DRAFT ED-246 FOR OPEN CONSULTATION

Transcription

1 The European Organisation for Civil Aviation Equipment L Organisation Européenne pour l Equipement de l Aviation Civile Process Specification for Wireless On-board Avionics Networks This document is the exclusive intellectual and commercial property of EUROCAE. It is presently commercialised by EUROCAE. This electronic copy is delivered to your company/organisation for internal use exclusively. In no case it may be re-sold, or hired, lent or exchanged outside your company. ED-246 [Month Year]

2 i FOREWORD 1. This document was prepared by EUROCAE Working Group 96 Wireless Intra- Aircraft Communications and was approved by the Council of EUROCAE on [Day Month Year]. 2. EUROCAE is an international non-profit making organisation in Europe. Membership is open to manufacturers and users of equipment for aeronautics, trade associations, national civil aviation administrations, and, under certain conditions, non-european organisations. Its work programme is principally directed to the preparation of performance specifications and guidance documents for civil aviation equipment, for adoption and use at European and world-wide levels. 3. The findings of EUROCAE are resolved after discussion amongst Members of EUROCAE and in collaboration with RTCA Inc, Washington D.C., and/or the Society of Automotive Engineers (SAE), Warrendale PA, U.S.A., through their appropriate committees. 4. EUROCAE performance specifications and other documents are recommendations only. EUROCAE is not an official body of the European Governments. Its recommendations are valid as statements of official policy only when adopted by a particular government or conference of governments. 5. Copies of this document may be obtained from: EUROCAE 102, rue Etienne Dolet MALAKOFF France Telephone: eurocae@eurocae.net Website:

3 ii TABLE OF CONTENTS FOREWORD... I TABLE OF CONTENTS... II LIST OF FIGURES... VI LIST OF TABLES... VII CHAPTER 1 GENERAL FRAMEWORK SCOPE OF WORK DOCUMENT STRUCTURE RELATION TO THE WORK OF OTHER EUROCAE WORKING GROUPS EUROCAE WG-72 AERONAUTICAL INFORMATION SYSTEMS SECURITY EUROCAE WG-99 PORTABLE ELECTRONIC DEVICES (PED)... 9 CHAPTER 2 WIRELESS ON-BOARD AVIONIC NETWORKS INTRODUCTION DEFINITION OF WOBAN AND TERMINOLOGY TYPICAL WOBAN TOPOLOGIES AND CONFIGURATIONS POINT-TO-POINT WOBAN SYSTEM CENTRALIZED POINT-TO-MULTI-POINT WOBAN SYSTEM MULTI-HOP WOBAN SYSTEM CHAPTER 3 CERTIFICATION GUIDANCE INTRODUCTION DEFINITION OF STAKEHOLDERS AND TASKS TYPICAL DEVELOPMENT SCENARIOS SCENARIO 1: WOBAN COMPONENT DEVELOPMENT SCENARIO 2: APPLICATION DEVELOPMENT SCENARIO 3: NEW WOBAN SYSTEM DEVELOPMENT AND AIRCRAFT INTEGRATION SCENARIO 4: MODIFICATION OF AIRCRAFT FUNCTIONS SCENARIO 5: MODIFICATION OF RF PROPAGATION ENVIRONMENT CERTIFICATION PROCESSES CERTIFICATION REQUIREMENTS COMMON FOR ALL STAKEHOLDERS CERTIFICATION PLANNING General Certification Requirements for Systems System Safety Assessment Electromagnetic Compliance Demonstration EMC Qualification according to ED Intentionally radiated emissions Susceptibility to non-intentional interference Susceptibility to intentional interference Data Security Assessment... 21

4 iii Health Risks Determination Physical Protection Usage of batteries Environmental qualification aspects of certification Software and complex hardware aspects of certification Configuration Management Aircraft Test Plan Aircraft Flight Manual Operational Aspects Aircraft Design Changes following the Initial Approval of a WOBAN system Shared Communication Resources GUIDANCE FOR SAFETY ASSESSMENT Functional Hazard Assessment Safety Assessment for a typical WOBAN system Safety effects and mitigations Item Development Assurance Level determination Diversity of Development Assurance Level in WOBAN systems CONTINUED AIRWORTHINESS PROCESS Performance degradation Guideline for in-service modification of RF propagation environment Guideline for in-service installation of additional wireless networks Instructions for Continued Airworthiness regarding Cyber Security GUIDANCE FOR OPERATORS AWARENESS TRAINING MATERIAL CREW INSTRUCTIONS AND MANUALS MAINTENANCE MANUAL CHAPTER 4 GUIDANCE ON DEVELOPMENT PROCESS REQUIREMENTS INTRODUCTION RADIO REGULATORY REQUIREMENTS WOBAN SYSTEMS OPERATED UNDER THE REGULATORY PROVISIONS FOR WAIC SYSTEMS WOBAN SYSTEMS OPERATED WITHIN NON-AERONAUTICAL FREQUENCY BANDS ON THE BASIS OF NON-INTERFERENCE AND NON-PROTECTION RADIO LICENSE CONSIDERATIONS WIRELESS COMMUNICATION REQUIREMENTS REQUIREMENTS ON APPLICATION LEVEL Data Rate Jitter Latency Communication Outage... 33

5 iv REQUIREMENTS ON NETWORK LEVEL Failure Propagation Network Management Function Network Recovery Spectrum Management REQUIREMENTS ON ENVIRONMENTAL LEVEL Radio Channel Characteristics Coexistence PROTECTION REQUIREMENTS PROTECTION OF THE AIRCRAFT AGAINST WOBAN SYSTEM S ELECTROMAGNETIC EMISSIONS PROTECTION OF HUMANS AGAINST WOBAN SYSTEM S ELECTROMAGNETIC EMISSIONS PROTECTION OF THE WOBAN SYSTEM AGAINST ELECTROMAGNETIC EMISSIONS FROM THE AIRCRAFT PROTECTION OF THE WOBAN SYSTEM AGAINST MALICIOUS HUMAN INTERACTION - CYBER SECURITY PROTECTION OF THE WOBAN SYSTEM FROM PHYSICAL ACCESS BY NON- AUTHORIZED PERSONS PROTECTION OF THE AIRCRAFT ITS CREW AND PASSENGERS FROM THREAT CAUSED BY USE OF LITHIUM BATTERIES VALIDATION OF REQUIREMENTS CHAPTER 5 GUIDANCE ON REQUIREMENT VERIFICATION RADIO REGULATORY REQUIREMENTS VERFICATION WOBAN SYSTEMS OPERATED UNDER THE REGULATORY PROVISIONS FOR WAIC SYSTEMS WOBAN SYSTEMS OPERATED WITHIN NON-AERONAUTICAL FREQUENCY BANDS ON THE BASIS OF NON-INTERFERENCE AND NON-PROTECTION WIRELESS COMMUNICATION REQUIREMENTS VERIFICATION APPLICATION DATA RATE, JITTER AND LATENCY REQUIREMENTS VERIFICATION APPLICATION COMMUNICATION OUTAGE REQUIREMENT VERIFICATION PROTECTION REQUIREMENTS VERFICATION PROTECTION OF THE AIRCRAFT AGAINST WOBAN SYSTEM S ELECTROMAGNETIC EMISSIONS PROTECTION OF HUMANS AGAINST WOBAN SYSTEM S ELECTROMAGNETIC EMISSIONS PROTECTION OF THE WOBAN SYSTEM AGAINST ELECTROMAGNETIC EMISSIONS FROM THE AIRCRAFT PROTECTION OF THE WOBAN SYSTEM AGAINST MALICIOUS HUMAN INTERACTION - CYBER SECURITY PROTECTION OF THE WOBAN SYSTEM FROM PHYSICAL ACCESS BY NON- AUTHORIZED PERSONS PROTECTION OF THE AIRCRAFT ITS CREW AND PASSENGERS FROM THREAT CAUSED BY USE OF LITHIUM BATTERIES... 42

