSC). The plan was to use this frequency for pre-operational trials and for an early deployment of the VDL2 in Europe VGS Coverage The locations of VGS stations deployed in Europe and operating on a single channel ( MHz) create interferences for aircraft flying at or above FL285 ([ ]). Page 33 of 193

34 In 2009, the SITA VDL coverage already exhibited 1 VGS in Orly (ORY) and 1 in Charles de Gaulle (CDG) airports both operating on the CSC (Common Signalling Channel). The intent of ICAO [9776] was to use this CSC frequency for the network management. An aircraft flying at FL285 would only need one of these VGS (CDG or ORY) to have a link with the CSC. The data would be distributed on another frequency. The distribution of the VGS for data transmission/reception would have to consider both the number of frequencies available and the minimum RF radius between VGS operating on the same frequency. On the other hand, [ACCESS] estimates that 60 % of the AOC data are exchanged between the aircraft and the airline operation officers on the ground, when the aircraft is at the airport. [ACCESS] also introduces service volumes for large TMAs covering several large airports such as Paris or London TMAs. A separate airport surface service volume for Roissy, Orly, Gatwick and Heathrow would be needed since it would be impossible to find one single site in London and Paris providing line-of-sight VDL communications with aircraft on the ground at either airport Security aspects The current deployment does not integrate general security measures by technical features as described in ICAO document 9880 such as secured dialogue service or IDRP authentication. Page 34 of 193

35 However, [ ] 31 requires measures to ensure appropriate security of information exchanges. Moreover, the Protected mode (PM) variant integrates a checksum-based mitigation mechanism to detect involuntary or trivial malicious data modification. This PM- CPDLC is described in ICAO Document 9880 Edition 1. PM-CPDLC is required by DLS regulation [ ] Human factors aspects (pilots and ATCOs workload) Flight crews The answers collected from airlines [EV_09_01] [EV_09_02] regarding the technical impact of data link communications are specific to fleet and aircraft configuration. These are collected in section However, the safety implications as experienced in the cockpit are reported to be general and applicable to other aircraft configurations. KLM [EV_09_01] has put in place a systematic process for collecting the information related to provider aborts. The operational documentation, procedures, crew training, have been adequately established. The implementation of restrictions of usage of data link services ( white lists ) is considered as creating a safety issue by DLH if the flight crews are not knowledgeable about the applicability to the aircraft they fly [EV_09_02]. Therefore, DLH discourages the usage of CPDLC to its flight crews in the European airspace. Disconnections have the following cockpit effects: Warnings on centralised warning system display Additional workload, system resets No difference between cockpit layouts for the detection of disconnections Possible safety effects have been raised: The HMI is somewhat complicated in these situations Workload increases when addressing the problem and the system is resetting Pilot becomes out of the loop : there is loss of situational awareness arising from confusion. Reversion to voice communications restores an appropriate level of safety. DLH [EV_09_02] lists the following operational situations as benefiting the most from CPDLC usage: Transfer from ATC Centre to ATC Centre including MONITORING function, NSSR automation, Descend Planning Descend/Approach Sequencing 31 (22) Page 35 of 193

36 KLM [EV_09_01] would recommend the usage of CPDLC in all conditions except emergencies situations. All the ANSPs implement all the mandatory ATN B1 messages according to [ ] 32. Some ANSPs implement additional ATN B1 messages. The avionics implement the complete set of ATN B1 messages. However, some HMIs of some avionics create confusion when displaying the instruction to turn right/left. Some HMIs display three digits for the UM215 message to turn right or left by a specified number of degrees, rather than omitting the leading zeroes where appropriate 33. For example, an instruction to TURN RIGHT 30 DEGREES results in a display of TURN RIGHT 030 DEGREES, which can cause the flight crew to interpret this as a an instruction to turn right to heading 030. Two cases of confusion were reported at MUAC during 2012, both of which were detected due to the voice read-back which was in place at that time. It is worthwhile noting a quote from a pilot when it works, it is very easy to use Air Traffic Controllers Skyguide and MUAC were interviewed since they had an operational experience with data communications. The observed occurrences of loss of connection are mainly attributed to provider aborts. The following observations for the origin of provider aborts were communicated: More cases for aircraft connected via SITA than via ARINC; Large contribution of aircraft not having implemented the relevant Rockwell service bulletin for receiver deafness update; Mismatch between the data in FMS and submitted FPL (e.g., callsign may be coded on 7 characters in FPL and on 8 characters in the FMS) These disconnection events are treated as normal occurrences and are reported; a feedback is provided to the ATCO. ATCOs report that the impact on workload would not be acceptable if more aircraft would be equipped with data link. These disconnections may create confusion. The sector capacity is not affected because there is a low level of aircraft which are equipped. The trust in CPDLC has been eroded. Note: this perception of low-level of aircraft equipage is artificially created by the usage of white lists which filter aircraft configurations known to significantly contribute to provider aborts. 32 Cf Cf. _instructions_to_turn_right.2fleft Page 36 of 193

37 The roles and tasks for CPDLC are considered to be clearly described in the existing manuals. However, when the training was designed such number of losses of connections was not considered. Therefore, the training might not be considered fully adequate with the current situation. Because of the low number of equipped aircraft, the air traffic controllers are provided with some additional material: the current operation does not allow CPDLC proficiency. Sharing basic training info for CPDLC is considered appropriate. The mostly used routine CPDLC messages are: CONTACT, ROUTE, LEVEL. The following potential safety impacts are identified: Ambiguity of aircraft intent; Increased workload with the need to re-establish communication and to implement changes in the air traffic controller plan for handling the conflicts; Air traffic controllers are uncertain about the success of CPDLC communication; If the CPDLC communication is lost in the middle of an interaction between an ATCO and the flight crew, both the ATCO and the flight crew have to first assess where the technical exchange resumed and what has to be repeated on the voice channel; If CONTACT fails, this may be critical during handover between sectors. Note: most incidents in air traffic control occur during transfers. Air traffic controllers comment that problems such as those experienced with CPDLC have not occurred with other projects (e.g., 8.33, RVSM, Mode S). 3.7 Other aspects Occurrence reporting No single occurrence was found in EASA Internal Occurrence Reporting System (IORS). Additionally, EASA analysis of the EASA ADREP repository and the European Central Repository (ECR) [SA_DL] indicates the following: No accidents and only 2 serious incidents have been found where data link problems have been a factor. These 2 losses of separation occurred in Tahiti FIR and were not related to VDL2. The causes were not related to the data link technology (FANS) but to confusion of call signs, procedures and ground system HMI inappropriate for the evolutions in the operational environment in the south Pacific Cf. Page 37 of 193

38 The ECR contains 147 occurrences where data link problems have been identified. The limited access to information in the ECR makes it impossible to make any deep analysis into these occurrences. Most data link occurrences reported to the ECR have been reported by ANSPs. It is likely that occurrences were not reported by airlines to NAAs, but instead taken care of within the companies' internal SMS systems No specific aircraft model is more exposed to data link problems than others. No specific area can be pinpointed as "hotspot" for data link problems Process The deployment of this network which interconnects distinct ground infrastructures with mobile nodes (aircraft) was neither sequenced in several implementation steps nor technically controlled. Apparently, no operational means was identified to continuously measure and monitor the observed performance of the integrated network. The underlying assumption was that the adequate performance of individual services and constituents would ensure the adequate performance of the network as a whole. However, the outcome of the study related to the data link roadmap [DL_roadmap] had identified a number of inconsistencies between the required performance to support the applications and the capabilities of the existing systems [ICB_2004]. This already indicated that deployment risks had to be managed for any technology that would be selected. Achieving the appropriate performance of the overall network would be very challenging. In 2004 [ICB_2004], the European Commission was relying on the newly created Industry Consultative Body (ICB) to play a significant role in deciding how to proceed. Article 6 of Regulation 549/2004 provided to ICB the role of advising the Commission on technical aspects of the implementation of the single European sky. Page 38 of 193

39 4 Analysis 4.1 Problem characterisation ACARS on VHF introduced the first data link system in Airlines started to use it in ACARS uses 2 Central Processing Systems (one for SITA and one for ARINC) with connections to the Airline s Operations Centres. ACARS VHF was based on 25 khz Channel dedicated SITA/ARINC frequencies and on a base frequency [EV_06_02]. For ATN, the ground network is a distributed architecture of G/G routers. The processing of messages is also distributed over the European ANSPs. ATN foresees the equivalent of a base frequency designated as the Common Signalling Channel. In 1998, up to 5 frequencies were used in the northeast corridor to provide adequate system performance by plain old ACARS [ACARS_TRAN]. The possibility to add frequencies for the ACARS needs was scarce. Using VDL was considered the optimal solution. However, interoperability of ATN and ACARS over the AVLC interface of VDL2 [EV_08_02] added a fair amount of overhead on the RF [ACARS_TRAN]. The overall RF capacity increase from 2400 bps (VHF) to 31,500 bps (VDL) was considered adequate because of the limited number of aircraft using the capacity [ACARS_TRAN]. Technology Application Remarks ACARS on VHF (plain old ACARS or POA) AAC, AOC, APC designated as AOC globally in this document Globally available in 2009 Large fleet of equipped aircraft in 2009 Standard equipage in new airframes in 2009 Strong support from airlines Low data rate Near capacity saturation Quality of Service less suitable for ATM applications New technology required Need to maintain POA in parallel to new technology Page 39 of 193

40 Technology Application Remarks ATN over VDL2 ATS communications Communication oriented protocol (like TCP) Requires CSC channel plus separate other channels for data Reliable but vulnerable to network congestion will be impacted by competition from AOA/FANS for bandwidth ( starvation of TCP by UDP ) Can only use 85 % of available bandwidth Best practice recommends not mixing TCP-based traffic with UDP-based traffic within a single service-provider class ATN: ICAO standard limited to support ATC Air/Ground data link applications, in particular CPDLC over VDL2 VDL ACARS over AVLC (AOA) AAC, AOC, APC designated as AOC globally in this document FANS in continental airspace Share between POA and VDL frequencies to be carefully monitored and managed Unreliable but can use 100 % of available bandwidth Common AVLC (ACARS over VDL) and MAC with ATN VDL channel offers an increase of 20 fold capacity increase VGS can support ACARS POA, AOA, VDL2/ATN and VDL broadcast AOA: AEEC standard Note: One VGS radio either runs in ACARS (POA) mode, or in VDL2 mode. In the VDL2 mode, it can transfer AOA, ATN, VDL broadcast messages (GSIF) but not POA messages any more. The ratios of attempted logons and successful logons versus aborts are better for FANS than for ATN (see Appendix G Figures 15 & 16). The round trip delay for FANS aircraft is longer than for ATN aircraft but it is also more stable (see Appendix G Figures 17 & 18). The number of FANS and ATN transactions are comparable. The deployment risks associated to a single channel for competing AOA and ATN protocols has not been properly identified and managed. Moreover, no decision process for problems identification and resolution was implemented. The process for error reporting and resolution from [GOLD] should have been executed. Page 40 of 193

41 4.2 Airborne equipment Some problems on some avionics are clearly bugs which have to be corrected 35. The causes of provider aborts are related to: VDL mode 2 coverage/interference Ground network VHF Data Radio (VDR) CMU/CMF avionics The resolution of problems would have to follow the above sequence. The outcome of this investigation area is that the most probable cause of provider aborts is the quality and quantity of the RF signals observed by the avionics. It is observed that the tests performed for certification were not representative of the operational conditions of the core European airspace. However, manufacturers have designed their avionics to meet or even exceed the minimum requirements. Moreover, both SITA and ARINC qualify the avionics for satisfactory interoperability and performance on their respective networks (See section 3.6.3). In addition to signal quality triggers for handovers, too many packet retransmissions, or timeout of network timers can cause initiation of handovers as well. 35 For example for VDR750, [DLISG], PA ad hoc meeting #2, Airbus presentation Page 41 of 193

42 This process is called Frequency Recovery. Relying on these mechanisms to maintain connectivity between the aircraft and VGSs can lead to unacceptable levels of latency and overall degradation of VDL subnet performance [Mgt_infrastructure]. [Mgt_infrastructure] suggests the optimisation of the network load by a ground management of handovers. It is likely that the quantity and the quality of the signal significantly differ from the models defined in the technical standards. This correlates directly with the congestion effect produced by the deployment on a single channel (for CSC and data): this was not envisaged by the standard architecture of VDL2 as defined in ICAO [9776] (see Section 3.6.6). Once the congestion issue of the infrastructure is addressed, other more specific airborne problems might still exist in particular for the handover algorithm. Eurocontrol [VDL_channel] document had assessed that some simplistic handover algorithms to switch from a VGS to another VGS were creating too many unnecessary changes. This could also contribute to the degradation of the channel capacity and performance. There could remain other vulnerabilities or software bugs in the avionic. However, the avionics are not operating in the nominal ground infrastructure. Therefore, it is not possible to determine with certainty in all cases whether some observed malfunctioning is triggered by the environment or embedded into the product. The ground infrastructure is late for multi frequency and is far from providing the expected performance 36 although the DLS regulation [ ] clearly referenced the radio frequency spectrum identified by ICAO as suitable for air ground data communications and the usage of several frequencies was the standard operating mode for VDL mode 2 in ICAO [9776]. The retrofit of avionics enhancements like the VDR Deafness is demanding. Such retrofit alone does not enable to reach the expected performance. DLH reports that the technical problems, the limited message set of ATN B1 compared to traditional FANS 1/A service and the delayed implementation at ANSP level weaken the confidence of pilots in the usability of ATN B1 data communications. Lufthansa operates a few aircraft with individual Certificate of Airworthiness issued after According to [ ] these aircraft have to be fitted with data link equipment by Since they will reach their OEM design service goal in the 2018 to 2020 time frame, they can neither take advantage of the fully deployed data link services for a long time (expected not earlier than 2018 according to current ANSP equipage plans), nor of any high-end CPDLC usage defined by SESAR. Lufthansa has major concerns that EASA requires installation of future-proof data link equipment on these aircraft resulting into enormous retrofit cost due to older avionics architecture (especially with regards to ATC message annunciation). These aircraft were using CPDLC during 6 years of Link2000+ pioneer phase with no event compromising safety. Lufthansa would kindly ask EASA to revisit its policy on system integration/atc uplink annunciation for old aircraft, or to support the Airspace Users in the discussion with the EC to modify Article 3.4(b) of EC regulation 29/2009 (extending the automatic exemption to aircraft stopping operation by 31 December 2020). 36 See Section Page 42 of 193

43 Equipment vendors are also seeking for EASA support to be able to have selected Airspace Users operating, under certain conditions and in a controlled manner, new data link software releases not yet fully certified on revenue flights in order to accelerate the technical investigation. In these conditions, EASA supports the request from the airlines to modify Article 3.4(b) of EC regulation 29/2009 by extending the automatic exemption to aircraft stopping operation by 31 December Moreover, once issues with the ground infrastructure are solved, remaining issues with avionics would require instrumentation of the corresponding installations. Moreover, equipment vendors should seek a mean to operate on a non interference basis with selected Airspace Users, operating under certain conditions and in a controlled manner, new data link software releases not yet fully certified on revenue flights in order to accelerate the data collection and technical investigation. Indeed Section 4.7 demonstrates that laboratory tests and some flight tests are not sufficient to accurately characterise the problem. 4.3 ANSP/ACSP ground equipment An important element to be pointed out is the fact that all the ANSPs contacted implement the same ground equipment for the CM/CPDLC datalink services (namely the DLFEP from Thales) or at least common modules of this DLFEP. The only ANSPs known to install a different system are NAVP and ENAV which will integrate an Airtel ATN product. This common ground system could be a common source of problems that could affect aircraft equipped with avionics from different vendors. Because of commercial landscape, issues related to common design errors are more likely to occur in the ground equipment than in the avionics. On the other hand, interoperability issues are more likely to occur with the avionics. From the analysis carried-out, no significant differences have been found in the technical baseline applied to this equipment by the different ANSPs. Moreover, the testing approach performed by all the ANSPs was quite similar, mainly relying for the verification activities on tools provided by Thales (only Skyguide used Airtel ATN tools but not for the formal verification testing). As a complement, all the ANSPs performed specific CM/CPDLC interoperability testing but it was noted that the level of thoroughness could be adequate for detecting problems at functional level (based on [IOP_ANSP], [ETSI]) but with significant limitations for possible design errors at TP4 level. In summary, due to the use of a common equipment, common technical baseline and similar verification approach, the existence of undetected DLFEP requirements/design errors could have an influence in potential issues at CM/CPDLC or at transport layer (TP4), being a possible root cause for the Provider Abort problems. Further investigations might be necessary having access to much more detailed evidences from Thales. The introduction of the white list has led to some improvement of the PA performances. However, the significant reduction in the overall traffic makes difficult to extract conclusions due to the potential limited representativeness of the resulting statistics. Please refer to Section 4.9 where specific analysis of the white list considerations is done. A quite uniform approach has been chosen by the contacted ANSP regarding the setup of the contractual baseline with the ACSPs, despite of the different implementations. The basis for such contractual setup was based on [GR_ACSP] although with some add-ons to cover specific Page 43 of 193