6 v APPENDIX A TYPES OF USE CASES FOR WIRELESS COMMUNICATION ON BOARD AIRCRAFT APPENDIX B RADIO REGULATORY FRAMEWORK APPENDIX C PROHIBITION OF JAMMING EQUIPMENT APPENDIX D RECOMMENDATIONS ON INCREMENTAL CERTIFICATION APPENDIX E WIRELESS COMMUNICATION PERFORMANCE VERFICATION PROCESS APPENDIX F ELECTOMAGNETIC COMPATIBILITY APPENDIX G DATA SECURITY APPENDIX H INDEX OF REFERENCES APPENDIX I WG-96 MEMBERSHIP APPENDIX J ACRONYMS AND GLOSSARY OF TERMS APPENDIX K IMPROVEMENT SUGGESTION FORM... 88

7 vi LIST OF FIGURES FIGURE 1: WOBAN SYSTEM EXAMPLE FIGURE 2: POINT-TO-POINT, SINGLE AIRCRAFT FUNCTION WOBAN SYSTEM EXAMPLE FIGURE 3: POINT-TO-POINT, MULTIPLE APPLICATIONS WOBAN SYSTEM EXAMPLE FIGURE 4: CENTRALIZED POINT-TO-MULTI-POINT WOBAN SYSTEM EXAMPLE FIGURE 5: MULTI-HOP WOBAN SYSTEM EXAMPLE FIGURE 6: STAKEHOLDER TASK RELATIONSHIP FIGURE 7: GUIDANCE ON DEVELOPMENT PROCESS REQUIREMENTS FOR WOBAN SYSTEMS FIGURE 8: CATEGORIZATION OF WIRELESS COMMUNICATION REQUIREMENTS FIGURE 9: GUIDANCE ON REQUIREMENT VERIFICATION FOR WOBAN SYSTEMS FIGURE 10: APPLICATION REQUIREMENT VERIFICATION FIGURE 11: MAP OF ITU WORLD REGIONS FIGURE 12: AERONAUTICAL RADIO SERVICES FIGURE 13: CONCEPTUAL COMPUTER SIMULATION MODEL FIGURE 14: WOBAN SYSTEM SECURITY PERIMETER... 70

8 vii LIST OF TABLES TABLE 1: POSSIBLE COEXISTENCE SCENARIOS TABLE 2: COMMONLY USED TERMINOLOGY FOR CHARACTERIZING THE REGULATORY REGIME TABLE 3: DIFFERENTIATION BETWEEN REGULATORY REGIMES TABLE 4: COMPLIANCE TASKS, MEANS OF COMPLIANCE AND ASSOCIATED AIRWORTHINESS DOCUMENTS TABLE 5: COMPLIANCE TASKS, RESPONSIBILITIES AND PROPOSED MOCS FOR SCENARIO TABLE 6: COMPLIANCE TASKS, RESPONSIBILITIES AND PROPOSED MOCS FOR SCENARIO TABLE 7: COMPLIANCE TASKS, RESPONSIBILITIES AND PROPOSED MOCS FOR SCENARIO TABLE 8: COMPLIANCE TASKS, RESPONSIBILITIES AND PROPOSED MOCS FOR SCENARIO TABLE 9: THREAT CONDITIONS WITH RESPECT TO WOBAN SYSTEMS... 70

9 8 CHAPTER SCOPE OF WORK GENERAL FRAMEWORK This document is intended to provide guidance on the airworthiness certification process for electronic aircraft equipment installed or integrated on board an aircraft, featuring a wireless communication function to allow for exchange of information with other equipment installed or integrated on board the same aircraft. These wireless communication functions are part of the aircraft configuration and their proper functioning will need to be approved through airworthiness certification authorities. These systems are named Wireless On-board Avionics Network (WOBAN) systems throughout this document. Wireless communications between intentionally transmitting portable electronic devices (T-PEDs), which are not part of the approved aircraft configuration, are already covered by existing standards (e.g. ED-130A [7], DO-294C [18]) and are outside the scope of this specification. Similarly, wireless communication systems such as those used for air-to-ground, airto-air and air-to-satellite communication and navigation purposes are also outside the scope of this specification. WOBAN systems may use globally available radio frequency spectrum resources such as the global frequency allocations for Industrial, Scientific and Medical (ISM) applications. These frequency bands are often made available by telecom regulatory authorities on the basis of license exemption or a general authorization for use (see paragraph B.2.2 in Appendix B). WOBAN systems may also be designed for use in a particular aeronautical spectrum allocation which is dedicated for the purpose described above (for example, the frequency allocation in the frequency band MHz). WOBAN systems that operate in this band are also referred to as Wireless Avionics Intra-Communication (WAIC) systems [51]. This process specification is applicable to all on-board wireless systems that fulfill the above definition, i.e. all WOBAN systems. The proposed requirements as well as the process and means to demonstrate compliance of a particular system implementation to these requirements are described throughout the remainder of this document. This specification hence provides guidance to WOBAN Component Developers, Application Developers, WOBAN System Integrators as well as the Certification Applicants that are seeking airworthiness approval for their products. This guidance includes a description of the proposed activities that should be performed and the supporting information that should be generated. It is also intended to assist the airworthiness certification authorities in addressing the certification aspects of WOBAN systems. Whenever reference to other guidance material, such as EUROCAE ED-xx or RTCA DO-xx documents, is made throughout this Process Specification, unless otherwise stated, always the latest revision of that document shall apply. 1.2 DOCUMENT STRUCTURE The document contains five main chapters. Chapter 1 provides the general framework for which this Process Specification (PS) is applicable. It defines its scope, describes the document structure and identifies related guidance material and related activities carried out in other EUROCAE working groups. Chapter 2 provides the definition of a Wireless On-board Avionics Network (WOBAN) system and describes the WOBAN system elements and the associated terminology. It further provides a description of a number of typical WOBAN system topologies.