44 requirements from each ANSP. Regarding network performances, the target values included in [GR_ACSP] have been taken as baseline. However, it is not clear if an analysis has been performed in all the cases about the validity of such values for the particular implementation of each ANSP (only NATS identified that more demanding availability requirements were requested). Nevertheless, potential problems in the [GR_ACSP] are not seen as a major driver for the Provider Aborts occurrence due to the fact that Provider Aborts are being detected even with the current low traffic levels. On the other side, the CM/CPDLC interoperability testing was performed typically with several real hardware avionics and it did not lead to any Provider Abort, despite the use of the operational SITA/ARINC network, excluding the RF part. This supports the idea that the major cause is not in the ground/ground network. Regarding the VGS number and location, all the ANSPs agree that it may create scenarios where the PA probability of occurrence is higher because it affects to the channel occupancy as there are more emitters in the area and because they expose the avionics to specially complex situations in which several strong signals are available, increasing the probability of collisions that would lead to the discard of the incoming signal by the VDLM2 radio on-board. Finally, all the contacted ANSPs, following the action plan launched by Eurocontrol CRO, are starting to collect data about the round trip delay. The initial achieved values are considered quite high taking into account the low ATN traffic that is currently present. This may indicate either delays in the ground/ground network architecture or potential sources of unavailability of the RF channel (due to high occupancy of this channel, see Section 4.8.1). 4.4 Air/Ground and Ground/Ground communication Regarding the current Provider Abort (PA) statistics, occurrences of this problem have been detected with airlines that have contracted their data link communication services with any of the ACSPs. Then, the Provider Abort problem is affecting both SITA and ARINC, with different relative percentage, depending on the ANSP. In order to discard the different contributions, an analysis of the potential causes, in relation with the ACSP, has been performed. Results are summarised in the coming paragraphs. Both the SITA and ARINC infrastructure present significant differences in the set-up: different suppliers for the equipment, different telecommunication providers, Then, this reduces the risk that there would be a common cause in the ARINC and SITA network that may be the major cause for the Provider Abort. On the other side, there is a quite diverse implementation approaches among ANSPs specially regarding SITA. For the contacted ANSPs, the information is summarised in Table 2. The ACSP role varies from being the equipment supplier (VGS, routers) to be full responsible of the data communication service from VGS antenna until ANSP router. This is an indication of some coordination lacks during the data link implementation process. This situation may be worse in the future, at least for the SITA case, as far as most of the future operational ANSPs have chosen the service model in which they procure the VGS and ATN ground routers to SITA and being also responsible of the connectivity to the SITA gateway for connecting to the A/G router. Moreover, some of these ANSPs have also procured the A/G router to SITA what may indicate that they plan to take also the responsibility of the A/G router management, increasing significantly the complexity of the resulting network. Page 44 of 193

45 Similar conclusion can be achieved from the analysis of the VGS distribution. This is done in bilateral agreements between the ACSP and each of the ANSPs, taking into account the AOA and ATN requirements plus some other aspects (e.g., security, network connections). As a consequence, the current VGS network is not optimised at European level with a higher number of VGSs than those necessary to ensure a full coverage for aircraft flying above FL285. This over-redundancy may a have a quite detrimental effect when combined with the use of a unique shared resource, the RF channel. It would increase the RF channel occupancy and the probability of RF interferences plus the increased complexity for the airborne logic to decide the VGS to be selected and the next VGS to handover to. This aspect may represent one of the drivers of the currently experience PA problems and it is treated specifically in Section Regarding the RF channel occupancy, both ACSPs have identified it as a limiting factor as far as this is a shared resource by both AOA and ATN traffic but with a less sensitiveness of the AOA protocol with respect to potential limitations in this resource. Specific statistics have been received from SITA, ARINC and Skyguide regarding the RF occupancy. These statistics are presented in Appendix G and correspond to periods of time in which the white lists were in place so most of the RF usage should correspond to AOA traffic. This aspect may represent one of the drivers of the currently experience PA problems and it is further detained in Section Regarding the ACSP requirements, confirmations have been received that a common basis is used for them, coming from the Link program. However, no concrete information has been received about how the compliance demonstration against the performance requirements is performed and monitored in the SLAs due to ANSP/ACSP confidentiality reasons. Nevertheless, this is not perceived as the major cause for PA occurrences because of the current PA problems even with the currently low ATN traffic. However, it could be a driving factor in the near future, once the main ones are solved and where many more ANSPs are operational. Then, specific attention shall be put: Identification of the supporting assumptions in which the target values in [GR_ACSP] are based on. Availability of common demonstration and monitoring approaches for these performances requirements that could be applied uniformly by all the ANSP/ACSPs ATN Technical Baseline The deployment in the European core area was performed on this single MHz channel [EV_06_02]. In 2006, Eurocontrol simulation [VDL_channel] was showing that with the full migration of the old ACARS technology to VDL2 (AVLC), a minimum of 2 channels would be required to operate ATN B1 for the busiest areas. The first VDL 2 channel was expected to come to saturation within the timeframe. The predictions of the [VDL_channel] 37 For those ANSPs in which they are responsible of the data link communication services. Page 45 of 193

46 saturation appears to be confirmed in 2008 with the high number of provider aborts reported by MUAC. Therefore, the technical advisors to the decision makers should have taken this known risk into consideration. On a single channel only pre-deployment in remote areas would be possible. A deployment mandated by the DLS regulation [ ] would have required the use of at least 2 channels (the CSC and one data channel). 4.6 SESAR Validation Exercises AFD demonstrations will provide final results after the delivery of this report. However, as the VGS are under the direct control of ENAV. It is thus possible to switch on and off some VGS and get operational observations on the impact on the aircraft, on ATN and on AOA. Therefore, it is proposed to add some supplementary tasks to AFD in order to implement and check some actions as specified in the action plan. If the results deliver the expected performance for ATN in the Italian airspace, this will enable the derivation and the adaptations for the European airspace. If the results do not enable to reach an acceptable performance in the most demanding areas of the European airspace, the technology limitations will have to be analysed and confronted with the observed data. This has the potential to result in a major rework addressing the technology limitations. The outcome of this investigation area is that SESAR can be tasked to assess some proposals from the action plan before deployment in the European area. Deployment will need an effective decision process which shall also include enforcement of error correction (see Section 4.1). EASA suggests that the deployment manager 38 shall be tasked to manage the implementation of the correction solutions while identifying and managing the associated risks. 4.7 Representativeness of bench test As result of all the information collected, one of the first elements that has been assessed in the emulation capability of the existing test environments. This analysis has been conducted looking at those main characteristics that, based on the actual knowledge of the problem, have been identified as potential drivers for the Provider Aborts. The result of this analysis is summarised in the following table: Strengths Multiple aircraft simulations are possible, although without the VDLM2 part. Network aspects are considered when remote testing is applied (equipment are connected via SITA/ARINC to the test facility) Data-link services: all the services in Reg. 29/2009 are covered by the emulation/simulation capabilities. Limitations Limited VGS emulation, especially for complex scenarios (that can exist today) Very limited emulation of the radio-frequency part 38 Cf. Commission Implementing Regulation (EU) No 409/2013 of 3 May 2013 Page 46 of 193

47 Strengths Separate CDA/NDA emulation (forward testing possibility) Limitations Table 5: Emulation Capabilities of test facilities From this table, it can be concluded that the current available test facilities (either in Eurocontrol EEC or Airtel ATN) are well suited for CM/CPDLC interoperability testing, that would allow the stakeholders to test (and, hence, to detect possible anomalies) of the equipment behaviour at functional level. Nevertheless, as part of these CM/CPDLC interoperability tests, some potential issues have been noted regarding the coverage of the ED-110B requirements and the differences between [ETSI] and the Link2000+ documents (e.g., [IOP_ANSP]) regarding tests at TP4 level. From EASA viewpoint, the combination of both factors may lead to some undetected interoperability problems between the airborne and ground applications under normal or abnormal conditions. However, this would have an impact at functional level, potentially leading to User Abort (annunciated disconnection) but not to the Provider Abort (PA). This is therefore not considered as a major contributor to the Provider Abort. On the other hand, some limitations have been identified in the existing test facilities regarding the VDLM2 interoperability testing and on the Radio Frequency domain. Both Eurocontrol EEC facilities and Airtel ATN tools have the possibility of emulating some VDLM2 aspects but with some relevant limitations (e.g., number of aircraft in view by a VGS, specific behaviour of the VGS, possible cross-effects among VGSs, Radio Frequency collisions, resources sharing and conflicts with other type of traffic). It is acknowledged that the emulation of all these aspects in the laboratory is usually very complex (and, even unfeasible). It should not be understood that these limitations are weaknesses of the existing test environments but an indicator of the potential origin of the Provider Abort as far as it was not detected during the different testing activities at several levels. The main outcome of this analysis has been that the root cause of the Provider Abort problem may be located either in the radio-frequency part or in the interaction (interoperability) between the VGS and the aircraft (avionics) as this part could not be thoroughly tested, relying only on the flight tests. 4.8 Technology considerations RF Channel Usage Solving the saturation on VDL2 requires dedicated frequencies for data and a separate CSC channel [9776]. The generic requirements for A/G communications service providers [GR_ACSP] were already anticipating that at least 3 frequencies would be necessary (cf. [EV_08_02] Figure 55). A revised deployment plan shall consider the current AOC, FANS and ATN data traffic volume sharing the same data frequencies. ATN is encapsulated into AVLC for transmission and access to the channel while requiring positive feedback. In particular, the application connections must stay in place even during movement (aircraft) from one link-layer connection to another (handover). If the delays get too long (or if the error rate gets too high), ATN will not get its acknowledgements in time and will re-transmit. This could result in unacceptable link performance. Once the multi frequency Page 47 of 193

48 deployment is defined to solve the congestion, it is necessary to confirm whether the timers and options from the technical standards are appropriately fine-tuned for the intended infrastructure and data traffic. It was observed in [MOON_2007] that AOA protocol uses more bandwidth than ATN. This is also correlated to the theory in [EV_08_02] for the same number of messages. The DLS regulation [ ] envisages the possibility to use several communication protocols for exchanging data between air-ground applications 39 but does not directly associate target performance requirements. According to computations based on [ACCESS] (see Section Table 4), the channel occupancy should stay below 40% in order to guarantee a timely delivery of ATN messages. Honeywell (cf. Appendix G) reports a maximum channel occupancy in the order of 40 % (cf. Figure 13) when leaving the USA compared to % (cf. Figure 14) when approaching Europe. Aircraft manufacturers report excessive amount of VDL2 retries at top of climb [EV_02_09]. The roadmap for the implementation of data link services in European Air Traffic Management Network (ATM) [DL_roadmap] was showing no single agreed solution for all users between VDL2 or VDL4. However, there was full consensus in the community that implementation of data link technology was essential to meet future needs. The roadmap clearly highlighted the fact that several VHF channels would be needed for any VDL technology. Eight VDL2 frequencies 40 were expected to provide the adequate support both for the forecast increase in AOC data exchange and for the planned ATM applications 41 in a first step. The main conclusion from this investigation area is that the current RF channel occupancy in Europe has peaks which do not enable the delivery of the ATN messages within the expected performance. This increases the likelihood of user aborts and provider aborts. In order to further investigate contributing factors from the avionics, it would be necessary to embed instrumentation on several configurations [EV_02_10] [EV_02_09]. The cost and resources needed to analyse the data collected from the embedded instrumentation could be significant [EV_02_10][EV_02_09]. It is also worthwhile noting that the initial deployment of AOA (ACARS via VDL Mode 2) was not smooth either [EV_02_10] VGS coverage With a radiation radius of approximately 200 NM, VGS emitting on the same frequency should be roughly separated by 400 NM on the ground in order to minimise the level of interference for an aircraft flying at FL300. The reported utilisation of the ACSP infrastructure bandwidth on the ground and the number of VGS in line of sight of an aircraft can make the observed occupancy vary on the aircraft [EV_08_01]. 39 Cf. [ ] (16) 40 Phase 2 Public consultation [DL_roadmap]; see also Figure million kilobits/month according to SITA comments to [DL_roadmap] Page 48 of 193

49 The main outcome of this investigation area is that the topology of the VGS distribution should be further studied with simulations taking into account the frequencies available as well as the data traffic needs as currently observed and predicted for ATN B2 deployment (SESAR services). The current deployment of the VGS ground stations should be reviewed and several frequencies shall be deployed Security aspects A scenario of Distributed Denial of Service (DDoS) is very unlikely. The attack would have needed compromised computers to send enormous amounts of traffic towards the network. The CRO, ANSPs and ACSPs are monitoring the network: such enormous data volumes would have been noticed. Another cyber strategy could have consisted in misdirecting the messages so that the recipient does not receive the expected message. The protected mode PM-CPDLC embeds some detection of trivial malicious or involuntary data modification (cf. Section ). PM-CPDLC integrates an end-to-end protection of message integrity by an application level integrity check that also provides assurance of correct delivery. The validation of the Application Message Integrity Check provides some evidence that the message has been delivered to the intended destination and from the expected source (Flight ID, 24-bit ICAO Address, and Ground Facility Designation). The Application Message Integrity Check is required even when no CPDLC Message is sent. A cyber attacker would need to listen to all data communications and generate proper Application Message Integrity. No particular airline, aircraft operator, ANSP or ACSP has been targeted since provider aborts affect all stakeholders. This scenario is unlikely compared to a DDoS which would be much easier to implement in order to get the same effect. Page 49 of 193

50 For all these reasons, security aspects are unlikely to have played a role in the occurrence of provider aborts. This does not mean that cyber threats should not be considered for deployment: this analysis is outside the scope of this investigation. The PM-CPDLC application version 1 does not address security requirements. However, nothing in the current draft specification will prevent from developing a secure version of the PM-CPDLC application (version 2) based on the secure ULCS services 42. Analyses related to the cyber vulnerabilities of the IP-based ATN are available 43. There are also studies regarding security architecture for all aeronautical communications including prototypes of secured A/G routers 44. ICAO ATN SARPs provide the following security services: Authentication and integrity of Air-Ground Telecommunications. Authentication and integrity of IRDP (Inter-Domain Routing Protocol) communications. Supporting Public Key Infrastructure (PKI). Finally, some preliminary investigation on the usage of Quantum Cryptography exists if PKI based security would become vulnerable to Quantum Computers Human factors The operational effects of the poor data link performance are universal for all flight crews in all aircraft types and with all avionics. They create additional workload and potential confusion. The ATCOs experience the same negative operational effects plus uncertainly on aircraft intent for clearances via data link. Non delivery of contact message for transferring aircraft to the next ATSU shows a particular risk since most serious air traffic incidents occur during this handover transition. Regarding the potential confusion in some aircraft installations of the turn right/left instructions (cf. Section ), until solutions are deployed to reduce disconnections to an acceptable level, EASA proposes to follow Eurocontrol CRO advice: the usage of turn left/right 46 instruction by ANSPs shall be inhibited by National Supervisory 42 Quoted from ICAO ACP WGN SGN2/4 WP 11, ACP WGN/5 WP 19, PM-CPDLC Validation Report, Version 0.1, May For example, Secure and Efficient IP Mobility Support for Aeronautical Communications, KIT Scientific Publishing 2013, ISBN For example, Dissertation Definition, Design, Implementation, Tests and Evaluation of an Embedded Router for a new generation of Avionic systems, Antoine VARET, INSA Toulouse, Cf. Quantum Crypt, Enhancement of AGT communications security using Quantum Cryptography, ENST/EEC/QC WP3.A, published on January 5, UM215, _instructions_to_turn_right.2fleft Page 50 of 193

51 Authority/Competent Authority. Further action on the affected airborne installations would be taken once the ATN network meets it intended performance. In order to limit the number of disconnections, white lists have been implemented by some of the ANSPs. A white list defines which aircraft are allowed to use data communications with a particular ANSP. These restrictions do not apply to FANS 1/A aircraft. On one hand, the introduction of the white list aims at the reduction of the workload on the ground (ATCO) and in the air (flight crew) and possible confusion and lack of situational awareness caused by the unexpected interruptions of the CPDLC communication. It is intended to maintain an acceptable level of safety for a risk which had been overlooked by the safety assessment [EV_05_03]. ATCOs considered that such interruptions, at the present rate of occurrence, could bring unacceptable level of additional workload when the percentage of Data Link equipped aircraft will be higher than to date. In such situation an unreliable CPDLC will probably contribute to the reduction of the declared capacity of the ATC sectors and thus the overall performance of the EATMN. On the other hand, for flight crews, airlines have to recommend to the flight crews to avoid using data communications if some of the fleet is not included on the white list. This avoids unnecessary connection attempts that would result in additional workload. The flight crews would have to rely on additional procedures to confirm whether the aircraft is on the white list. Such additional procedures would introduce new potential sources of mistakes. An additional element concerning the human factors aspects is the fact that in some areas very few aircraft are Data Link equipped and the ATCOs can hardly maintain their CPDLC related skills obtained during the training. This is in turn increases the risk of operational errors when using CPDLC thus a negative impact on workload. An excessive increase in workload can simultaneously negatively impact safety and efficiency Other aspects EASA notes that very few problem reports have been officially reported either by ANPSs, airlines, aircraft manufacturers or avionic equipment suppliers. It should be recognised that aircraft operators are required to report all occurrences which affect or could affect the safe operations of the aircraft and ANSPs are required to report all operational or technical occurrences which are considered to have significant safety implications. Although not being the root cause of the technical issues, this lack of notification has resulted in the late identification of the magnitude of the problem. Deployment of such a collaborative network not only requires coordination but also continuous technical monitoring and global error reporting with rectification enforcement until the decommissioning of the system Regulatory aspects There are obligations for applying (Article 4.5 of Regulation DLS regulation [ ]) common standardised procedures consistent with relevant provisions of the International Civil Aviation Organisation. Section Failure of CPDLC of PANS-ATM gives the actions to be taken by controller and/or pilot in case of CPDLC failure. However, PANS-ATM is not explicitly mentioned in the annexes of [ ] and in particular in its Annex II. Furthermore, according to Article 7.1 of [ ], the Member States have an obligation to comply with ICAO provisions specified in Annex III of [ ] in particular chapter 6 Air traffic services requirements for communications of ICAO Annex 11. The ICAO provisions do Page 51 of 193

52 not oblige the Member States to establish Required Communication Performance (RCP) and associated procedures, in accordance with the Manual on Required Communication Performance (RCP) (Doc 9869) and so far there is no such a legal obligation in EU law White list ATS providers are required to provide and operate the data link service in accordance with Article 3(1) of Regulation (EC) No 29/2009 [ ]. Per Article 7(1) of [ ], Member States are to ensure that air ground communications as specified in the Annex IV part B Regulation (EC) No 29/ are available to operators. Aircraft operators are also required to equip in accordance with Article 3 of [ ]. In accordance with regulation (EU) No 965/2012 the aircraft to be operated must have a valid certificate of airworthiness and in accordance with regulation 748/2012 the aircraft must comply with the airworthiness codes. Therefore the aircraft is deemed to be in conformity with the regulation if it had an EASA certificate. The introduction of a white list could be seen as contradicting both of the above requirements, as the service is only being made available to a select fleet and not all aircraft that have been declared to be in conformity with the rule by the relevant competent authority (e.g. EASA). Thus, requiring aircraft to be equipped to a different standard that it has been certified to, in order to be in conformity to a specific rule, is problematic as an ANSP does not have the privilege to act in such a manner. However, if the National Supervisory Authority has issued a safeguard measure in accordance to Article 7 of Regulation 552/2004 and has stated that the white list approach is being applied as the method to ensure safety and continuity of service, it could be deemed to be appropriate. Furthermore, the Member States shall inform the European Commission when there is a non-compliance with the Essential requirements of Regulation 552/2004. In conclusion, this investigation did not indicate unambiguous legal obligations to report of the poor performance of the data link service as mandated in DLS regulation [ ]. However, legal advice by the European Commission on the interpretation of the Safeguard measures of (EC) regulation 552/2004 for the white lists could be advisable. Additionally, it is recommended to re-emphasise the need for the reporting of adequate information from ANSPs to their National Supervisory Authority/Competent Authority and to the European Commission (and/or EASA), when this type of measures are taken, especially when taken to maintain safety Process Per article 6 of Regulation 1070/2009, the advice by the involved industry stakeholders through the ICB has been extended to the implementation of Single European Sky. The ICB has identified the lack of standards, guidance material, Acceptable Means of Compliance as one of the High risks for SES [ICB_risks]. However, high quality standards have to be complemented by the fine-tuning of design options in order to ensure an industrialisation and 47 air ground communication based on ATN and VDL Mode 2 including the required services Page 52 of 193

53 deployment tailored to the needs. For data link services, the standards include several models and options which have to be selected for deployment. Moreover, in the case of data link services, the integration of services and constituents into an integrated network specifically would have required an architect for deployment as well as a responsible entity for continuous technical monitoring and actions/corrections until decommissioning. The major risks for data link (like for any complex integrated system) arise during the transition from the integration to the industrialisation phase: Figure 3: SESAR concept maturity lifecycle model The ICB position on Data Link Services Implementing Rule [ICB_DL] is seen correctly identifying a need for a project management process as well as a process owner: in this case Interim Deployment Steering Group until the establishment of the Deployment Manager. However, as in 2004, no specific risks are identified arising from the technology, from the integration and from the operations. If the individual services and constituents were designed to meet the maximum foreseeable data load, there would be no solid business case and no realistic deployment scenario for VDL frequency management. Operating a global network should enable to smooth the data traffic peaks of some nodes. Finally, this raises questions regarding the Regulatory Impact Assessment that preceded the decision to draft the DLS regulation [ ]. Safety and interoperability risks were Page 53 of 193

54 considered but other types of risks such as the constraints related to the coexistence of ATC and AOC communications supported by VDL2 48 were not reflected upon. 48 Cf. Summary of responses document for the draft Implementing Rule on Data Link Services, Formal consultation 5 March 7 May 2007, Annex to Enclosure 2, October 2007, Edition 2.0 Page 54 of 193

55 5 Conclusions The current Provider Aborts (PAs) occurrences cannot be attributed to a single cause, acting in a deterministic and predictable way. Furthermore, they happen in a random way, at different locations, with different avionics, ANSPs, ACSPs, and at different times of the day. All attempts to establish a correlation between the apparent random patterns and the variables have not provided the necessary level of confidence. Despite of that, the technical investigation has concluded that the Provider Abort occurrences could be attributed to a combination of the following factors: Use of a single frequency for Common Signalling Channel (CSC) and data. Concurrency of AOC and ATN traffics over this single frequency channel, leading to an excessive channel usage level compared to the ATN protocol needs. The VGS networks are mainly driven by AOC needs, leading to a saturated and nonoptimised VGS network for en-route (over FL 285) purposes. The resulting RF complex environment (where there are many VGSs in view) introduces some unexpected demands on the VGS handover logic at airborne level. Increase of the Radio Frequency congestion leading to delays in data transmissions or disconnections. The complexity of the RF environment and the unpredictable RF channel availability, resulting from the combination of all these factors, may be the cause of the random nature of the PA occurrences observed. Based on these aspects, the introduction of multi-frequency with VDL mode 2 Autotune function and the optimisation of the VHF ground station (VGS) network should result in some improvements in the PA occurrences, subject to additional verification and validation prior to its implementation (as detailed below and in the proposed action plan). The VDL2 deployment has enabled airlines to continue using ACARS with increased data volumes generated by modern aircraft to improve their operational efficiency. The VDL2 channel should simultaneously support AOC and ATN. Otherwise, there would be an unrealistic requirement for a dedicated airborne radio for each service. On the other hand, because of the divergent needs from ATN and AOC protocols, channel occupancy will have to remain sufficiently low 49 to meet the round trip delays required for ATS data link services. As VDL2 does not support a priority mechanism, ATN and AOC packages are encapsulated into the common AVLC frames. The length of the frames should be optimised to favour the short ATN messages while maintaining an appropriate network performance. Additionally, highspeed ground networks could drastically reduce latency between the Air/Ground router and the ANSP if needed. 49 Probably around 20-40%, exact limit to be determined Page 55 of 193

56 It is essential to continue to support the needs of ACARS traffic at airports: currently the ground ACARS traffic represents roughly 60% of the overall ACARS traffic. A dedicated ground frequency may be implemented by some ACSPs as an initial step towards full multi-frequency VDL2 operation, or as a complementary technique. Current technical standards contain provisions for both possibilities. If the shortage of frequencies becomes a show-stopper at some airports or requests for data exchanges increase, the use of other technologies (e.g., AeroMACS) should be considered well in advance. The constraint generated by the mixing of AOC and ATN data leads to the requirement for a reduced throughput per channel on the scarcely available VDL2 frequencies. The key performance criteria are time delay and throughput, which determine the number of frequencies required to support the data link applications. Overcoming the VDL2 capacity limitation necessitates the distribution of channel occupancy on the available channels at European level, while considering the optimisation of the VGS locations as well as the split between en-route service volume, TMA/airport service volume and airport-only service volume in major airports of the core area. Besides, the management of VGS handovers in congested environment is critical. The airborne method to maintain signal connectivity is essentially based upon the quality/power of the RF signal. However, the VDL2 standard also foresees ground-requested aircraft-initiated handovers. The possibility to manage the network load with a predictive ground handover management should be evaluated in order to avoid hot spots along known flight paths. From a technical perspective, the lack of governance for the deployment, the operation and the control of the infrastructure (VGS, frequency optimisation, performance monitoring) has generated some of the identified technical issues; it has also impaired an efficient correction as soon as the first symptoms were recognised. Institutionally, centralisation can take several forms. This centralisation is justified by the integrated nature of the network as well as by the impairment of the network that could be created by the malfunctioning of any of the constituents and systems. For all these reasons, it would be seen advisable to reconsider the applicability timeframes of the DLS regulation [ ] in the sense whether they should be aligned with the proposed action plan as outlined in section 6. It is suggested that large scale deployment of the plan, as possibly refined by SESAR, should preferably be performed by the to-be-nominated deployment manager Regulation No (EC) 409/2013 Page 56 of 193

57 Finally, the reporting of the technical issues and of the mitigation means to maintain safety and to address concerns related to interoperability did not reach the National Supervisory Authorities/Competent Authorities, the European Commission and/or EASA. Therefore, a specific action should be undertaken to re-emphasise the necessity and to improve the reporting mechanisms currently in place, especially when the level of safety may be impacted. The safety implications identified in this investigation also require dedicated actions: The white lists should be endorsed by the applicable National Supervisory Authority to maintain safety for the ANSPs that have fully deployed the DLS regulation [ ]; these safeguards shall be notified to the European Commission in accordance with Regulation (EC) No 552/2004; It is strongly recommended that the National Supervisory Authority/Competent Authority issue a Safety Directive in order to stop the usage of the optional turn left/right instruction 51 by ANSPs; EASA should issue a Safety Information Bulletin (SIB) applicable to all EU operators and pilots recommending the immediate reversion to voice based communication in case of any Provider Abort occurrence when using CPDLC. 51 UM215, _instructions_to_turn_right.2fleft Page 57 of 193

58 6 Recommendations 6.1 Recommended actions based on the analysis stemming from this investigation This draft action plan is based on the analysis of the technical issues identified in Appendix F. The identified actions are focusing on multi-frequency implementation, with the purpose of mitigating the technical risks identified during these technical investigations. Nevertheless, some of the actions can also be applied to the current deployment in order to get the confirmation with respect to the issues identified. This list of actions may not be complete and should be considered as a starting point. EASA suggests that such a plan should be executed within the scope of SESAR. The SESAR project should refine these proposed actions and amend them as necessary. Therefore, any call for proposal should integrate flexibility for different options that would be triggered by previous results. It should also be possible to stop the SESAR project at any point once it has been demonstrated that the objectives have been appropriately validated. Action 1: ground infrastructure 52 The overall locations of VHF ground stations (VGSs) should be designed according to the intended service coverage (airport surface, TMA, en route). This would mean selecting the appropriate frequencies and adjusting the emitting power of the VGSs according to the required service coverage. This analysis should be performed by taking into account the current AOC and ATN data traffic on one hand and the variations of aircraft traffic flows on the other hand. Simulations should be performed for the distribution of all VGSs and their associated properties (emitting power, frequencies, etc) for all the services which are to be provided. The model should also take into account the constraints related to the current VGS deployment and the impact on the existing infrastructure. The next step would consist in deploying a subset of VGS and/or modifying some existing VGS according to the plan. Aircraft flying in the related area should be instrumented so as to confirm the measured radio frequency (RF) interference level with the assumptions in the related technical standards 53. Both the validation results (successful and unsuccessful) as well as the limitations of the deployment should be documented for subsequent decisions for a larger scale deployment. Action 2: level of RF interferences for core European area 54 A representative set of aircraft currently flying in the core European airspace and equipped with avionics having a good record of satisfactory connections should be instrumented so as to analyse the channel occupancy and RF interference level. This data should be compared with the CRO problems database and investigations in order to determine if any correlation is evident. 52 Cf. TI3, TI5 and TI6 in Appendix F 53 Such as e.g., EUROCAE ED92()/RTCA DO-281() 54 Cf. TI11 in Appendix F Page 58 of 193

59 Action 3: management of hot spots 55 The current zones in the airspace and times showing the highest AOC/ATN load should be identified. It should be analysed whether the airborne algorithms as defined in the relevant technical standards can suitably cope with the intended use. There should also be a complementary proposal for a method suited to the European airspace for the ground management of VGS ground-requested air-initiated handovers. Such method should be prototyped and trialled. There should be a comparison of the limitations between the air-initiated and the ground-requested air-initiated VGS handovers. Action 4: concurrent management of AOC and ATN data traffic 56 Simulations and analyses should be used to determine the maximum channel occupancy when concurrently managing AOC and ATN protocols under the conditions of the intended use. This should be performed with different frame lengths. Other network management techniques compatible with VDL2 could be proposed. Limitation to the frames of AOC traffic, balanced to allow adequate performances of both AOC and ATN data traffic should be also foreseen, and potentially being required in an update of the DLS regulation [ ]. Action 5: management of air/ground communication service provision versus distributed or centralised infrastructure 57 There should be a technical trade-off analysis of the constraints and benefits arising from a distributed infrastructure (where intermediate providers such as ARINC or SITA provide some services) compared to a fully managed infrastructure (where the ACSP is completely in charge of its network) up to a fully centralised model. The assessment should derive the constraints to be imposed on the distributed constituents and on the governance processes in order to guarantee the expected performance for the network. The evaluation should establish how the control of the infrastructure could be performed in all cases. Action 6: avionics 58 /ground end systems Avionics supporting multi-frequency should be trialled with instrumented installations. The objective would be to gather metrics on indicators related to the channel technical usage 59. This would enable the characterisation of the effect of multi frequency on the different ATN and VDL2 layers. Installations currently having a high level of disconnections and already capable of operating in multi frequency environment should be assessed in a multi-frequency environment 60. If 55 Cf. TI4 in Appendix F 56 Cf. TI7 in Appendix F 57 Cf. TI9 in Appendix F 58 Cf. TI2 in Appendix F 59 Such as for example the number of retries 60 Some of these avionics could necessitate upgrade to multi-frequency capability Page 59 of 193