10 9 Chapter 3 provides a description of typical development scenarios for WOBAN systems including an introduction of individual development tasks and their assignment to stakeholders. Furthermore, it introduces aspects of certification planning, including airworthiness aspects and instructions for continued airworthiness. It addresses as well safety assessment and protection requirements. Chapter 4 provides Guidance on requirements for the development process for WOBAN systems including those related to radio/telecom regulations, communication performance and protection of the WOBAN system against external effects. Chapter 5 provided guidance on the verification of the requirements introduced in chapter RELATION TO THE WORK OF OTHER EUROCAE WORKING GROUPS EUROCAE WG-72 Aeronautical Information Systems Security This process specification uses as a basis for the WOBAN security related topics the following documents created by WG-72: EUROCAE, ED 201, Aeronautical Information System Security (AISS) Framework Guidance, December 2015 [8] EUROCAE, ED-202A, Airworthiness Security Process Specification, June 2014 [9] EUROCAE, ED-203, Airworthiness Security Methods and Considerations, September 2015 [10] EUROCAE, ED-204, Information Security Guidance for Continuing Airworthiness, June 2014 [11] EUROCAE WG-99 Portable Electronic Devices (PED) WG-99 developed a general methodology for verifying whether an aircraft is tolerant with regards to electromagnetic emissions from T-PEDs. WOBAN systems, unlike T- PEDs, are a part of the approved aircraft configuration. While in this aspect WOBAN systems and TPEDs certainly differ, the methodology for demonstration of T-PED tolerance of aircraft systems can equally be applied for verifying tolerance against electromagnetic emissions from WOBAN-NAS (Non-Aeronautical Standard) systems. This is because T-PED radio technology and operational frequency ranges are essentially the same as that used for WOBAN-NAS systems. The special case of WAIC systems operating in the aeronautical frequency band MHz involves front-door coupling of WAIC emissions into the receive band of the radio altimeter system as well as radio altimeter emissions into the receive band of the WAIC system. Since this is a question of the ability of both WAIC and radio altimeter systems to coexist in the same frequency band, it needs to be addressed by system design measures rather than by demonstrating electromagnetic compatibility. This case is discussed in further detail in paragraph and Appendix E. This process specification considers the testing methodology developed by WG-99 to test the tolerance of an aircraft against T-PEDs, as applicable for the testing of the aircraft tolerance against WOBAN. The following documents developed by WG-99 complement the process described in this process specification and should be used for guidance: EUROCAE, ED-130A, Guidance for the use of portable electronics devices (PEDs) on board aircraft, December 2016 [7] EUROCAE, ED-239, Aircraft Design and certification for portable electronic device (PED) tolerance, December 2016 [12].

11 10 CHAPTER INTRODUCTION WIRELESS ON-BOARD AVIONIC NETWORKS This chapter provides a generic description of WOBAN systems and introduces the terminology used throughout the remainder of this document. Examples of typical WOBAN topologies and configurations are discussed at the end of this chapter. 2.2 DEFINITION OF WOBAN AND TERMINOLOGY The term WOBAN refers to wireless networks that provide communications for aircraft functions. These functions are introduced to an aircraft through either a Type Certification (TC), a Design Change to a TC, or a Supplemental TC (STC). Appendix A provides categories of possible wireless application use cases. A WOBAN system provides the following high-level functionality: reception of data from an application as part of the aircraft function, transfer of data across the network to its intended destination in accordance with a specified quality of service, delivery of data in its original format to the intended application, management of the network operation and its configuration. A WOBAN system consists of WOBAN components. These components can be WOBAN nodes, network management functions or any other entity necessary for a proper WOBAN system operation. Generally, a WOBAN system comprises two or more WOBAN nodes and an entity responsible for managing the network. A WOBAN node is connected to one or more applications, where each application is part of one or more aircraft function(s). WOBAN nodes wirelessly transmit and receive application data. The network management entity can either be integrated into the WOBAN nodes or can be hosted within dedicated processing entities. Application(s) Aircraft Function Domain WOBAN Node Wired Connection WOBAN Domain WOBAN Node Antenna FIGURE 1: WOBAN system example Application(s) Aircraft Function Domain WOBAN nodes are installed at fixed locations or are movable within a designated onboard area. The latter type of node is also referred to as a movable WOBAN node within this PS. In addition to transferring data between applications, WOBAN nodes may also be used for relaying data to extend the communication range of a network. Relay nodes may not necessarily be connected to an application. Fixed and movable WOBAN nodes (including relay nodes) are part of the approved aircraft configuration. WOBAN systems may include provisions for granting network access on a temporary basis to nodes which are not part of the approved aircraft configuration, e.g. for aircraft servicing or maintenance purposes. These nodes are referred to as guest nodes. Guest node access will be on a temporary basis that is restricted to aircraft ground

12 11 operation only. It is recommended that the WOBAN system has a special mode of operation that is only applicable for restricted access conditions. 2.3 TYPICAL WOBAN TOPOLOGIES AND CONFIGURATIONS WOBAN system implementations differ depending on factors such as, aircraft type, configuration and targeted function(s). Consequently, a broad range of WOBAN topologies and configurations are possible. This section provides an overview of some typical WOBAN topologies and their configurations Point-to-Point WOBAN system The simplest WOBAN topology consists of two WOBAN nodes using a single wireless communication link as depicted in FIGURE 2. The two depicted WOBAN nodes provide wireless communications for a single aircraft function. WOBAN WOBAN Application 1 Application 1 Node Node Aircraft Function Domain Wired Connection WOBAN Domain Antenna Aircraft Function Domain FIGURE 2: Point-to-Point, single aircraft function WOBAN system example The same topology can be used to provide wireless communications for several aircraft functions. In this case the network must be configured such that a WOBAN node is able to physically interface with multiple applications and to distinguish between them. Such a configuration is depicted in FIGURE 3, where applications 1 to 3 represent (parts of) different aircraft functions. Application 1 Application 2 Application 3 Aircraft Function Domain WOBAN Node WOBAN Domain Wired Connection WOBAN Node Antenna Application 1 Application 2 Application 3 Aircraft Function Domain FIGURE 3: Point-to-point, multiple applications WOBAN system example Centralized Point-to-Multi-Point WOBAN system A centralized point-to-multi-point network topology consists of more than two WOBAN nodes. At least one particular node in the network is connected to all the aircraft functions that make use of the WOBAN system via a wired avionics data bus.

13 12 This node serves as a gateway between the wired avionics data bus and all other WOBAN nodes in the network. Consequentially, it must be in mutual radio range of all other nodes. The remaining WOBAN nodes connect to a single or several applications which, for example, send or receive data to/from an actuator or a sensor. This network topology and configuration is depicted in FIGURE 4. Centralized point-to-multi-point WOBAN systems may include more than one WOBAN node that serves as a gateway to increase radio coverage and redundancy. Application 1 Application 1 Application 3 Aircraft Function Application 2 Aircraft Function Domain Multi-Hop WOBAN system WOBAN Node WOBAN Node WOBAN Node WOBAN Domain Gateway WOBAN Node Antenna Wired Connection Application 1 Application 2 Application 3 Aircraft Function Domain FIGURE 4: Centralized point-to-multi-point WOBAN system example A Multi-Hop network topology consists of multiple WOBAN nodes which are transmitting or receiving data of the connected applications. These nodes may also relay messages to other nodes. However, Multi-Hop WOBAN systems may also include WOBAN nodes whose sole purpose is to relay data for the purpose of increasing radio coverage. In addition, Multi-Hop WOBAN systems may also include nodes that serve as a gateway as described above. FIGURE 5 shows an example of a Multi-Hop WOBAN system. In the depicted example, WOBAN nodes 1 and 2 may directly communicate to exchange data of application 1. The same applies for WOBAN nodes 5 and 6 with respect to application 3. However, WOBAN nodes 2 and 5 require one or more relays to exchange data related to application 2. A possible route to connect nodes 2 and 5 could be via node 3. Other routes are possible, for example, via nodes 4 and 6, where the latter also acts as a relay node besides serving application 3.