60 problems persist, such installations should be instrumented in order to determine the causes of the problems. For avionics which generate internal failures or resets of connected units 61, EASA is obliged to act if there are safety concerns. However, reports would be needed in order to be able to justify the issuance of the appropriate corrective action. EASA could potentially undertake a dedicated audit of the airborne parts and appliances that have already been certified to assess continuing compliance with the declared certification basis. Further, the NSAs (National Supervisory Authority) could undertake a review the Declaration of Verification (DOVs) issued by their ANSPs. Action 7: ACSP performance monitoring 62 This action should assess the status of the process, the metrics and the tools already developed by CRO/ACSPs and their adequacy to assess network performance and the ACSP services in general. It should propose modifications or new developments suitable to continuously monitor the criteria alerting on a necessary activity before the degradation of the overall network below the required performance. This analysis should take into account the way that the ACSPs provide services both for AOC and ATN traffic over the same channel(s). Action 8: ground/ground network 63 This action shall develop or reuse the process, criteria and tools in order to monitor and act upon ground infrastructure bottlenecks. Action 9: CM/CPDLC interoperability robustness testing 64 The test benches have been an excellent tool to debug the interoperability requirements of avionics and ground data link end systems. This action should continue to sponsor interoperability testing with any of the existing test benches for any new or modified product. This would avoid adding problems at network level, that could have been identified and that would be much harder to isolate in the network or during operation. Additionally, this action should install automated CM/CPDLC exchanges between selected end ground system and avionics in multi-frequency environment. The objective would be to assess pre-defined scenarios as well as robustness to high load. Action 10: ground data link end systems 65 See action 9 for new deployments of ground data link end systems. This action shall also elaborate a comprehensive deployment package based on the technical standards and on the specific aspects of the European infrastructure. It would allow a 61 As reported by KLM for the its equipped CMU 62 Cf. TI8 in Appendix F 63 Cf. TI10 in Appendix F 64 Cf. TI12 in Appendix F 65 Cf. TI1 in Appendix F Page 60 of 193

61 harmonised verification, acceptance and introduction into service process of the end systems by the ANSPs (involving the respective Competent Authorities). It shall contain requirements, explanations on infrastructure decisions as well as recommendations explaining the rationale. 6.2 Recommendations for further investigations The analysis of the overall location of VGS should also be performed for the anticipated AF#6 in the [PCP_consultation] 66. It shall also take into account the study launched by SJU on VDL2 [SJU_VDL2]. VDL2 was not designed for large data exchanges. Therefore, it is essential to expedite the fielding of specific technology for the airport surface (e.g., AeroMACS). In parallel, it is important to explore the use, for en route, of alternative technologies such as satellite-based communication (e.g., ESA project ANTARES or its precursor THAUMAS) and/or new technologies such as L-band Digital Aeronautical Communication System (LDACS). 66 Initial Trajectory Information Sharing Page 61 of 193

62 Appendix A: Acronyms List This table contains the list of acronyms used in this document Acronym A/G AAC ACARS ACSP AeroMACS AFD AMC AOA AOC APC ARTCC ATC ATCO ATN ATSU AVLC B1 CPDLC CRO CSC EEC ES ESA FANS FL G/G GSIF Meaning Air-Ground Airline Administrative Control Aircraft Communications Addressing and Reporting System Air-Ground Communication Service Provider Aeronautical Mobile Aircraft Communication System WiMAX ATC Full Datalink Acceptable Means of Compliance ACARS over AVLC Airlines Operational Control Airline Passenger Communications Air Route Traffic Control Center (FAA) Air Traffic Control Air Traffic Controller Aeronautical Telecommunication Network Air Traffic Service Unit Aviation VHF Link Control Baseline 1 (ATN) Controller Pilot Data Link Communication Eurocontrol Central Reporting Office common signalling channel Eurocontrol Experimental Centre End System European Space Agency Future Air Navigation Systems Flight Level Ground-Ground Ground Station Information Frame Page 62 of 193

63 HMI ICAO ICB IP JIRA MPLS MUAC Acronym Human Machine Interface Meaning International Civil Aviation Organization Industry Consultation Body Internet Protocol CRO on-line reporting tool for data link issues Multiprotocol Label Switching Maastricht Upper Area Control Centre (Eurocontrol) ODIAC Operational Development of Integrated Surveillance and Air/Ground (Eurocontrol) PCP Pilot Common Project (see EC No 409/2013) PDR Proposed Defect Report (to ICAO Doc [9705]) PENS PETAL RCP RF RTF SARPs SES SESAR SIB SLA SMS TCP TMA TP4 TSEL UCLS UDP Pan European Network Services Preliminary Eurocontrol Test of Air/ground data Link Required Communication Performance Radio Frequency radiotelephony Standards and Recommended Practices (ICAO) Single European Sky Single European Sky Air Traffic Management Research Safety Information Bulletin Service Level Agreement Safety Management System Transmission Control Protocol Terminal Manoeuvring Area ISO/IEC 8073 Class 4 transport protocol Transport Selector ATN Upper Layer Communications Service User Datagram Protocol VDL2 VHF data link mode 2 VGS VHF VHF Ground Station Very High Frequency Page 63 of 193

64 VPN WiMAX Acronym Virtual Private Network Meaning Worldwide Interoperability for Microwave Access, Inc. (group promoting IEEE wireless broadband standard) Page 64 of 193

65 Appendix B: References Reference Document [ ] COMMISSION REGULATION (EC) No 29/2009 of 16 January 2009laying down requirements on data link services for the single European sky [9705] ICAO Doc AN/956 Manual of Technical Provisions for the Aeronautical Telecommunications Network (ATN) Second Edition, December 1999, including identified PDRs [9776] Manual on VHF Digital Link (VDL) Mode 2, Doc 9776 AN/970, First edition [ACARS_TRAN] ACARS TO VDL Transition Plan, prepared By Aloke Roy, ARINC, Incorporated for AEEC Data Link User Forum, January 28-29, 1998, Orlando, Florida [ACCESS] CEC TEN-T ATM Task UK/96/94, ACCESS, ATN Compliant Communications European Strategy Study, Deployment scenarios for air/ground subnetworks, ACCESS/STNA/220A/WPR/038, Revision Number Issue 1.0, published 02 November 1998 [AFD_Doc] [Annex 10] [CAFT_1998] [CISCO_MPLS] [DLISG] [DL_roadmap] ATC Full Datalink (A.F.D.), 02.08, Demonstration handbook, edition AFD Experimental Plan, edition ATC Full Datalink Demonstration Plan, edition Project Quarterly report to AFD first output (20/12/2013), slides presented during the 1 st internal workshop VHF air ground digital link (VDL) of ICAO Annex 10 Aeronautical Telecommunications Volume III, Part I (Digital Data Communication Systems) (First edition July 1995 incorporating Amendment 81 ( )). Migration to VDL Mode 2, Presentation to the C/AFT Datalink Sub- Group Seattle, 12 March 1998 Enterprise QoS Solution Reference Network Design Guide, CISCO, Version 3.3, chapter 5 MPLS VPN QoS Design Material distributed to the Eurocontrol Data Link Implementation Support Group Roadmap for the Implementation of data link services in European Air Traffic Management (ATM), Helios, Helios Technology, Sofreavia, IATA, Integra Consult, Airbus, February 2003, Page 65 of 193

66 Reference Document [ED-110B] Interoperability requirements standard for aeronautical telecommunications network baseline 1 (ATN B1 Interop Standard), Eurocae, December 2007 [ED-120] [ETSI] [FAA_Build1] [FANS_ATSRO] Safety and Performance Requirements standard for Air Traffic Data Link services in continental airspace, ED-120 including changes 1 and 2, Eurocae, published in May 2004, including Change 1, published in April 2007, and Change 2, published in October 2007 Data Link Services (DLS) System; Community Specification for application under the Single European Sky Interoperability Regulation EC 552/2004; Requirements for ground constituents and system testing, ETSI EN V1.1.1 ( ) MIAMI Controller Pilot Data Link Communications summary and assessment, MITRE, Contract DTFA01-01-C Air Traffic Services Systems Requirements and Objectives - Generation 2, Model 757/767, Document No D926T0280, dated May 12, 2000 [FANS_ISPACG] FANS-1/A Datalink Communications Environment, ISPACG, Version 1.0 March 7, 2008 [Garmin_non-AOC] [GOLD] Non-AOC Considerations for Operators Using Link CPDLC. Garmin International Inc., December 19, 2013 Global Operational Data Link Document (GOLD), ICAO, Second Edition 26 April 2013 [GR_ACSP] Generic Requirements for an ATN/VDL Mode 2 Air/Ground Communications Service Provider, Eurocontrol, edition [Grappel] [ICB_2004] [ICB_DL] Internet over the VDL-2 Subnetwork-the VDL-2/IP Aviation Datalink System, report NASA/G-2, published on 20 October 2000 Internet over the VDL-2 Subnetwork-the VDL-2/IP Aviation Datalink System 6. Performing Organization Industry Consultation Body, 1 st meeting, 28 April 2004, Draft minutes ICP position on DLS IR, adopted at ICB/50 [ICB_risks] Shaping the ICB work programme: SES Top 10 Risks, December 2013 [IOP_ANSP] [IOP_AVIONICS] CM/CPDLC Generic Interop Test Plan for Air Navigation Service Providers, Version 1.6 Generic Interop Test Plan for Avionics - Part 1, Upper Layers and CM/CPDLC applications, Version 2.3 [LINK_AGI] Link Guidance to Airborne Implementers, issue 2.000, dated 18 November 2013 [LINK_GGI] Link Guidance to Ground Implementers, issue 2.000, dated 18 November 2013 Page 66 of 193

67 Reference Document [LINK_SPEC] EUROCONTROL SPECIFICATION on Data Link Services, EUROCONTROL-SPEC-0116, Edition 2.1 [MAN_EC] Letter to EASA from European Commission on Technical Issues on the implementation of the Regulation 29/2009 (Data Link) Request for EASA investigation, dated 9th December [Mgt_infrastructure] PREDICTIVE MANAGEMENT OF AIR-GROUND COMMUNICATION INFRASTRUCTURE, Ravi Vaidyanathan, Anthony Triolo, Telcordia Technologies Inc. & Aniruddha Karmarkar Lockheed Martin. [MOON_2007] [MUAC_PROC] MOON - Air-Ground Data-Link Monitoring pre-operational Network, Deliverable 4, Trial Phase Synthesis TPS, edition V1.1a, 15-May-2007 Air / Ground Data Link Procedures For Flights within the area of responsibility of Maastricht-UAC, Eurocontrol, Edition 2.5, published July 2008 [OLDI_corr] Corrigendum to EUROCONTROL Specification For On-Line Data Interchange (OLDI), EUROCONTROL- SPEC-0106, Edition 4.2 [PCP_consultation] SESAR deployment, Targeted stakeholder consultation on the establishment of the Pilot Common Project supporting the implementation of the European Air Traffic Management Master Plan, 12 December 2013 [PETAL II] [PETAL_PROC] [SA_DL] [SJU_VDL2] PETAL II Preliminary Eurocontrol Test of Air/ground data Link, Phase II, Early Operational Implementation, Rob Mead, PETAL II Trials Manager, Eurocontrol DED/2 PETAL II Preliminary Eurocontrol Test of Air/ground data Link, Phase II, Operational Validation & Early Implementation, Rob Mead, PETAL II Trials Manager, Eurocontrol DIS/ATD Air / Ground Data Link Procedures For FANS-1/A Flight Crews within Maastricht UAC Airspace, Eurocontrol, AGDL Procedures for FANS-1/A Flight Crews, Version 4.0 Safety Analysis Report, Data link occurrences, EASA E SESAR, Tender Specifications annexed to Invitation to Tender, Ref. SJU/LC/0096-CFT, VDL Mode 2 Capacity and Performance Analysis, 30 September 2013 [VDL_channel] Eurocontrol VDL Mode 2 Capacity Analysis through Simulations, WP5 - Simulation Results for initial Link2000+ deployment (single VDL 2 channel), Edition 2.0, edition date Page 67 of 193

68 Appendix C: Investigation Evidences Evidence [EV_01_01] [EV_01_02] [EV_02_01] Description CRO reply to the questionnaire on avionics/aircraft manufacturer, dated 24 th of January 2014 Evidences regarding provider aborts status presented by CRO Airbus reply to the questionnaire on avionics/aircraft manufacturer, dated 10 th of February 2014 [EV_02_02] Meeting Notes of the Teleconference with Airbus, dated 13 th of February 2014 [EV_02_03] [EV_02_04] [EV_02_05] [EV_02_06] [EV_02_07] [EV_02_08] [EV_02_09] [EV_02_10] [EV_02_11] [EV_02_12] Garmin International Inc. reply to the questionnaire on avionics/aircraft manufacturer, dated 11 th of February 2014 Meeting Notes of the Teleconference with Garmin International Inc., dated 13 th of February 2014 Boeing reply to the questionnaire on avionics/aircraft manufacturer, dated 12 th of February 2014 Spectralux reply to the questionnaire on avionics/aircraft manufacturer, dated 6 th of February 2014 Thales avionics reply to the questionnaire on avionics/aircraft manufacturer, dated 10t h of February 2014 Detailed evidences for avionics Embraer reply to the questionnaire on avionics/aircraft manufacturer, dated 24 th of February 2014 Honeywell reply to the questionnaire on avionics/aircraft manufacturer, dated 26 th of February 2014 Rockwell Collins reply to the questionnaire on avionics/aircraft manufacturer, dated 7 th of February 2014 Meeting Notes of the Teleconference with Boeing International Inc., dated 12 th of February 2014 [EV_03_01] ARINC reply to the questionnaire on ACSP, dated 5 th February 2014 [EV_03_02] Meeting Notes of the Teleconference with ARINC, dated 14 th February 2014 [EV_03_03] SITA reply to the questionnaire on ACSP, dated 7 th February 2014 [EV_03_04] Meeting Notes of the Teleconference with SITA, dated 21 st February 2014 [EV_04_01] MUAC reply to the questionnaire on ANSP, dated 7 th February 2014 [EV_04_02] Meeting Notes of the meeting with MUAC, dated 17 th February 2014 [EV_04_03] Skyguide reply to the questionnaire on ANSP, dated 12 th February 2014 Page 68 of 193

69 Evidence Description [EV_04_04] Meeting Notes of the Teleconference with Skyguide, dated 12 th February 2014 [EV_04_05] from Skyguide dated 21 st February 2014 with plots on VDLM2 Channel Usage [EV_04_06] NATS reply to the questionnaire on ANSP, dated 6 th February 2014 [EV_04_07] Meeting Notes of the Teleconference with NATS, dated 18 th February 2014 [EV_04_08] NATS Presentation UK Domestic Datalink, dated 13 th February 2014 [EV_05_01] [EV_05_02] [EV_05_03] [EV_05_04] [EV_06_01] [EV_06_02] Adjustable performance requirements Key information from pioneer phase not properly conveyed for deployment (see Appendix H: Details of evidences) Incomplete safety assessment (see Appendix H: Details of evidences) TP4 timers customisation (see Appendix H: Details of evidences) Misinterpretation of technical standards such as for example [ED-110B] (see Appendix H: Details of evidences) Misuse of ICAO VDL2 architecture versus ICAO [9776] (see Appendix H: Details of evidences) [EV_07_01] Airtel ATN reply to the questionnaire on Test Centres, dated 5 th February 2014 [EV_07_02] Meeting Notes of the Teleconference with Airtel ATN, dated 12 th February 2014 [EV_07_03] Airtel ATN presentation Airtel ATN Test Software, dated 12 th February 2014 [EV_07_04] Eurocontrol EEC reply to the questionnaire on Test Centres, dated 31 st January 2014 [EV_07_05] Meeting Notes of the Teleconference with Eurocontrol EEC, dated 6 th February 2014 [EV_08_01] [EV_08_02] [EV_08_03] Theory of networks in ATN/AOA context (see Appendix H: Details of evidences) Channel sharing between ATN and AOC (see Appendix H: Details of evidences) Role of CSC (common signalling channel) (see Appendix H: Details of evidences [EV_09_01] KLM reply to the questionnaire to airlines, dated 7 th of February 2014 [EV_09_02] DLH reply to the questionnaire to airlines, dated 4 th of February 2014 Page 69 of 193

70 Appendix D: EASA Investigation Team and Eurocontrol CRO focal points Member Role Role at EASA Catherine Gandolfi Team Leader Policy Officer Executive Directorate Isabel Clara Barbero Team Member ATM Standardisation Team Leader Martin Bernandersson Safety analyst Safety analysis section Frederic Copigneaux Team Member Head of ATM/ANS Certification Department Bryan Jolly Team Member ATM/ANS Rulemaking Officer Laszlo Kiss Team Member Head of ATM/ANS Rulemaking Section Angel David Mancebo Pajares Team Member Avionics Systems Expert Hannu Melaranta Team Member ATM/ANS Rulemaking Officer Emilio Mora-Castro Team Member ATM/ANS Certification Expert Jussi Myllarniemi Team Member Head of ATM Rulemaking Department Emanuil Radev Team Member ATM/ANS Rulemaking Officer Friedhelm Runge Team Member Head of Avionics Section Hans Trautenberg Team Member ATM/ANS Certification Expert Table 6: EASA Data-Link investigation team The following staff members from the Eurocontrol Central Reporting Office (CRO) have collaborated in close partnership with EASA investigation team: Jacky Pouzet, as focal point Patrick Delhaise Soren Dissing Isabelle Herail David Isaac Page 70 of 193

71 Appendix E: Stakeholders and focal points Stakeholder Type of stakeholder Focal point Airbus aircraft/avionic manufacturer Delphine Blais Airtel validation platform Santi Ibarz ARINC communication service provider Yanko Videv Boeing aircraft manufacturer Joseph Mc Pherson CANSO ANSP Eduardo Garcia CRO CRO Jacky Pouzet Embraer aircraft manufacturer Luis Malizia Alves Joao Tabora EEC validation platform Isabelle Herail ENAV ANSP Maria Grazia De Fenza FINNAIR airline Antti Aukia Garmin avionic manufacturer Richard Kynard Honeywell avionic manufacturer Daniel Nucuta KLM airline Ceriel Janssen Indra ground system manufacturer José Luis González Paz Lufthansa airline Thomas Körber MUAC ANSP Christopher Adams NATS ANSP Jon Westbrook Network Manager ANSP Jacky Pouzet Rockwell Collins avionic manufacturer Brian Connell Ryanair airline John Clear Page 71 of 193

72 Stakeholder Type of stakeholder Focal point Selex ground system manufacturer Pierluigi Fantappié SITA communication service provider François Bardin Skyguide ANSP Gwénaël Vern Spectralux avionic manufacturer Ian Gilbert Thales avionic avionic manufacturer Hugues Meunier Thales ATM ground system manufacturer SJU SESAR Joint Undertaking José Antonio Calvo Fresno Table 7: Stakeholders (and identified focal points) participating in the investigation Page 72 of 193

73 Appendix F: Analysis of Technical Issues The table below summarises the analyses carried-out on the identified potential technical issues, including the possible effects and the likelihood of its contribution. Technical issue Effect Contribution Comment Undetected design errors in ground Data Link End System (TI1) Provider Abort Low Design errors at application level should not contribute significantly to Provider Abort. User Abort Medium For the ANSPs in which the CPDLC service is operational, the ground end system is supplied by the same manufacturer. Delays Medium Same rationale as for User Abort. Undetected design errors in airborne equipment (TI2) Number and location of VGSs: increased number of RF collisions (TI3) Provider Abort Low Design errors at application level should not contribute significantly to Provider Abort. User Abort Low (except for some specific avionic) Several interoperability testing including robustness for most avionic suppliers Deviations have to be declared and accepted In service reporting of problems from operators Dissimilarity of avionics Delays Low Same rationale as for User Abort Provider Abort High RF interference User Abort High RF interference Delays High RF interference Inappropriate management of VGS handovers in congested environment (TI4) Provider Abort High Loss of communication due to excessive or inappropriate VGS handovers User Abort High Loss of communication due to excessive or inappropriate VGS handovers Delays High Loss of communication due to excessive or inappropriate VGS handovers Page 73 of 193

74 Technical issue Effect Contribution Comment Reduced RF channel availability for CPDLC (TI5) Provider Abort High Impossibility of send/receive data. Activation of corresponding timers. User Abort High Impossibility of send/receive data. Activation of corresponding timers. Delays High Impossibility of send/receive data. Delays. Single channel for CSC and data (TI6) Provider Abort High Impossibility of send/receive data. Activation of corresponding timers. User Abort High Impossibility of send/receive data. Activation of corresponding timers. Delays High Impossibility of send/receive data. Delays. Common AVLC protocol for connectionless (AOC) and connection-oriented (ATN) protocols (TI7) Provider Abort Medium If channel occupancy is limited (typically =~ 40%) User Abort Medium If channel occupancy is limited (typically =~ 40%) Limited monitoring of ACSPs (based on monthly reports review) (TI8) Delays Medium to High Provider Abort Low to Medium User Abort Low to Medium Longer frames may lead to ATN delays Too small frames could also impair performance Contribution cannot currently be determined since provider aborts are not explicitly monitored in [GENACSP] Limited monitoring of ACSPs may contribute to a degradation of the ground/ground performances with the consequence on delays, reaching the timers activation thresholds. Page 74 of 193

75 Technical issue Effect Contribution Comment Delays Medium Limited monitoring of ACSPs may contributing to a degradation of the ground/ground performances with the contribution to round-trip delays, although without reaching the timers activation thresholds. Diversity of ACSP setups (TI9) Provider Abort Medium to High User Abort Medium to High Different setups of ACSPs with outsourcing SITA model to ANSPs high Same as above Delays High Same as above Delays in the ground/ground network (TI10) Provider Abort Medium Air-Ground link has more impact and it is not tested User Abort Medium Ground/ground performances contributes to round-trip delays, potentially reaching the timers activation thresholds Delays Medium Ground/ground performances contributes to round-trip delays, although without the timers activation thresholds Limited RF interoperability testing (TI11) Provider Abort High Only CM/CPDLC is tested for interoperability on ground A single flight test would not necessarily see the worst operational conditions User Abort High Same as above Delays High Same as above Limited CM/CPDLC interoperability robustness testing (TI12) Provider Abort Low Robustness testing performed with well-formed signals RF model of standards User Abort Medium Lack of thorough robustness testing may increase the occurrence of user aborts in untested, although possible, situations Page 75 of 193

76 Technical issue Effect Contribution Comment Delays Medium Lack of thorough robustness testing may skip some possible scenarios in which round-trip delays increases due to miscoordination between air/ground applications. Table 8: Summary table for the technical issues analysis Page 76 of 193

77 Appendix G: RF Channel Usage Statistics The following figures show the RF channel usage statistics received from: SITA ARINC Skyguide (which owns and maintains their own VGSs for SITA network) These statistics are defined as percentage of time RF energy (typically above -90 dbm) is present on the channel as reported by the VDL radio transceiver. They represent any energy in the channel detected by the VDL radio The radio s own transmissions Aircraft at the airport Aircraft flying over the airport Any adjacent VDL ground stations (on same airport) Any other source of in-band energy on the channel Figure 4: ARINC - Average of Hourly Max Utilisation at Busiest L2K Stations - November 2013 Page 77 of 193

78 Figure 5: ARINC - RF Utilisation on a Random Day 3 Nov, 2013 Figure 6: ARINC - RF Utilisation on a Random Day 3 Nov, 2013 Page 78 of 193

79 Figure 7: SITA RF Statistics (Frankfurt VGS February 2014) Page 79 of 193

80 Figure 8: Skyguide ZRH9 RF usage Statistics February 20 th 2014 Figure 9: Skyguide ZRH8 RF usage Statistics February 20 th 2014 Page 80 of 193

81 Figure 10: Skyguide ZRH7 RF usage Statistics February 20 th 2014 Figure 11: GVA8 RF usage Statistics February 20 th 2014 Page 81 of 193

82 Figure 12: GVA7 RF usage Statistics February 20 th 2014 Page 82 of 193

83 Figure 13: RF Channel Usage Statistics leaving USA (Honeywell) [DLISG] Page 83 of 193

84 Figure 14: RF Channel Usage Statistics approaching Europe (Honeywell) [DLISG] The number of aborts is represented by the red bars. The number of Logon attempts is depicted in blue. FANS has better ratios for Logon attempts and Logon success versus aborts than ATN. Page 84 of 193

85 Figure 15: ATN logons/aborts Figure 16: FANS logons/aborts Figure 17: ATN technical round trip delay Figure 18: FANS technical round trip delay Page 85 of 193

86 Appendix H: Details of evidences [EV_01_02] Evidences regarding provider aborts status presented by CRO PA were recognised as a major risk as of March This was confirmed by CRO to EASA during this investigation. Figure 19: PA occurrences [DLISG] CRO session March 2012 Figure 20: Origin of provider aborts from [DLISG] CRO session March 2012 Page 86 of 193

87 Figure 21: Statistical analysis of sources of PA [DLISG] CRO session March 2012 Page 87 of 193

88 [EV_02_08] Detailed evidences for avionics Some aircraft installations have been observed as being more vulnerable to provider aborts [DLISG] 67. Figure 22: PA trend from [DLISG] CRO session March CRO session March 2012 Page 88 of 193

89 [EV_05_01] Adjustable performance requirements [ED-110B] chapter 5 provides a link to the Operational Performance Assessment which should be developed according to the guidelines of ED-78A/DO-264. Sections 4.3.2, , , of [ED-120] (identified in point 11 of Annex III in [ ] contain the performance requirements. The approach in [ED-120] is to have some performance requirements adjusted by each state (cf. note 3) such as ET (expiration time) and TT(95) (transaction time for 95% of all transactions). Moreover, [ED-120] foresees that some values need additional validation. This is not an unusual process for technical standards. Eurocontrol guidance material [LINK_GGI] 68 rightly makes the parallel between ATN B1 TP4 and TCP for the transport connection. TCP is commonly used to connect to the World Wide Web e.g., by using http. It is expected for a company to deploy its network, TCP ports and sockets according to the intended usage, the expected volume of data transfers and the transmission bandwidth. Similarly, the ATN deployment should have customised key parameters of the infrastructure according to the flexibility provided by the technical standards. For example, [ED-120] anticipates a coordinated process for arrival/departure and TMA environments (cf. note 3 in Table 4-8 below). This is outside the scope of [ ] but this 68 A Page 89 of 193

90 would have to be considered for deployment below FL 285. On the other hand, European States should have coordinated appropriate performance requirements in order to optimise the European network for en route operations above FL 285 (see e.g., notes 3 & 4 in Table 4-8 as well as notes 4 and 5 in Table 5-21 below). Page 90 of 193

91 Page 91 of 193

92 [EV_05_02] Key information from pioneer phase not properly conveyed for deployment During PETAL II trials, the traffic estimated for 2010 had peaks of more than 200 IFR flights per day in the dense areas of the European airspace [PETAL II]. SITA reports 500 simultaneous aircraft connections although the overall traffic has not recovered from the economic crisis. These 500 simultaneous connections represent all data communications: airlines operational communications (AOC), effective flight crews/air traffic controller data messages and ATN administrative exchanges. The log-on procedure between PETAL II trials (cf. Figure 23) and deployment (e.g., in Maastricht in Figure 24) have not changed significantly. However, in the meantime, AOC data traffic has increased as well as the number of ATSUs having deployed data communications. Nevertheless, there is no continuity of data link services on the ground in the core area. The ATN operations produce administrative data on the infrastructure (including on ARINC and SITA infrastructures) that can be generated from the departing aerodrome. EASA could not find an analysis of the estimated data traffic generated by ATN as well as the impact of lack of continuity of data link services in the core area on data volume and delays (which could generate provider aborts). Figure 23: [PETAL_PROC] Log-on Page 92 of 193

93 Figure 24: [MUAC_PROC] Log-on [PETAL II] Trials had highlighted numerous defects identified (e.g., timers). The FAA CPDLC Build 1 program in Miami ARTCC [FAA_Build1] was based programmatically, operationally, and technically on the concept of operations and architecture of PETAL II program. During the FAA CPDLC Build 1 trials [FAA_Build1], MITRE produced metrics such as the Mean Transaction Time for all Message Types. MITRE also summarised the performance which had been achieved by the ACSP versus the expected targets: ARINC consistently met or exceeded their performance goals for network availability of 99.9 for Florida Sectors and 99.4 for Caribbean sectors. The summary report [FAA_Build1] recognised that Collecting data from the Build 1 system for use in performance analysis was labor intensive. Figure 25: [PETAL II] excerpts EASA acknowledges the efforts to specify generic requirements for the ACSPs [GR_ACSP] that would be materialised into service level agreements between the ACSP and the ANSPs. However, some of these requirements cannot be measured or controlled. Page 93 of 193

94 Figure 26: [GR_ACSP] uncontrollable requirement Figure 27: [GR_ACSP] not specifying an acceptable maximum time Other requirements are not described in a manner that highlights the risks on the global European network. The impact of the example above (cf. Figure 27) can result in undesirable delays (provider aborts) or TP4 re-transmissions (contributing to channel congestion). The example below (cf. Figure 28) would deserve explanations on each possibility together with the associated risks for the global network performance. There should be a requirement for the implementation of the solution optimising global performance together with the possibility for a deviation whose impact/acceptability should be assessed at the network level. Figure 28: [GR_ACSP] alternate requirements without risk identification Finally, some ACSP requirements in [GR_ACSP] fall outside the scope of the responsibility of the ACSP and shall be implemented by the ANSPs. Figure 29: Example of [GR_ACSP] requirement applicable to ANSP G/G router Page 94 of 193

95 [EV_05_03] Incomplete safety assessment [ED-120] makes the link between safety requirement SR-ACL-12 and RCP en route (RCP ER ). The safety requirement is related to the annunciation of a message which was not delivered during the expected timeframe. The values of ET (expiration time) and TT (95) (transaction time for 95% of all transactions) have to be specified by the states. The analysis foresees that the likelihood of late or expired messages used for separation shall be no greater than remote. The ACL operational hazards assessment (table 5-27) fails to address the common cause failure that would be created by an inadequate performance of the network. For example there is no analysis of undetected late or expired messages used for separation occurring for several aircraft in an ATSU or of massive amount of expired messages in a busy ATSU. There should have been an additional safety objective similar to SO-ACL-6 related to the likelihood of undetected late or expired messages used for separation impacting several aircraft in a busy ATSU. The importance of high availability service is recognised and discussed in PDR M for PM-CPDLC in case of CPDLC connection recovery after failure of the main system: Figure 30: ICAO PDR M for PM-CPDLC Page 95 of 193