14 13 Application 1 WOBAN Node 1 WOBAN Node 2 Application 2 Application 1 Application 2 Application 3 Aircraft Function Domain WOBAN Node 5 WOBAN Node 3 Relay Wired Connection WOBAN Domain WOBAN Node 4 WOBAN Node 6 FIGURE 5: Multi-hop WOBAN system example Application 3 Relay Antenna Aircraft Function Domain

15 14 CHAPTER INTRODUCTION CERTIFICATION GUIDANCE This chapter identifies the stakeholders involved in the development and certification of a WOBAN system. It defines the necessary certification tasks and provides an overview of a number of typical WOBAN system certification scenarios. The information provided in this chapter is intended to supports the applicant in the development and certification process applicable to WOBAN systems. 3.2 DEFINITION OF STAKEHOLDERS AND TASKS The following stakeholders can be involved in the development, integration and compliance demonstration of a WOBAN system: WOBAN Component Developer: Responsible for the development of WOBAN components, e.g. WOBAN nodes or network management function. Application Developer: Responsible for the development of applications in respect to the associated overlaying aircraft functions. WOBAN System Integrator: Responsible for building a new or modifying an existing WOBAN system. The WOBAN System Integrator is responsible for ensuring that all WOBAN applications that use the network meet their performance objectives. Certification Applicant: Responsible for aircraft-level integration of a single or multiple WOBAN system(s) and for providing certification documentation in order to obtain certification approval for a WOBAN system installation including their applications. The Certification Applicant is typically the aircraft manufacturer or a STC design organization. Certification Authority: The Certification Authority is the organization(s) granting approval on behalf of the individual State(s) responsible for aircraft airworthiness certification. NOTE: The stakeholder names defined above appear in italic notation throughout this Process Specification Major Relations between Stakeholders: Requirements Flow Product / MoC Approval data Certification Authority TC & STC Certification Applicant WOBAN integrator WOBAN Application WOBAN Developer B Application Developer A A/C function B A/C function A ETSO ETSO Approval ETSO Approval WOBAN ETSO Approval component WOBAN developer component WOBAN C developer Component developer A FIGURE 6: Stakeholder task relationship

16 15 The development and integration of a WOBAN system as well as the compliance demonstration for that system requires the following tasks: Task 1 WOBAN component development: This task comprises the development of WOBAN components and their testing against validated certification requirements. WOBAN components can be approved independently from applications in accordance with established ETSOs and relevant certification requirements proposed in CHAPTER 4 of this PS. NOTE: At the time of development of this EUROCAE PS an ETSO for WOBAN does not exist. It is expected that such ETSO will be developed by EASA. Task 2 Application development: This task comprises the development of new applications or the modification of existing applications. Applications should be tested together with the WOBAN system used by these applications against an approved set of certification requirements. Applications could be approved independently from each other and from the WOBAN system, by demonstrating that the application can fulfil its intended function for the characteristics specified by the WOBAN usage domain. Task 3 WOBAN system integration & configuration: This task comprises the architectural integration of WOBAN components and applications into a new WOBAN system or the addition of WOBAN components and/or applications to an existing WOBAN system. This task also includes the configuration of all WOBAN system components (i.e. nodes, network management and applications) in a way that the network in its entirety and all associated applications fulfil their intended function. Generally, the development of a WOBAN system should be designed to meet certification requirements provided in CHAPTER 4 of this PS. Task 4 WOBAN aircraft integration: This task comprises the integration of a WOBAN system into the target aircraft or the modification of an existing WOBAN system of the target aircraft. Furthermore, this task includes demonstration of compliance with the certification requirements proposed in CHAPTER 4 of this PS. Generally, parties involved in the certification process can be associated with more than one of the stakeholder roles defined above and consequently also with more than one of the tasks. For example, a party could develop WOBAN nodes and applications together and, therefore, fit into the definition of a WOBAN Component and Application Developer. 3.3 TYPICAL DEVELOPMENT SCENARIOS This section describes typical WOBAN system development scenarios. The scenarios are discussed with respect to involved stakeholders and tasks described in the previous sections. Furthermore, objectives for incremental certification of WOBAN systems and components are introduced. Appendix D describes an incremental compliance demonstration process in which a set of specific Means of Compliance (MoC) is mapped to each stakeholder per each development scenario Scenario 1: WOBAN component development Description: In this scenario WOBAN components are developed without consideration of specific target applications or specific aircraft types. The development is performed against applicable requirements (e.g. generic performance and reliability classes). WOBAN components may be approved, if these requirements are based on applicable standards, e.g. an ETSO. The scenario applies for WOBAN components which are based on purpose build and/or commercially available hardware and software. NOTE: At the time of development of this EUROCAE PS an ETSO for WOBAN does not exist. It is expected that such ETSO will be developed by EASA.

17 16 Objectives for incremental certification: To support incremental certification, WOBAN components should be developed against applicable application-level airworthiness requirements agreed with the Certification Authority. The product data sheet of an approved WOBAN component should clearly identify technical characteristics (e.g. performance parameters and limitations) relevant for Application Developers, WOBAN System Integrators, Certification Applicants and certification authorities. WOBAN components should support the segregation of applications that use the network. Involved stakeholders and related tasks: WOBAN Component Developer: Development and compliance demonstration in accordance with Task 1. Certification Authority: Parts and Appliances approval (e.g. based on ETSO) Scenario 2: Application development Description: In this scenario an application is developed for a specific aircraft function. It is assumed that the application development uses available WOBAN components approved according to Task 1. The composition of developed application and used WOBAN components is qualified against the specific requirements imposed by the aircraft function (for example maximum achievable data rate, minimum tolerable transmission latency) by Means of Compliance proposed in CHAPTER 5. Qualification testing should include a set of requirements representing characteristic environmental conditions (e.g. electromagnetic environment, temperature range, pressurized or unpressurised area) representative for the target aircraft type(s). Objectives for incremental certification: Applications should be developed such that the behavior of one application does not affect the performance of other applications using the same WOBAN system. Optionally, an application associated with an aircraft function which can be implemented on board different aircraft types may be approved against requirements agreed with the Certification Authority when using approved WOBAN components. Involved stakeholders and related tasks: Application Developer: Development of the application as part of a specified aircraft function in accordance with Task 2 Certification Applicant: Specification of the aircraft function, including the certification requirements for that function in accordance with Task 2. Certification Authority: Approval, review and approval statement for the concerned aircraft function Scenario 3: New WOBAN system development and aircraft integration Description: This scenario covers the development of a new WOBAN system and its integration into the target aircraft. Two cases are considered: Replacement or extension of an existing wired network: in this case the characteristics and performance of the affected aircraft functions remain unchanged. Therefore, the WOBAN system must be developed against the requirements that the aircraft functions impose on the wired network to be replaced by the WOBAN system. In this context, applications serve as a simple interface between WOBAN node and aircraft function (see paragraph 2.2). Joint development of a WOBAN system and aircraft functions making use of it: In this case the WOBAN system is developed against the requirements of the