96 Page 96 of 193

97 Page 97 of 193

98 [EV_05_04] TP4 timers customisation [9705] 69 anticipate configurable values for all timers and protocol parameters. ATN B1 interoperability standard [ED-110B] foresees the usage of dynamic TP4 timers. [LINK_SPEC] proposes some recommendations for TP4 timers. Both [LINK_AGI] and [LINK_GGI] have more stringent recommendations for these TP4 timers for the minimum Window time (W). At the same time, it is recognised that a non-compliant aircraft system can create a serious risk on the infrastructure. EASA does not understand why such a risk has not been properly mitigated by detection means and requirements on the ground in order to mitigate the risk coming from a non-compliant airborne avionics. A non-compliant avionic could be caused by software bugs introduced as part of a modification without any intention to deviate from a requirement! ICAO [GOLD] 70 indicate that monitoring the rate of TP4 retries for each system on the ground and identifying which aircraft are involved will allow the identification of problems occurring within the network/ground system or with a particular aircraft. It can be concluded that monitoring of these TP4 retries has to be implemented in order to isolate problems. ICAO [9776] specifies that this parameter enables to control the delay of the packets in the network queue. The [ETSI] document does not include all the relevant test cases for TP4 such as for example TP4 Keepalives (ANSP) or TP4 Inactivity Timer (Airborne). Figure 31: excerpts of requirements for dynamic TP4 timers in [ED-110B] D Page 98 of 193

99 Figure 32: detailed requirements for dynamic TP4 timers in [ED-110B] Figure 33: TP4 recommendation from [LINK_SPEC] Page 99 of 193

100 Figure 34: recommendation for TP4 W in [LINK_GGI] Page 100 of 193

101 Figure 35: recommendation for TP4 W in [LINK_AGI] Page 101 of 193

102 Figure 36: TP4 monitoring recommended by [GOLD] Figure 37: Role of W for packet size in ICAO [9776] Page 102 of 193

103 [EV_06_01] Misinterpretation of technical standards such as for example [ED-110B] AFD reported that they had not interpreted all the options provided in [ED-110B] [EV_06_01]. Interestingly, Eurocontrol made the same interpretation error in the OLDI specification and published a corrigendum. This impacted the OLDI messages to support the CPDLC Handover procedures between ATSUs ([DLISG] 71. Figure 38: AFD reporting on misinterpretations of [ED-110B] 71 Cf. CRO session 20 October 2012, CRO Proposal of LOF-NAN-Adjustments OLDI-Ed4 & summary of CRO Hot Topics Session March 28, 2012 agenda item 11 Page 103 of 193

104 Figure 39: Correction in OLDI [OLDI_corr] Figure 40: DFS/MUAC CPDLC implementation status March 2012 [DLISG] Page 104 of 193

105 [EV_06_02] Misuse of ICAO VDL2 architecture versus ICAO [9776] All AOC and ATS applications are carried on the single VDL Mode 2 VHF channel ( MHz) which is the world-wide Common Signalling Channel (CSC) that is shared by all DSPs that offer service 72. Back in 1998 [CAFT_1998], migration from the old plain VHF ACARS to VDL ACARS was advertised. Indeed a 20 times gain could be achieved on the bandwidth. However, ICAO [9776] was anticipating one frequency for the CSC and one frequency for the data. More efficient use of VHF channels was indeed needed. For FANS, the HFDL ground stations (HGS) operate on 2-3 channels [FANS_ISPACG]. ARINC indicates that a single channel is still sufficient in the USA (Figure 47). But, with Classic ACARS (plain old ACARS), the distribution of ACARS traffic was relatively simple. Protocols moved aircraft from the DSP base frequency to a group of alternate frequencies. The Data Link Service Provider s (DSP) monitored traffic levels on the ACARS base and alternate frequencies or channels. If the traffic on a particular channel became congested, the DSP sent an uplink autotune command to the aircraft, and the Communications Management Unit (CMU) commanded the VHF radio to switch to the assigned ACARS frequency. The aircraft CMU then set up a connection on the new channel. If communication could not be established or was lost, the ACARS CMU always returned to the DSP known base frequency and re-established the connection 72. VDL2 is known to have limitations related to the CSMA channel access protocol (see Figure 48). Channel congestion adds another limitation. Thus, a minimum of 2 channels as anticipated by ICAO [9776] was a must for ATN in order to mitigate the risk of message transfer time. Comparison with the situation in the USA also indicates that optimisation of the VGS ground stations is required. FANS protocol (like AOA or UDP) is less sensitive as far as delays trigger operational timers but do not necessarily create disconnections. Loss of communications is declared after 16 consecutive minutes of NO COMM (absence of data connectivity). In these conditions, based on the previous systems and on the fundamental assumption from ICAO [9776] it is not understood why the VDL2 for ATN could be deployed on a single frequency! Figure 41: Reference to ICAO [9776] 72 ARINC, The Global Link, May 2011, #42 Page 105 of 193

106 Figure 42: Role of CSC in [9776] Figure 43: Single channel for CSC and CPDLC Page 106 of 193

107 Figure 44: Single frequency [CAFT_1998] in 1998 Figure 45: need for VDL transition for ACARS [CAFT_1998] Page 107 of 193

108 Figure 46: capacity increase for ACARS on VDL2 [CAFT_1998] Figure 47: excerpt from ARINC, The Global Link, November 2011, #43 Page 108 of 193

109 Figure 48: Seamless Sky, H.V.Sudarshan 2003, ISBN Figure 49: excerpt from the technology assessment report from [DL_roadmap] Page 109 of 193

110 [EV_08_01] Theory of networks in ATN/AOA context Note: in what follows AOC will be used to designate the combination of AAC, AOC and APC. There are many studies and lectures regarding the competition between TCP (ATN B1) and UDP (AOC) for the bandwidth. Some techniques can be used to manage congestion but they are not obvious to work effectively with a mixed TCP/UDP flow. No congestion management is currently implemented. [CISCO_MPLS] best practice recommends not mixing TCP-based traffic with UDP-based traffic within a single service-provider class. Telecommunication suppliers use MPLS to connect ATN A/G and G/G routers with the VGS for the ARINC infrastructure. Therefore, the principles from [CISCO_MPLS] can be interpolated to the ARINC infrastructure. However, ARINC reports an average maximum utilisation in the order of 20% of the bandwidth. Therefore, this should be sufficient to handle mixed ATN/AOA on the ACSP infrastructures. This is reflected by the fact that 2 A/G ARINC routers can handle all the data communications. Nevertheless, an expansion in the number of VGS would actually also increase the RF utilisation observed by each aircraft. According to [EV_03_02], the range observed from an airplane rises with altitude and is typically 200 NM at an altitude of feet (~ FL300). This typical range is consistent with [FANS_ATSRO] 73. With a reported utilisation of 20% of ACSP infrastructure and with 10 VGS in view (line of sight), an aeroplane would have a theoretical RF utilisation probability of approximately 90 %, assuming that the stations are uncorrelated. Simplified analysis for RF occupancy on aircraft The simplified formula would compute as: ( ) = 90 %. This probability would assume uncorrelated events. The probability of getting no signal from the signals of 10 stations would follow from: P(no signal) = ( ) with p=0.2 and k=0.2 Thus, the probability of receiving a signal: 1 ( ). This model based on probabilities does not take into account the signal from surrounding aeroplanes as well as potential interferences between VGS Page 110 of 193

111 When using this simplified formula with different values for the number of stations and for the utilisation of the ACSP infrastructure, very different levels of occupancy on aeroplane are obtained. Percentage of occupancy Number of stations % % % % % % % % % % % % % % % Observed occupancy on aeroplane RF observed occupation on aeroplanes and respective impact on ATN/AOC services In networks, the outgoing limit should typically be set at about 85 % of the minimum bandwidth EVER observed on the line for TCP traffic (e.g., to use http). UDP (AOC needs) could still work at 100 % with some delays but the quality of service would be seriously degraded for TCP (ATN needs). Delays for UDP would result in delays for FANS messages thus possibly in some disconnections created by the operational timers. Consequently, theoretically, the current locations of VGS and number of aeroplanes connections in the European airspace could already create congestion situations for the aeroplanes with more impact for ATN services than for FANS services or AOC services. ARINC clearly and adequately reported the issue of Quality of Service on a shared channel. For all these reasons, simulations using realistic scenarios for aircraft traffic and current VGS ground network should be carried out. Page 111 of 193

112 Figure 50: excerpt from [CISCO_MPLS] Figure 51: Reply to Q1 from ARINC in [EV_03_01] Page 112 of 193

113 Figure 52: Figure 1 referenced in Reply to Q1 from ARINC in [EV_03_01] Page 113 of 193

114 Figure 53: Reply to Q15 from ARINC in [EV_03_02] Figure 54: Excerpt from [DLISG] Cf. summary of CRO Hot Topics Session March 28, 2012 agenda item 8 Page 114 of 193

115 [EV_08_02] Channel sharing between ATN and AOC [Grappel] VDL2 is currently operating on a single channel 75 which is used for CPDLC and VDL2 CSC (Common Signalling Channel). All VDL2 ground stations broadcast a special message called the Ground Station Information Frame (GSIF) every 90 seconds on the CSC. The GSIF contains the operating parameters of the ground station, including its operating frequencies, nearest airport, ATN network addresses supported, timer values, etc. Aircraft listen to the GSIF broadcasts in order to determine how to make a connection to the VDL2 ground station. The GSIF provides a ground-based, distributed system database that can be updated (ex. to deal with new, failed, or moved VDL-2 ground-stations) without requiring any avionics changes. The VDL2 has a bit rate of 31.5 kbps (0.031 megabits per second or kilobytes per second). VDL2 has a bit rate of a modem. The VDL2 media access control (MAC) is based on Carrier Sense Multiple Access (CSMA) Protocol. Access is not organised: any user can transmit at any time. There is no prioritisation 76. ACARS over AVLC or AOA has been developed by ARINC as a means to operate ACARS applications over the VDL2 sub network in a way that is totally transparent to the ATN applications that will eventually be supported over VDL2. AOA re-uses only the layer 2 of VDL2. ATN and AOA share the same physical, MAC and Data link lower layers protocols. New VDL2 radios provide higher bit rates than the analogue VHF on which the Plain Old ACARS (POA) was based. VDL channel capacity is 20 times higher than for VHF ACARS. This means that AOA (used for AOC) and ATN (used for ATC communications) share a single VDL channel capacity which has been multiplied by 20 compared to POA (used for AOC). ACARS uses for AOA a centralised topology where all aircraft downlinks received by ACARS ground stations anywhere in the network are relayed to a central processor (one for ARINC and one for SITA). The central processor eliminates any duplicate downlinks received and relays its uplink response to the ground station having the best signal quality with the given aircraft. VDL2 is based on a distributed network topology with multiple routers selecting the best message path (unlike the centralised ACARS topology). The VDL2 system utilises a sophisticated method of link establishment and handover to control the selection of a ground station to communicate with a given aircraft (while ACARS is a broadcast system). The basis of the AOA protocol is message encapsulation. The ATN message is first enclosed in a Connectionless Network Protocol (CLNP) datagram. Then, the CLNP datagram is then included in an IS packet. The IS packet is further embedded into an AVLC frame. The ACARS message is encapsulated in an AOA packet which is then further included in an AVLC frame. The AOA protocol differentiates the contents of AVLC frames containing AOA packets from AVLC frames containing IS (ATN) packets MHz 76 Training Data Link Implementation in Europe, Eurocontrol Institute of Air Navigation Services Page 115 of 193

116 The maximum VDL2 burst length is bits and applies only to the ground system that can uplink frames to more than one aircraft in one transmission 77. A VDL2 transmission burst may contain one or more frames. The default maximum length for a VDL2 frame is bits. The maximum frame size available in the VDL2 system is bits. The AOA protocol entails a 2-byte additional overhead to provide transparent interoperability of ATN and ACARS over the AVLC interface of VDL2. A minimum number of 3 frequencies was deemed necessary to deploy ATN over VDL2. Figure 55: minimum number of frequencies [GR_ACSP] 77 ICAO [9776] Section 2.3 Page 116 of 193

117 Figure 56: encapsulation mechanism [Grappel] Page 117 of 193

118 [EV_08_03] Role of CSC (common signalling channel) The role of the CSC is essentially to annunciate VDL availability in a single frequency which does not have to be searched by the aircraft. It can be compared to the base frequency in the plain old ACARS. Figure 57: VDL availability in ICAO [9776] Page 118 of 193

119 Figure 58: Use of CSC for connection [9776] Figure 59: CSC for LME frequency acquisition in ICAO [9776] Page 119 of 193

120 Figure 60: Advertisement of services in ICAO [9776] Figure 61: ICAO proposed frequency plan for VDL Mode 2 (frequency management group, FMG/5, WP/6 Page 120 of 193

121 Appendix I: Additional clarifications Item Question/Clarification EASA Answer Background clarifications 1 According to section EUROCONTROL document: " Generic Requirements for a LINK Air/Ground Communications Service Provider (ACSP)", "The ACSP shall support VDL Mode 2 operation on the number of frequencies necessary to ensure that the Service Level Requirements specified by Section 2.5 are maintained, subject to the allocation of VHF frequencies to VDL Mode 2 by the appropriate regulatory authorities. Note: EUROCONTROL simulations indicate that at least three frequencies will be required to support VDL Mode 2 operation following the LINK Mandate. QUESTION: whose responsibility is it to decide "the number of number of frequencies necessary to ensure that the Service Level Requirements specified by Section 2.5 are maintained? The ACSP or the ATS? The referenced EUROCONTROL document is not binding. It could become contractually binding with a Service Level Agreement between the ACSP and the ANSPs. (EC) 29/2009 (19) introduces the possibility for ATS providers to rely upon other organisations for the provision of air-ground data link communication services. (EC) 29/2009 (20) also puts a requirement for aircraft and ATS units with data link capability to be able to establish data link communications irrespective of the arrangements made by operators and ATS providers. The ATSP remains ultimately responsible for the ATS service based on the ACSP service. Technically, only the ACSP knows the number of subscribers for AOC (airlines data communications) and AOC data volume. The ACSP delivers the AOC and ATN services using the same infrastructure. The ATSP knows the traffic in its area of responsibility and can estimate the needs for ATN data traffic. However, the ATSP does not know which aircraft subscribes to which ACSP and the AOC traffic level. Hence, the ATSP needs ACSP information to determine the number of frequencies necessary to ensure that the Service Level Requirements specified by Section 2.5 are maintained. The responsibility of the ATS on this aspect has been transferred contractually to the ACSP through the introduction of the EUROCONTROL document as part of the respective contractual baselines. Page 121 of 193

122 Item Question/Clarification EASA Answer ENAV is the ACSP service provider for the transport of both AOC and ATN data. The other extreme is the complete subcontracting of the transport of ATN data to the ACSP. These business combinations have impacts on the way the ATSP has to oversee the ACSP. EASA proposes to assess pros/cons/constraints in action 5 of the EASA report. EUROCAE ED120 for ATN B1 did not allocate the requirements among ATSP and ACSP (e.g., see in ED120 and [EV_05_01] in EASA report). This weakness has been corrected in EUROCAE ED228 for ATN B2 (e.g., E ). This is linked to action 7 in section 6.1 of the EASA report. Additionally, there is a need for European coordination for the management of frequencies and mitigation of interferences. This corresponds to action 1 in section 6.1 of the EASA report. 2 According to section of EUROCONTROL document: "Generic Requirements for a LINK Air/Ground Communications Service Provider (ACSP)": "The ACSP shall implement the Autotune procedure specified in ARINC 631 [5] to maintain the Service Level Requirements of Section 2.5 for communication with airborne aircraft, whenever this cannot be achieved on a single frequency. When so required, the ACSP shall be capable of sending an Autotune command in an uplinked Ground Requested Air Initiated Handoff command, as well as in the uplink response to both a Link Establishment request or Air Initiated Handoff request." The autotune function is specified in ICAO manual, ARINC 631-5/6 and EUROCAE ED-92B documents for the avionics. This function should be available in all avionics. However, the proper functioning of this feature has only been tested in some flight tests. Such tests were conducted with 3 DFS/SITA VGS (2 frequencies). The problems which were identified during these tests would impact multi frequency operations and shall be rectified in the avionics. Multi frequency cannot be deployed on a large scale without a progressive validation in a representative ground environment. ARINC indicated in December 2013 that its infrastructure was designed to operate multi frequency by autotune. SITA recalled that it had a prototype that could make use of autotune function. Some ATS providers are anticipating multi frequency: such as. ENAV in 2015 timeframe or also Riga FIR as included in this specification for the Page 122 of 193

123 Item Question/Clarification EASA Answer QUESTION: is the Autotune command present in all avionics? Has this been validated? provision of (EC) 29/2009: -Spec_ docx Section 6.1 of the EASA report contains the related action 6. 3 Note: Article 5.6 of Regulation No 29/2009 imposes that: "6. ATS providers shall monitor the quality of service of communication services and verify their conformance with the level of performance required for the operational environment under their responsibility". The Eurocontrol specification for data link V2.1 indicates that the QoS management and QoS monitoring that are needed to ensure that performance requirements are met are outside the scope of the EUROCONTROL Specification. QUESTION: How is this performance monitoring done by the ANSPs? How is this monitoring information managed? Did the NSAs verify that? The ANSPs are monitoring the quality of service through the following activities: Monitoring of the reported loss of communications, including Provider Aborts and User Aborts. Review of the ACSP monthly report, prepared according to the Generic ACSP requirements guidelines. The records of these activities are the databases of logged events, including their analysis, and the review of the monthly reports from the ACSPs. EASA does not have evidence about how the compliance with respect to this Article is being verified by the NSAs. 4 According to section 2.5 of Eurocontrol document: "Generic The definition is documented in the ICAO GOLD document (not part of (EC) Page 123 of 193

124 Item Question/Clarification EASA Answer Requirements for a LINK Air/Ground Communications Service Provider (ACSP)", the following Service Level requirements are defined: availability of service is 99.99%; reliability is 99.99%; continuity of service: max 6 min of outage. QUESTION: On this basis, what is the exact definition of "provider abort"? How does it link to the performance requirements? Section 3.5 of EASA report Where does the definition of Provider Abort come from? What is the source of this definition? 29/2009) in appendix D. The number of provider aborts is an indicator of the actual availability of use of the data link service. The continuity of service is linked to the actual availability of use. Disconnection for more than 6 minutes indicates a provider abort: it is a loss of continuity The transaction has started and is interrupted.. It is noted that other errors like the user abort are also contributing to the loss of continuity. User aborts are also recorded and analysed by the ATSPs. This definition of continuity differs from the conventional engineering definition in that it refers to a group of transactions in a single flight hour rather than a whole system. But, it has an operational meaning. It expresses the probability that a transaction will be completed successfully within ET (Elapsed Time) seconds, per Flight Hour. Operationally, it quantifies the chance to be able to end the data link transaction within the expected timeframe (without user abort, provider abort or excessive delay). For (EC) 29/2009, the only legally applicable reference is EUROCAE ED-120 including Change 1 and Change 2 (item 11 in Annex II of (EC) 29/2009). Page 124 of 193

125 Item Question/Clarification EASA Answer In this standard, the performance requirements are established according to a template and acronyms defined in section , and Table 1-9 of ED-120. There is no separate allocation for the ACSP, but only a global allocation to the ATS provider. The performance requirements for ATC Communication Management (ACM) are specified in EUROCAE ED-120 Table The performance requirements for ATC Clearance (ACL) are specified in EUROCAE ED-120 Table 5-31 for flight crew initiated transactions and Table 5-32 for controller initiated transactions. The provider aborts correspond to the requirement for continuity of service en route (only en route is within the scope of (EC) 29/2009). In these tables, continuity (C) has a probability requirement of 0.99 per flight hour for ACM and ACL (supporting CPDLC). For ATN B2, in addition to the ICAO GOLD document, this is now included in EUROCAE ED-228 which states: The most obvious indication of a loss of availability for an individual aircraft is a Provider Abort. This occurs when there is no air-ground connectivity during a certain period (e.g. 6 minutes) after which the data communication system is considered to be unavailable. However it is difficult to determine precisely at what time the data communication system has become available again. It is possible that the pilot or controller may choose not to re-establish the connection even though it would be technically possible and thus the system should be considered as available. Rather than calculating the actual probability of the aircraft system being available when needed, the number of Provider Aborts may Page 125 of 193

126 Item Question/Clarification EASA Answer Mathematical approximation of P t 1-(1-P fh )/n: be measured. In ED-120 (appendix E), 6 minutes is the requirement for the unplanned service outage duration for ATSU and CSP. This value of 6 minutes also determines the requirement for the maximum number of service unplanned outages per year for ATSU and CSP (87). This value like the aircraft flight duration per sector and other ones relate to observations in the European airspace. The Link DLS CRO Performance Monitoring Requirements has proposed a method to measure disconnections instead of estimating probabilities of availability (use) and availability (provision). A simulation of the Eurocontrol method compared to ED228 appendix D is provided below. The overall availability target in the ED228 simulation is converted into transaction from flight hour. Assuming n independent transactions per flight hour, if P t is the probability per transaction, P fh is the probability per flight hour: P t 1-(1-P fh )/n. For 10 transactions per flight hour, the target for the probability per transaction should be 10 times more stringent than the probability per flight hour. The target can be converted into: per transaction. for n independent transactions where is the probability per flight hour and is the probability per transaction thus ( ( )) ( ) Using series expansion : ( ) ( ) ( )( ) for Y very small ( ( )) ( ); thus, (1 Pt) ( ). This leads to Pt ( ) Page 126 of 193

127 Eurocontrol method (specified in Link DLS CRO Performance Monitoring Requirements, reference CFC/Datalink/PMR, edition 1.2): Number of PA per 100 hours loss availability availability of provision Page 127 of 193

128 ED228 Appendix D: Total planned flights Average time (min) in sector Total planned flights hours Outage (min) Aircraft impacted by outage Total outage (flight hours) Outage per 100 hours Overall Availability Page 128 of 193

129 Total planned flights Average time (min) in sector Total planned flights hours Outage (min) Aircraft impacted by outage Total outage (flight hours) Outage per 100 hours Overall Availability Page 129 of 193

130 Item Question/Clarification EASA Answer Specific clarifications on the EASA Report 1 Section 3.2 of the EASA report states: "specific review activity on the applicable standards has been performed ". Which standards have been reviewed? Reference The parts of the standards and guidance material reviewed for this analysis are listed in Appendix B. These documents are listed below. Some other documents like [ACCESS] or [DL_roadmap] are not standards but these studies provide valuable analysis that existed prior to the DLS regulation. EASA has also considered the ATN B2 standards when there were providing additional explanations on existing ATN B1 requirements. Document [ ] COMMISSION REGULATION (EC) No 29/2009 of 16 January 2009 laying down requirements on data link services for the single European sky [9705] ICAO Doc AN/956 Manual of Technical Provisions for the Aeronautical Telecommunications Network (ATN) Second Edition, December 1999, including identified PDRs [9776] Manual on VHF Digital Link (VDL) Mode 2, Doc 9776 AN/970, First edition [Annex 10] [ED-110B] [ED-120] VHF air ground digital link (VDL) of ICAO Annex 10 Aeronautical Telecommunications Volume III, Part I (Digital Data Communication Systems) (First edition July 1995 incorporating Amendment 81 ( )). Interoperability requirements standard for aeronautical telecommunications network baseline 1 (ATN B1 Interop Standard), Eurocae, December 2007 Safety and Performance Requirements standard for Air Traffic Data Link services in continental airspace, ED-120 including changes 1 and 2, Eurocae, published in May 2004, including Change 1, published in April 2007, and Change 2, published in October 2007 Page 130 of 193

131 Item Question/Clarification EASA Answer [ETSI] Data Link Services (DLS) System; Community Specification for application under the Single European Sky Interoperability Regulation EC 552/2004; Requirements for ground constituents and system testing, ETSI EN V1.1.1 ( ) [GOLD] Global Operational Data Link Document (GOLD), ICAO, Second Edition 26 April 2013 [GR_ACSP] Generic Requirements for an ATN/VDL Mode 2 Air/Ground Communications Service Provider, Eurocontrol, edition [IOP_ANSP] CM/CPDLC Generic Interop Test Plan for Air Navigation Service Providers, Version 1.6 [IOP_AVIONICS] Generic Interop Test Plan for Avionics - Part 1, Upper Layers and CM/CPDLC applications, Version 2.3 [LINK_AGI] Link Guidance to Airborne Implementers, issue 2.000, dated 18 November 2013 [LINK_GGI] Link Guidance to Ground Implementers, issue 2.000, dated 18 November 2013 [LINK_SPEC] EUROCONTROL SPECIFICATION on Data Link Services, EUROCONTROL-SPEC-0116, Edition 2.1 [OLDI_corr] Corrigendum to EUROCONTROL Specification For On-Line Data Interchange (OLDI), EUROCONTROL- SPEC-0106, Edition Section 3.6 of EASA report: " these implementation errors would not have been detected during testing activities." Why wouldn t implementation errors be detected during the testing activity? For complex systems (as the case of software-based avionics equipment), the testing activities cannot ensure that there is no implementation errors (normally, discovered during operation). Testing activities ensure that the requirements are met under some conditions but it does not imply that there could not be implementation errors. This rationale was used as justification to include the testing/verification methods (and organisations) as one of the investigation areas. Page 131 of 193

132 Item Question/Clarification EASA Answer 3 Section of EASA report What is the link between the expected "availability of 99.99% and the maximum number of authorised PA of 1 per 100 hours? Please refer to reply 4 to Background elements/questions above. The intent in the EASA report was only to determine the order of magnitude. This approximation of probabilities is fit for purpose for an operational indicator. This approximation was derived from ED228 for ATN B2. The Eurocontrol approach provides similar results. The important thing to remember is that this value can change with the airspace and with operations. Therefore, it is recommended to specify such values in guidance material together with the assumptions. Page 132 of 193

133 Item Question/Clarification EASA Answer 4 Section of EASA report What is the definition of the "radio deafness problem"? What is the effect of this problem? The phenomenon known as VDR Deafness refers to a condition in which a VDL Mode 2 VHF Data Radio (VDR) persistently ceases to decode uplink transmissions, while the downlink continues to function normally. Initially, uplink and/or downlink re-tries arise, then the link is lost, and the aircraft attempts to perform a handover to other VGSs in succession. In 2007, this seemed to be the predominant cause of provider aborts for Rockwell Collins VDR. This VDR Deafness situation continues to exist until the VDR mode changes (e.g. due to a fall-back to Plain Old ACARS), and when the VDR subsequently returns to VDL Mode 2 it then operates normally. Therefore, there is most probably vulnerability in the software of a unit with such an issue since the unit cannot properly recover without transitioning to another mode. The cause leading the VDR to enter into this mode is in most cases an unexpected value of the burst length in the physical layer header. When this situation is encountered, this generates a serious malfunction in the software. The ground VDR is responsible for setting the Transmission Length in the physical burst header. But, erroneous values of the Transmission Length field could also arise as a result of corruption of the VDL Mode 2 burst on the Radio Frequency (RF) channel. Whenever uplink transmissions from VGSs overlap, some corruption may occur: this is an inevitable and expected occurrence in VDL Mode 2. The current ground infrastructure on a single frequency and without optimisation of the VGS locations clearly increases the probability of creating these corruptions. On the other hand, the VDRs not embedding the enhancement are vulnerable to the condition. Page 133 of 193

134 Item Question/Clarification EASA Answer 5 Section of EASA report Where does this statement come from? "Connection-oriented with positive feedback protocol of ATN is pointed as a factor increasing the probability of disconnections" This is summarised in and further detailed in [EV_08_01] in Appendix H in the EASA report. In this analysis, it is based on simplified theory for RF interference and networks. EASA recommends performing simulations using realistic scenarios. This corresponds to action 1 in the EASA report. The ACSPs have highlighted the divergent needs for AOA and ATN. This is reported in section of the EASA report. Page 134 of 193

135 Item Question/Clarification EASA Answer 6 Section of EASA report: "some of the selected operating modes have not been translated into requirements" Question: What does that mean? What is the impact of this statement? The evidence is the reference [EV_02_06] in Appendix H of the EASA report. See also section of EASA report. Both ARINC and SITA require additional tests for the avionics. Such tests are not documented in technical standards publically available. ARINC Avionics Qualification Policy is available on the Internet. viation/arinc%20globalink%20avionics%20qualification%20policy.pdf Moreover, some requirements have been re-interpreted without being documented. For example, this was done to accommodate wrong interpretation of a standard such as for example for ISO SITA had found that some avionic suppliers had been confused by an address field in the past, and so began to leave that field blank, or null. However, ISO 8208 provides for that field to be populated. Therefore, an unit programmed to strictly comply with ISO 8208 would send a clearing" response to SITA's null field. The avionics supplier added robustness by making the unit ignore the null field. SITA also implemented a fix on their end. The impact is technical. Deviations to standards should be coordinated and documented. The deployment package shall document any deviations or additions to the standards that were necessary for deployment. Page 135 of 193

136 Item Question/Clarification EASA Answer 7 Section of EASA report: "in order to improve the QoS, DLH has decided to deactivate VDL2 on aircraft not equipped with CPDLC: this has reduced the number of technical problems." Question: does that mean that VDL2 has problems even without CPDLC? When used only with AOC? 8 Section of EASA report: Question: why was DFS not contacted? Why only MUAC, Skyguide and NATS? Yes, some VDL2 installations have problems for AOC without CPDLC. In addition to the reply from DLH, this has also been confirmed orally by some pilots: they also loose the ACARS. DFS was contacted by EASA but no reply was received. In December 2013, EASA contacted by letter Skyguide and MUAC. During the first phases of the investigations, it was considered adequate to contact more ANSPs and DFS and NATS were contacted in January 2014 through dedicated s to the focal points in the DLISG. NATS responded positively to this request of support whereas no answer has been received by DFS (reminder was sent in February 2014). Additionally, ENAV was also contacted in January 2014 with positive answer and contribution. Page 136 of 193

137 Item Question/Clarification EASA Answer 9 Section of EASA report: How is it substantiated that the A/G Router for SITA is in Montreal? 10 Section of EASA report: " there are VGSs which are emitting signals and which are not connected to any of the two ACSPs" Question: what does this mean? What is the impact? This information was provided by Skyguide and confirmed in SITA available information. However, this remote location was not identified as a driver for the Provider Aborts as the operational SITA network has been used during the interoperability tests and no Provider Abort has been recorded during such tests. Nevertheless, this may have an influence on the transmission delays. For ARINC, the A/G routers are located in London and Amsterdam. We have been informed that there are some ANSPs that have purchased A/G routers to SITA (e.g., DFS, Skyguide, AENA, DSNA). This may imply some future plans about the establishment of local networks at their Areas Of Responsibility. This aims to refer to cases like ENAV in which the VGSs are connected through their own proprietary network and their own air/ground routers. The 2 ACSPs are only connected to ENAV network via a firewall. In this case, the data traffic to/from aircraft is always transported by ENAV (including for the AOC traffic). The impact is that there are much more configurations than one SITA network and one ARINC network in Europe. One impact is the diversity of configurations in the ground infrastructure that makes it difficult to isolate causes of issues observed on the aircraft. It is not possible to assume only a single model: it is necessary to consider all the specific elements of the ground infrastructure at the location where the issue occurs. This would also be the case if the SITA and ARINC networks would also embed different VGSs types and/or software versions. Page 137 of 193