18 17 aircraft functions. In contrast to the previous case these requirements may be defined such that an optimum exploitation of the WOBAN system capabilities and performance is possible, for example by accounting for the characteristics of the utilized wireless communication. Instead of serving as a simple interface, the application may become an integral part of the aircraft function itself. When integrated into the aircraft, the WOBAN system should be tested under representative operational conditions against requirements agreed with the Certification Authority as describe in CHAPTER 5. Objectives for incremental certification: The WOBAN system should support the addition, removal and modification of applications and respective WOBAN components while maintaining the existing certification evidence of other applications using the WOBAN system. Involved stakeholders and related tasks: WOBAN System Integrator: Integration and configuration of WOBAN system in accordance with Task 3. Furthermore, the WOBAN System Developer may also be responsible for WOBAN component and/or application development if the WOBAN system is not based on approved WOBAN components and/or applications. Certification Applicant: Integration of the WOBAN system into the target aircraft in accordance with Task 4. Certification Authority: Validation of certification evidence and granting of aircraft approval Scenario 4: Modification of aircraft functions This scenario deals with modifications of aircraft functions making use of a WOBAN system. These modifications result in the addition of changes to or removal of applications and/or associated WOBAN components as well as changes to the WOBAN system configuration. Objectives for incremental certification: The WOBAN System Integrator should demonstrate that the performed modifications do not impact the segregation and performance of other applications using the WOBAN system. The demonstration should include analysis and if necessary test to prove that the existing verification evidence for these applications remain valid. The Certification Applicant should provide evidence that the modifications meet requirements agreed with certification authorities. Involved stakeholders and related tasks: WOBAN Component Developer: In case of changing or adding a new developed WOBAN component the WOBAN Component Developer may be involved and will take responsibility for Task 1 (refer also to Scenario 1: WOBAN component development). Application Developer: Modification of affected applications and demonstration of compliance with applicable certification requirements. WOBAN System Integrator: Integration of modifications into the existing WOBAN system in accordance with Task 3. Certification Applicant: Integration of modified WOBAN system into the target aircraft in accordance with Task 4. Certification Authority: Validation of certification evidence and granting of aircraft approval.

19 Scenario 5: Modification of RF propagation environment Description: This scenario is concerned with modifications to the aircraft impacting the Radio Frequency (RF) propagation environment in which the WOBAN system is operated (for example changes in the cabin configuration). There is a need to assess the continuing performance and defined capabilities of the WOBAN system s communication links after such aircraft changes. The extent of the assessment should depend on the extent of the aircraft-level changes and their impact on the RF-propagation environment. However, it is required to follow the instructions and the guidelines of the certification holder, which were established in order to ensure continued airworthiness (refer to paragraph 3.4.4). As a result of this assessment, two cases can be distinguished: 1. Changes to the RF-propagation environment do not impact the performance of the WOBAN system: In this case it should be checked that the established verification evidences remains valid (for example by built-in self-testing performed by the WOBAN system). No further actions are required. 2. Changes to the RF-propagation environment impact performance of the WOBAN system such that the established certification evidence is invalidated: In this case, the WOBAN system must be re-configured (refer to Scenario 4: Modification of aircraft functions). Involved stakeholders and related tasks in the latter case: System Integrator: Reconfiguration of the existing WOBAN system in accordance with Task 3 such that applicable certification requirements are met. Certification Applicant: Applies the configuration changes to the WOBAN system on board the target aircraft in accordance with Task 4 Certification Authority: Validates certification evidence and grants aircraft approval if case (2) becomes required. 3.4 CERTIFICATION PROCESSES Certification requirements common for all stakeholders Stakeholders responsible for one or more of the tasks described in paragraph 3.2 above should also apply industrial standards (e.g. ED-12 [2] / DO-178 [14], ED-14 [3] / DO-160 [13], ED-80 [5] / DO-254 [17]) in fulfilling their duties. Particular guidelines for the development of civil aircraft and systems are defined in ED-79 [4] / SAE ARP 4754 [25]. The following aspects need to be particularly considered by the stakeholder(s): Requirements validation management Configuration management and control of products and documentations Quality assurance and independent checking procedures (if required) Certification liaison support Development and verification tracking process (problem reporting, etc.) The standards that are applicable to the development of software and complex hardware should apply to the development of WOBAN components and applications. Aircraft-level requirements should be validated, i.e. reviewed for completeness and correctness before allocation of functions to the system. This step should follow the principles as provided in ED Certification planning For certification of the WOBAN system, the Certification Applicant should prepare a certification plan that describes the installation and the proposed Means of Compliance (MoC) with applicable airworthiness requirements in accordance with the certification basis. The Certification Applicant should further explain how the safe use of the WOBAN system under prescribed conditions is ensured.

20 19 Certification aspects addressed within the following paragraphs should be covered by the certification plan of a WOBAN system. Some of these aspects and requirements may or may not be applicable for a given installation/application. For example, possible vulnerabilities with respect to safety and integrity as well as installation specifics such as installed locations of WOBAN nodes may not be applicable. Their applicability will be dependent on the aircraft function(s) that make use of the wireless communication capabilities offered by the WOBAN system and will need to be determined on a case-by-case basis General Certification Requirements for Systems The following list of paragraphs from EASA Certification Specifications for Large Aeroplanes (CS-25) [1] is not exhaustive, but represents typical requirements which could be applicable to a WOBAN system: NOTE: NOTE: (a) Retention of Items in the cabin, (a) Fire Protection, (c) Sustained Engine Imbalance o AMC (a)(b) Function and installation, o AMC (a)(b)(c) Equipment installation and Safety, o AMC (a)(b) Power, Lightning protection, System Safety Assessment High-Intensity Radiated Fields (HIRF) protection Warning, Caution and advisory lights, (a) General - Electrical Systems, Circuit protective devices, Precautions against injury, (a)(b)(c)(d) Qualification, Instructions for Continued Airworthiness (including Appendix H of CS ), Airplane flight Manual, EWIS. For installations on aircraft of category other than Large Aeroplanes the relevant requirements should be used (e.g. CS-23, CS-27, CS-29, etc.). Means of compliance shall be demonstrated to the responsible authority for agreement. A system safety assessment should be provided to the Certification Authority. It is recommended to follow the existing guidance given in SAE ARP 4761 [26]. The certification plan should provide the objectives and an overview about the system safety assessment. The system safety assessment will be a vital part of the approval process of a WOBAN system. Therefore, this PS provides further guidance on the safety assessment process particularly relevant for a WOBAN system, which will be described in paragraph Electromagnetic Compliance Demonstration The introduction of WOBAN systems using wireless communication for the interconnection of avionic systems raises new issues related to the EMC qualification process which have to be assessed before. The WOBAN system should be designed and installed to prevent any radiated or conducted electro-magnetic interference (EMI) to aircraft systems covered by CS (a)(1) [1].

21 20 The Certification Applicant should perform a detailed RF and EMI assessment that defines the characteristics of the total RF environment in the aircraft and the vulnerability of aircraft systems to interference. The assessment may be based on the guidance given in ED-130A [7] or specific guidance material developed for WAIC systems. NOTE: Guidance for T-PED is referred to in this case, because the principles for testing and assessment used in ED-130A are equally applicable to WOBAN-NAS systems because they use the same wireless technologies. Electromagnetic compliance testing or analysis should demonstrate that the installed system, when operating, will not introduce interference effects during all possible system operation and failure modes. The RF field strength used during the test should reflect the incorporation of a safety margin increasing the test levels above the worstcase emissions from the installed WOBAN system or components thereof. Acceptance from airworthiness authorities should be sought in defining such margin. The electromagnetic field generated should ensure adequate coverage throughout all areas of the aircraft relevant for the envisaged application. WOBAN system s transmitters (when active) will generate increased levels of intentionally radiated emissions in the operating frequency range and unintentionally radiated emissions in the out-of-band and spurious domains. Receivers have a high sensitivity in their operating frequency range and, therefore, an increased susceptibility to RF energy emanating from the electromagnetic environment in that frequency range. If the WOBAN system is supposed to be active during critical flight phases, such as take-off and landing, particular attention should be paid to the noninterference demonstration during these phases of flight. Special attention should be paid to flight guidance systems, electronic flight control systems, electronic display and alerting systems, electronic engine control systems, radiocommunication and radionavigation systems including the Instrument Landing System (ILS), the Microwave Landing System (MLS) and the GBAS Landing System (GLS). This list is not exhaustive and the Certification Applicant should assess all installed systems which may be affected by the introduction of a wireless system. The general environmental qualification process for airborne equipment described in ED-14 [3] can be used as guidance; however, it will not be sufficient to cover all EMC aspects related to WOBAN systems. This chapter defines a set of requirements to achieve a sufficient level of assurance that WOBAN systems will not adversely affect other aircraft systems and vice versa. The Certification Applicant should provide evidence to the certification authorities that the WOBAN system under consideration meets the following requirements EMC Qualification according to ED-14 Any airborne equipment is required to be qualified to its intended environmental conditions using the test-procedures of ED-14 [3]. For WOBAN systems it is important to notice that the assessment of the radiated emissions according to ED-14 section 21 is limited to non-intentional (spurious) emissions. The assessment of the equipment s susceptibility to RF interference (ED-14 section 20) excludes the communication frequency range(s) of WOBAN system s receivers Intentionally radiated emissions The intentionally radiated emissions of the transmitting components of a WOBAN system (as single transmitting devices and as a combination of multiple, potentially simultaneously transmitting devices in a network) should not adversely affect other aircraft equipment Susceptibility to non-intentional interference The wireless communication of WOBAN systems should not be adversely affected by aircraft typical, non-intentional (spurious) interference levels in the WOBAN system s operating frequency range.

22 Susceptibility to intentional interference WOBAN systems should not be adversely affected by intentionally radiated emissions of other wireless systems using the same or partly the same frequency spectrum. This aspect of sharing a common medium among multiple wireless systems is commonly known as coexistence. For further information on this aspect refer to paragraph Data Security Assessment Aircraft and aircraft systems are subject to human interaction, some of which have the intention to misuse or disrupt the system. This interaction can lead to the loss of information security. In this document, the term information security refers to: The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability. [27] There are already several, internationally recognized standards, which cover aspects of information security on a multitude of abstraction levels and industries. For a list of standards relevant in aeronautics please refer to Appendix D of ED-202A [9]. The further development of standardization of aeronautical information systems security is assigned to EUROCAE working group WG-72 and the RTCA special committee SC-261. In this context, the following documents are or will be available in the future: ED-201 Aeronautical Information System Security (AISS) Framework Guidance (issued December 2015) [8] ED-202A / DO-326A - Airworthiness Security Process Specification (issued June 2014 / August 2014) [9], [21] ED-203 / DO Airworthiness Security Methods and Considerations (issued September 2015) [10], [23] ED-204 / DO Information Security Guidance for Continuing Airworthiness (Issued June 2014) [11], [22]. The work of WG-72 and in particular its work on the airworthiness security PS ED- 202A [9], is applicable to WOBAN systems. As defined in paragraph 2.2, a WOBAN system provides communication links for applications which form parts of one or multiple aircraft function(s). Hence, WOBAN systems contribute to the airworthiness of an aircraft which makes it an asset according to ED-202A. This implies that WOBAN systems have to be part of the airworthiness security process. This process contains several activities which are centered on the security risk assessment. The security risk captures the possible impact of adverse interaction with the system, as well as the likelihood of such an interaction happening. The magnitude of the security risk in turn determines the amount of effort which has to be invested in protecting the corresponding assets. In order to establish and maintain airworthiness of an aircraft containing WOBAN systems the applicant should establish information security processes in accordance with the process specification of ED-202A and other applicable standards during the whole lifecycle. Appendix G presents, in accordance with the approach of ED-202A, particular security aspects applying to WOBAN systems Health Risks Determination Use of the WOBAN system must not generate RF emissions that can have possible adverse health effects within aircraft areas occupied by passengers or personnel that operate and maintain the aircraft. Possible effects have been analyzed on behalf of several international organizations. The International Commission on non-ionizing Radiation Protection (ICNIRP) published the Guidelines for limiting Exposure to time-varying electric, magnetic and electromagnetic Fields

23 Physical Protection Usage of batteries to provide protection against known adverse health effects. These guidelines propose reference levels for the exposure to time-varying electric and magnetic fields which are used as basis for the most common environmental electromagnetic compatibility (EEMC) standards. The designer of the WOBAN system should ensure that the radiated emissions including all amplifying effects (e.g. multiple equipment emitting at the same time in a network) comply with the reference levels derived from international standards related to human health for the general public. Consideration should be given to any potential effect on medical equipment carried by the aircraft operator as a part of or supplementary to the first aid kit, including Automatic External Defibrillators (AEDs). This will need to be reflected in aircraft operator material made available to passengers and used in the creation of cabin crew procedures and training. Whilst Airworthiness Authorities can give no credit to the performance of these devices, the applicant may need to consider providing the aircraft operator with advice regarding the use of these devices whilst any element of the WOBAN system is operational. Furthermore, the system under normal operating, or fault conditions should not present a hazard to occupants of the aircraft from fire, smoke, or noxious fumes. In addition to electronic interaction with the WOBAN system, physical means of disrupting wireless communications should be addressed. Possible interactions affecting the availability of a WOBAN system include; direct physical access to one or more nodes with the goal of destroying or disabling the node or inhibiting the wireless communication link and indirect means of inhibiting the wireless communication link, e.g., by placing absorbent material in front of one or more nodes. The Certification Applicant should consider any constraints introduced by the installation of WOBAN components. An installation inspection should include the review that such constraints have been adequately addressed. WOBAN components, if powered by batteries should provide the containment of any hazardous products of the failure of its internal battery without the need of any additional external containment devices other than the mounting bracket. Any battery-powered equipment shall comply with the requirements in DO-347 [24], DO-311A [20], DO-227A [15] and any relevant supplements or document updates. The WOBAN Component Developer and/or the Certification Applicant should also develop a means to prevent inadvertent opening of WOBAN components with failed batteries that may be under internal pressure. This may include voltage or external temperature checks prior to opening the device. It may also be required to include appropriate Cautions/Warnings and to document procedures in manuals mentioned in paragraph Environmental qualification aspects of certification The environmental qualification of installed equipment should be compliant with applicable sections of ED-14G [3] / DO-160G [13]. Test categories or levels should be chosen according to the envisaged installation environment. Justification of conformance for the equipment under test with the criteria specified in ED-14G / DO-160G should be provided. Frequency ranges in which the equipment under test is intentionally transmitting are not subject to justification of conformance with respect to chapters 20 and 21 of ED-14G / DO-160G. The ability of the WOBAN components to meet the environmental requirements should be verified during the equipment environmental qualification tests Software and complex hardware aspects of certification The certification plan should include certification aspects of hardware, including complex hardware, and software, including configuration files.