138 Item Question/Clarification EASA Answer 11 Section of EASA report Clarification for the statement: "The shared usage of the single MHz both as CSC and as CPDLC should have been limited to initial deployment". Clarification for the statement: "The requirements from the technical standards supporting the implementing rule should have been further specified and allocated to the stakeholders (in particular to the ACSP) in a coordinated deployment plan for the European airspace Question: what is to be understood as "the deployment plan"? For single channel, please refer to reply 4 to General comments/questions on the way forward below. An implementing rule should only set the objectives including the performance objectives. The performance objectives are weak in 29/2009. At that time, the technical standards were also weak for the performance requirements (see reply 1 to Background elements/questions ). The technical requirements should have been defined in a deployment plan. This would have enabled a progressive and managed deployment in several phases. Evidence for the technical provisions is detailed in [EV_05_01]. Evidence for the clear identification of risks arising from the pioneer phase is detailed in [EV_05_02]. For example, the rise of AOC data traffic could have been foreseen and even estimated. The importance of the timers was already highlighted in the trials. It should have been converted into requirements and/or methods suited for the European airspace deployment. The management of risks arising from the infrastructure and creating common cause safety issue (inadequate performance of the infrastructure) is detailed in [EV_05_03]. The method and criteria to optimise the European implementation were not specified [EV_05_04] (TP4 timers). See also reply to question 8 on Specific comments/questions on the Report for undocumented requirements. Some flexibility was needed in order to accommodate the changes in data traffic. Therefore, this flexibility should preferably form part of a deployment programme and implementation plan for the deployment Page 138 of 193

139 Item Question/Clarification EASA Answer project. The deployment did not occur properly after the pioneer phase. The standards envisage different options in order to accommodate different needs. This is normal. The deployment should have defined a deployment plan for Europe which would have specified the objectives and the means selected together with some options if applicable. The deployment plan should have specified requirements tailored to the data volumes. In this way, it would have been possible to upgrade the implementation according to the needs. 12 Section of EASA report: "the locations of VGS stations create interferences for aircraft flying at or above FL285" Question: Why are such interferences happening? 13 Section of EASA report Where in Regulation No 29/2009 can it be derived that This is the result of two combined effects. On one side, the driver for the locations of the VGSs has not been the ATN needs over FL285 but the AOC needs. As result of that, there are much more VGSs deployed than necessary for the ATN, leading to the situation in which one aircraft flying above FL285 can see more VGSs than initially expected. On the other side, the use of a single frequency (CSC) and no dedicated frequency for data makes the VGSs interfere with each other and prevent the transmission/reception to/from the aircraft when the channel (understood as the data channel) is occupied. A different situation could occur in case that the VGSs are configured to work in different frequencies for data transmission (keeping the CSC for synchronisation). In this scenario, the above interference would be significantly reduced as far as they would be effectively using another VHF frequency. The need of a protection mechanism is requested in Regulation No 29/2009 Annex IV, Part A, point 3, where it is stated: 3. End-to-end data communications shall support a common Page 139 of 193

140 Item Question/Clarification EASA Answer "PM-CPDLC is required"? standardised end-to-end protection mechanism to ensure the integrity of messages received consistent with safety requirements of the data link services defined in Annex II. Regarding the technical means of compliance, the ETSI specification contains ED-110B as a normative reference (necessary for the application of the present document). For aircraft certification, EASA has introduced multi frequency and ED110B (protected mode) in a special condition. This is available on EASA Web site: Page 140 of 193

141 Item Question/Clarification EASA Answer In ICAO documents, the ICAO Doc Part 1 contains air-ground applications including CM and (PM) CPDLC, and the algorithm for AMIC (Application Message Integrity Check) computation in Chapter 6. The EUROCAE ED-120 document references ICAO document 9705 ed.2. ICAO Document 9705 ed.3 is being replaced by ICAO Doc. 9880, which is in unedited advance version as approved, in principle, by the Secretary General state at the time of writing. ICAO Document 9705 ed.3 is not equivalent to ICAO Doc 9705 ed. 2 plus PDR because it contains extra features. Page 141 of 193

142 Item Question/Clarification EASA Answer 14 Section of EASA report On the reference to the creation and role of the ICB, what is the intent? Section of EASA report Clarifications on the implications related to the ICB technical advice. 15 Section 4.2 of EASA report What does this mean "can only use 85% of available bandwidth"? What is the impact? These are the facts. The [DL_roadmap] had identified the risks. The EC had asked the advice from the ICB. Either the risks were overlooked on the basis that the study was pessimistic (this is indicated in some comments to the study) or the risks were not properly communicated to the European Commission. On this technical file, the ICB did not provide the adequate advice to the European Commission. The European Commission is advised to consider that the ICB has the technical knowledge but could also be influenced by other factors. It is recommended to always consider and manage the related risks when deploying a complex implementation. Things rarely completely proceed as planned; there are always at the minimum adjustments and critical decisions taken for any complex implementation. This means that the channel bandwidth cannot be used completely. For a TCP protocol, 85% is the value commonly referenced. TCP protocol and ATN are close for network properties. Actually, the load on the channel should even not exceed 40% (see Section Table 4) for ATN in order to guarantee the maximum time delay for the delivery of ATN messages (values related to ATS operations). This means that the effective bandwidth, or simply data transfer capacity, is reduced. Only unreliable protocols like video streaming can virtually use 100% of the bandwidth. Page 142 of 193

143 Item Question/Clarification EASA Answer 16 What is the reference in ICAO GOLD of the process for error reporting and resolution? The diagram in section 4.1 is directly extracted from the ICAO GOLD. The reference for the diagram is the ICAO GOLD reference: figure D-20. This is in section D in Appendix D Post-implementation monitoring and corrective action of the ICAO GOLD document. 17 Clarification for the statement about "congestion effect" and the fact that using a single channel was not envisaged by the standard architecture of VDL2 as defined in ICAO See also reply 4 to General comments/questions on the way forward below. Page 143 of 193

144 Item Question/Clarification EASA Answer 18 Section 4.3 of EASA report Clarification regarding the fact that the Thales equipment for ground could be a possible source of provider aborts. 19 Section 4.4 of EASA report Clarification for: " This is an indication of some coordination lacks during the data link implementation process " The intended message is that we cannot discard the possible contribution of this equipment to the Provider Abort, coming from the TP4 layer. By checking with the testing organisations, they confirmed that the tests performed by the ANSPs were more at CM-CPDLC interoperability layer (functional verification) and the TP4 layer was not tested with their involvement. The situation is different from most of the avionics manufacturers where the already identified TP4 level tests were successfully performed. Then, this lack of testing at this level may imply that there are some undetected errors in the Thales equipment that, under some circumstances, may affect the communication with the aircraft (via the air/ground network). This possibility, although remote, could not be discarded and this was the reason to keep it as potential driver, although with low probability. Coordination lacks refers to the implementation governance. Different ANSPs were taking different implementation approaches, with different levels of relationships with the ACSPs and, in some cases, playing the role of the ACSP. This diversity may be a clear contributor to interoperability problems as far as it could lead to several implementations of data link services by different ANSPs. As an example, the VGS network, identified as one of the contributors to the Provider Abort, is the consequence of this identified lack: in the exercise of their legal responsibility for their Area Of Responsibility, each of the ANSPs agreed their own VGS network with the ACSPs to cover the full territory without apparently considering the VGSs existing in the neighbouring countries (under other ANSP). Page 144 of 193

145 Item Question/Clarification EASA Answer 20 Section 5 of EASA report. Clarification of the statement: "..it would be seen advisable to reconsider the applicability timeframes of the DLS regulation in the sense whether they should be aligned with the proposed action plan as outlined in section 6. Question: would only a change of dates (differing/postponing/etc ) be sufficient? 21 Recommendation for large scale deployment to be performed by the "deployment manager". What is the legal basis for that? 22 Section 6 of EASA report The action plan lacks owner (WHO) and deadline (BY WHEN). For each action, this should be added. 23 Section 6.1 of EASA report Clarification of statement with concrete example: "..some of the actions can also be applied to the current deployment in order to get the confirmation with respect to the issues identified" EASA would not recommend to stop the deployment process but only to differ/postpone it, to ensure that the continuous equipage of production aircraft (forward fit). If not, it would imply the need for a significant retrofit once the DLS regulation is reintroduced, making more difficult and costly their implementation. As additional information, the equipment currently used for the ATN communication are also used for the AOC traffic. Then, there is no major burden on airlines to continue with the equipage of new produced aircraft to use the data link services as this is also used for the AOC traffic. There is no legal basis. However, technically, there is a need to ensure that the infrastructure deployed for (EC) 29/2009 can evolve to support AF6. The entity responsible for AF6 should also be responsible for the redeployment of (EC) 29/2009. See reply 27 to Specific comments/questions on the Report below. The idea of this action plan is to have it refined and validated within the scope of SESAR (see section 6.1 in EASA report). The consortium selected by the call for proposal would specify the details. Example: a simulation on the given infrastructure on the level of interference can be compared to actual measurements on the aircraft. This can support the enhancement of the representativeness of the simulations which are necessary for extrapolation. Important assumptions such as the current peak data traffic should also be determined and observed on the current infrastructure. Page 145 of 193

146 Item Question/Clarification EASA Answer 24 Action 2 of EASA report Question: shouldn t the existing SESAR AFD project be reused for this action? 25 Action 6 of EASA report Question: should a retrofit of the airborne avionic be envisaged? Would it be required? 26 Action 6 of EASA report Question: Why couldn t/wouldn t EASA start immediately the audit of the airborne parts and appliances? Why also not asking the NSA's to review the DoV issued by their ANSPs? Technically, this is a possibility. However, EASA does not know the conditions in the contracts between SJU and the SESAR projects. It is important to note that the ENAV architecture is also particular. It would also be important to complement the ENAV area with other areas. Some retrofit actions are already known such as for example for the Thales EVR750. For other avionics, it is first necessary to deploy the expected ground infrastructure before deciding. For sure, the avionics have been matured and their performance has improved. In any case, the proper ground infrastructure has to be deployed before deciding on the retrofit plan. Such a plan should first target the installations creating issues. There could be more flexibility for avionics bringing benefits but still working adequately with the ground infrastructure. In our opinion, these activities are necessary but priorities should be put in the solution of the infrastructure issue (channel usage, frequencies, VGSs). This may imply changes in the ground and airborne equipment which should be reviewed by the respective competent authorities. Then, to perform this activity immediately would not report any significant benefit as it would be necessary to repeat it once the changes are introduced. Through the action plan, the overseen organisations will be aware of this specific activity and include them in their respective planning. Page 146 of 193

147 Item Question/Clarification EASA Answer 27 Action 10 of EASA report Clarification regarding the "comprehensive deployment package" for ground data link end systems. The comprehensive deployment package would have to specify all the requirements (in addition to the ones in the IR 29/2009), the performance objectives (including their assessment), the order of the deployment steps, the risks and their management, the means to monitor the implementation after deployment, etc. Basically, the comprehensive deployment package should contain a deployment programme and implementation project as defined in (EU) No 409/2013. A deployment programme is necessary since the first step is to establish an acceptable baseline for 29/2009 but it shall consider the subsequent development for PCP AF6. Page 147 of 193

148 Item Question/Clarification EASA Answer 28 Section 6.1 of EASA report Question: is the needed analysis of VGS location a prerequisite for PCP AF6? As indicated in the note in section 2 of the EASA report, the analysis of the needs for PCP AF6 is outside the scope of this investigation. However, without making the detailed analysis, it is obvious that more data volumes will have to be exchanged. PCP AF6 does not contain the complete 4DTRAD function (cf. EUROCAE ED228 section 3.9.1) but instead the EPP (extended projected profile). The detailed requirements in terms of amount of EPP data will depend on the intended usage for the ATS. It is based on ADS contract: therefore, the refresh rate also depends on the usage for the ATS. But, in all cases, this will generate additional data traffic based on an uplink query (small message) and a downlink report containing the data. The current ATN B1 infrastructure is already saturated. EASA highly recommends jointly performing multi frequency deployment with VGS location analysis since the management of the frequencies has to be properly carried out both to limit interferences (technical performance) and to optimise the usage of frequencies (scarce resource). The PCP consultation anticipates AF6 in NEFAB (Estonia, Finland, Latvia and Norway). EASA has not collected data on ATN B1 in this NEFAB area. Page 148 of 193

149 Item Question/Clarification EASA Answer General comments/questions on the way forward 1 What is the envisaged timing of the EASA action plan? How long will it last? 2 Question: Does regulation (EC) 29/2009 mandate a single channel? Or it is the current implementation that is not satisfactory? Current estimations indicate not less than 1-2 year duration. Detailed setup depends on the possibility for SJU to amend ongoing contracts and projects. Nevertheless, EASA can provide some suggestions about the potential dependencies among the actions, to be considered in the implementation plan. The (EC) 29/2009 regulation does not mandate a single channel; this has been an implementation decision. The regulation indirectly refers to ICAO and thus implicitly to ICAO VDL2 manual (see Item 4 below). The links are detailed in section of the EASA report. The current implementation is not satisfactory. The deployment risks were not properly managed. The Eurocontrol FAQ below can be misinterpreted. It should clearly state that multi frequency is the expected standard operating mode. The original deployment on a single frequency would only be usable for a limited period of time when data volumes do not create congestion. Page 149 of 193

150 Item Question/Clarification EASA Answer Page 150 of 193

151 Item Question/Clarification EASA Answer 3 Question: is it possible to proceed with action plan without "removing" or "modifying" the regulation? 4 Question: Are we sure that "multi-frequency" will solve the issues? It has to be further tested. Some actions are necessary. Retrofit and rectification should be postponed until the solution is validated. EASA recommends that the forward fit (newly produced aircraft) is not interrupted to ensure an adequate level of equipage of the fleet when the infrastructure issue is solved. Key aspects for validation are autotune, multifrequency, VGS optimisation and ground-initiated handover (to manage the data traffic load). Yes multi frequency will solve the issues with the ground infrastructure, but it has to be further tested. As mentioned in the EASA report, there are several potential causes for the Provider Aborts. The implementation of multi-frequency would allow mitigating the contribution of the most relevant driving factors identified (e.g., channel occupancy, interferences, etc ). However, these benefits may depend on the way this multi-frequency is implemented and it is recommended to execute activities (including trials) to see the most suitable approach for the European airspace. One of the most relevant aspects is to decide the way in which the frequencies are distributed (e.g., per VGS, per service, per type of operation, etc ). EASA interprets from the ICAO VDL2 manual (9776) below that the standard design for VDL2 anticipated a common signalling channel plus dedicated frequencie(s) for the data. See [EV_06_02] in EASA report. Page 151 of 193

152 Item Question/Clarification EASA Answer Page 152 of 193

153 Item Question/Clarification EASA Answer ICAO had a plan for several channels for VDL2. Before 2010, there should have been already 4 VDL2 frequencies available. See Figure 61 in EASA report. Page 153 of 193

154 Item Question/Clarification EASA Answer 5 Question/comment: would it help to "just" push back the dates and add a requirement that at least 3 or 4 frequencies should be implemented for the ACSP? Would airborne multi-frequency be required for that? Pushing back the dates for the retrofit (article 3 (3)) would help. Postponing the date for the forward fit could make things more complex (installation of hardware, certification). The number of frequencies required could change depending on the area and demand for data. In an implementing rule, it is suggested to introduce multi frequency without stating the number of frequencies. It is necessary for the aircraft installations to also be multi frequency capable in order to use the service. Even if one area can start with a single frequency (e.g. ENAV with 2% of channel usage), it would need multi frequency once data volumes increase. Lessons from current deployment is that the saturation situation was not This is for example included in this specification for the provision of 29/2009 found on the Internet: atalink_tech-spec_ docx Page 154 of 193