24 23 E.g., ED-12C [2] / DO-178C [14] and AMC C [52] are acceptable means of compliance for CS and CS for software aspects of certification. Clarification on some interpretation of ED-12C / DO-178C can be found in ED-94C [6] / DO-248C [16]. Configuration tables and databases, developed by the WOBAN System Integrator, should be presented to the Certification Authority who will provide guidance for the approval process. If the WOBAN component contains a complex Application-Specific Integrated Circuit or complex programmable logic (e.g. Programmable Array Logic components, Field- Programmable Gate Array components, General Array Logic components, or Erasable Programmable Logic Devices) summarized as Complex Electronic Hardware to accomplish the function, development should be in accordance with EUROCAE ED-80 [5] / RTCA DO-254 [17]. Supplemental guidance material for all other airborne electronic hardware (including design of electronic circuit boards and use of COTS devices) included in the ETSO article may be found in EASA Certification Memorandum, EASA CM SWCEH 001, Development Assurance of Airborne Electronic Hardware [53] Configuration Management Aircraft Test Plan The Certification Applicant should provide information regarding the configuration management process for the WOBAN system and equipment. The information should include details of the hardware and software part numbering system to be employed for new and modified equipment. Commercial of the Shelf (COTS) components whose specifications can be changed without notice should be subjected to a change control plan. This is needed to demonstrate that configuration control is maintained by the Certification Applicant. The WOBAN Component Developer has to provide appropriate design data, including changes, to the Certification Applicant in order to control the WOBAN system configuration. The Certification Applicant should submit a ground and flight test plan (in case flight test is necessary) outlining the proposal for testing prior to certification. This plan should address testing system operation and interference during all applicable operating conditions and flight phases to establish representative field conditions, especially during instrument approach to the highest category approved for the aircraft, when approval of wireless system operation during these flight phases is sought. After the first aircraft installation, all subsequent aircraft of the same type that are subject to this airworthiness certification should be assessed to determine whether they are identical to the certified configuration (that of the first aircraft), to determine the validity of the initial safety assessment. If the next aircraft is not sufficiently identical, further analyses and/or tests shall be conducted to achieve the compatibility demonstration as required. Note: "Identical" = Sufficiently similar such that the certificated configuration s safety assessment remains valid for the considered aircraft; i.e. all assumptions and verification data remain valid Aircraft Flight Manual Operational Aspects The Aircraft Flight Manual (AFM) should identify the phases of flight in which the WOBAN system shall be inhibited. It should also provide crew procedures, following loss or misbehavior of the WOBAN system, to restore normal operation of the aircraft. See also paragraph The Certification Applicant should issue procedures and criteria for operators explaining the wireless system concept and its limitations.

25 24 The Certification Applicant should issue flight crew and cabin crew procedures concerning the use and the limitations of the WOBAN system. The design and installation of the WOBAN system should be such that impact upon operational procedures is minimized. However, if credit is taken for flight crew or cabin crew procedures to show compliance with the airworthiness requirements, these procedures should be included in the approved AFM and other crew manuals as appropriate. These procedures should be acceptable to the responsible Certification Authority. Also see section Aircraft Design Changes following the Initial Approval of a WOBAN system Due to the variability in aircraft model configuration, the Certification Applicant should present a plan for either testing or performing an analysis for aircraft that have major interior installation changes resulting in wireless system repositioning on which the system is installed under the STC. An EMI and WOBAN system performance reassessment should be conducted for the following cases: a new aircraft system that includes an external antenna is installed (e.g. MLS system), in case of significant antenna relocations, or when a new frequency band or a new modulation scheme is allocated to an aircraft system Shared Communication Resources A WOBAN system may provide communication services to multiple aircraft functions which will result in the sharing of WOBAN components by different aircraft applications. Therefore, such WOBAN components and the communication links between them will become shared resources. It is anticipated that airworthiness authorities would issue Interpretative Material or Advisory Circulars in order to clarify aspects associated with the approval of shared communication resources. For similar purposes EASA and FAA have issued guidance material related to the use of shared data busses (e.g. Avionics Full Duplex Switched Ethernet (AFDX)) and for the incremental certification of systems that make use of this type of shared resource Guidance for Safety Assessment The safety assessment should follow aeronautical standards as provided by SAE ARP4761 [26]. The installation and operation of the WOBAN system shall ensure that it does not adversely affect the aircraft s equipment and systems required by CS [1], i.e. those required for type certification or by the operating rules, or whose improper functioning would reduce safety throughout the entire flight cycle. The flight cycle starts at the moment of passenger door closure on departure and lasts till passenger door opening upon arrival. The safety objectives will depend on the severity of system failures introduced as a result of the use of a wireless network. It is obvious that such level of severity will be determined by the Functional Hazard Assessment (FHA) of the aircraft functions that will make use of the wireless communication links provided by a WOBAN system. The Certification Applicant should summarize possible failure conditions and present a set of safety objectives to the Certification Authority. This will usually be included in the system level FHA (see next paragraph) Functional Hazard Assessment For compliance with CS [1], the system and individual equipment failure condition classifications shall be identified by performing a safety analysis, including an FHA.

26 25 The FHA should contain an assessment of all potential failures and respective effects to the aircraft function. This shall include such failures that are induced by the WOBAN system itself. The FHA should identify the aircraft and system level safety objectives that must be considered in the system s architecture development and the assignment of the Functional Development Assurance Level (FDAL) for the WOBAN system and the Item Development Assurance Level (IDAL) for the equipment. Particular attention will need to be given to the risks of multiple failures of systems that could result in Catastrophic, Hazardous, Major and Minor aircraft-level functional failure conditions. It should include effects identified through an RF and EMI assessment of system normal and abnormal operation. Any functionality performed using software or digital devices or making use of databases would need to be developed to an appropriate level of rigor. The assurance levels of any software, digital devices and databases used within the system equipment must be compatible with the system safety analysis Safety Assessment for a typical WOBAN system As mentioned in paragraph , the FHA should contain a systematic determination of failure conditions and effects and a determination of safety and reliability objectives, design objectives and expected probabilities. Failure conditions can be divided into categories and individual events which trigger possible failures. Typical categories are: 1. Loss of single or combination of network components (e.g. WOBAN node): This category is mainly a result of hardware failure of the concerned component. Internal failures could also be caused by hardware or software design errors of WOBAN components. 2. Loss of communication capabilities, including transmission of erroneous data on a single or multiple communication link(s): Failures of this category may affect all communication links (total loss of communication capabilities). Failures from the second of the above categories are triggered by conditions and events external to the WOBAN system and are not caused by the WOBAN components themselves. Such events could result in the loss of communications or degradation in performance. Events external to the WOBAN system are independent and could be due to the following: Increased radio propagation loss for individual or a combination of WOBAN system s communication links through physical obstacles, Single event effects (SEE) caused by atmospheric radiation which could affect the electronic components of the WOBAN system, External electromagnetic sources leading to EMI and violating coexistence conditions by other networks (same frequency band), or by other members of the WOBAN system. Jamming requires specific consideration, NOTE: Jamming cannot be managed like other events because no recognized calculation method of probability exists. For this case refer to paragraph as well as Appendix C and Appendix G. Mechanical damage of accessible parts of WOBAN nodes (e.g. antennas) installed in passenger accessible areas, Electrical power loss, i.e., loss of power to the WOBAN node(s), NOTE: If the safety assessment identifies any issues associated with the wireless system in the event of an aircraft rapid decompression, then either the wireless system should be certificated in accordance with the rapid decompression environmental condition or it should be automatically deactivated in the event of a rapid decompression of the aircraft. If it is required to perform a safety assessment based on quantified probabilities, standard methods provided by SAE ARP4761 [26] shall apply (e.g. FTA, FMEA,

27 26 FMECA). For each event a calculation of failure probability should be performed applying recognized methods Safety effects and mitigations The safety assessment should take into consideration design features that would reduce or eliminate effects of failures. Following capabilities are usually part of the basic design: Embedded error detection/correction means in the network components which are typically transparent to applications (e.g. forward error correction coding), Means for monitoring the link quality on individual WOBAN system s communication links and for adapting link parameters accordingly (e.g. change of modulation and forward error correction coding schemes) and Application-level error detection and correction means. However, based on the severity of the failure effects, the following additional means should be made available in order to support detection and awareness including partial or complete loss of wireless communication: Make the flight crew aware of the failure, dependent on the failure effects (e.g. flight deck warning) and associated crew actions, Means for the flight crew to remove power from the wireless system, if the safety assessment identifies such a need and Means for the flight crew to detect external events which lead to loss of wireless communication, (e.g. to detect jammers). NOTE: To avoid an increase in workload only those actions required to ensure safe flight and landing of the aircraft should be included in the flight crew s operational procedures Item Development Assurance Level determination The FDALs identified through the FHA should be used, in conjunction with system architecture considerations, to determine the IDALs (including the design assurance level and software level). These levels must be assigned for the development of airborne electronic hardware and software, identifying the rigor of the development processes used. Guidance may be found within ED-79A [4] and SAE ARP 4754A [25] Diversity of Development Assurance Level in WOBAN systems WOBAN systems are used to enable communication between different aircraft functions that could have different criticalities and different DALs. The application inherits its DAL from the aircraft function it is belonging to. In case multiple applications will be connected to one WOBAN Node (refer to FIGURE 3), the DAL of this node should correspond to the highest DAL of the applications which this node is connected to. Failures propagation, affecting the data traffic between components of a WOBAN system should be prevented. Segregation of the communication links could prevent such failure propagation (refer to paragraph ) Continued Airworthiness Process The Certification Applicant should submit Instructions for continued airworthiness associated with the WOBAN system installation. Special consideration should be given to performance degradation, in service modifications and data security. The Certification Applicant should refer to CS and CS [1], if included in the certification basis Performance degradation In order to ensure continued airworthiness, the WOBAN Component Developer and WOBAN System Integrator should propose periodic and unscheduled maintenance tasks and inspections. The Certification Applicant should be aware that, depending on the criticality of the WOBAN system and the associated applications, the implementation of an inherent monitoring system might be required to achieve continued airworthiness. It is expected that built-in monitoring functions will detect unacceptable performance degradations. In any case, based on the WOBAN System

28 27 Integrator s proposal, the Certification Applicant should establish appropriate maintenance instructions to maintain airworthiness. It is highly recommended to include a Built-In-Test function into the WOBAN system which should be capable of measuring relevant performance metrics storing them and making them available for instance as a maintenance inspection report. If this is technically impossible because an interface to the on-board maintenance reporting system is not foreseen, a dedicated system interface should be made available to provide the results of the Built-In-Test Guideline for in-service modification of RF propagation environment As mentioned above, changes to the aircraft interior such as changes to the cabin layout may lead to a modification of the RF propagation environment significant enough to impact the WOBAN system s performance (refer to the description of development scenario 5 in paragraph 3.3.5). The Certification Applicant should provide guidance material to support such in-service changes. At least such guidance shall include information on limitations of conversion that will lead to significant loss of required performance. The location of the WOBAN nodes must be clearly identified. This guidance shall also include procedures to enable a post-change assessment to determine that the performance of the WOBAN system is still at an acceptable level Guideline for in-service installation of additional wireless networks If an upgrade is envisaged to provide additional wireless networks (for instance wireless in-flight entertainment equipment), operating within the same frequency band as the existing WOBAN system, the Certification Applicant should provide guidance material to ensure coexistence and non-interference with the installed WOBAN system. Such guidance should contain information about installation constraints to be considered by the installer of the additional wireless network, for instance minimum distance between existing WOBAN system and new wireless network equipment. It may also contain constraints about resource usage and performance limitations as well as procedures to enable a post-change assessment to determine that the existing WOBAN system s communication link performance is still at an acceptable level Instructions for Continued Airworthiness regarding Cyber Security A WOBAN system should be designed to be secure against possible cyber security attacks. However, new threats may emerge after issuing the TC/STC, or the security measures provided may have become compromised. The management of vulnerabilities, which are disclosed after issuing the TC/STC is an integral part of the ICA activities regarding data security. Therefore, the Certification Applicant shall follow ED-204 [11] / DO-355 [22]. These documents provide information on the activities that should be performed during operation and maintenance of the aircraft to address the threat of unauthorized interaction. The Certification Applicant should document how WOBAN system s security is managed, reviewed and updated. The following procedures and instructions should be considered as a minimum: Continuous monitoring of vulnerability databases and analysis of their relevance, Planning, testing and roll-out of security updates, Maintaining of an Information Security Management system and Addressing of information cyber security in Operating Manuals. 3.5 GUIDANCE FOR OPERATORS A WOBAN system will introduce a number of new factors that the aircraft operators and maintenance organizations need to be made aware of. The WOBAN Component Developer or System Integrator should provide sufficient support information to ensure that the equipment is operated and maintained in an appropriate manner. The primary objective is to ensure that the network always operates safely and reliably throughout its operational life. As a minimum, the Certification Applicant should provide guidance information as described in the following sections.

29 Awareness Training Material A WOBAN system is designed to communicate using radio signals that propagate through the air. The performance of a wireless communication link is a function of the transmitter and receiver characteristics (including antennas) and the radio channel between them. The aircraft operator and maintainer should be made aware of the principle operation of the WOBAN system by means of appropriate awareness training material. Furthermore, aircraft operator and maintainer should be made aware of factors under their control that could adversely affect WOBAN system performance, such as: Factors to be addressed include as a minimum: Placement of items in front of the transmit and/or receive antennas, Changes to the cabin and/or monument configurations, Installation, replacement, or modification of wireless networks or other radio systems, Any other modification to the aircraft that could affect the electromagnetic environment Crew Instructions and Manuals In case there are safety mitigations that require crew response, relevant Crew Manuals should contain appropriate instructions. If the flight deck crew needs to react in case one or more WOBAN nodes are not operational, or if the network performance will be below a predefined minimum, then a warning would be presented to the flight crew. The Flight Crew Operation Manual shall contain an associated activity in response of such a warning. Similarly, the cabin crew may be informed by messages to the cabin display systems (attendance panels). If a failure will degrade the operation and capability of the aircraft, it should be included as a limitation in the Aircraft Flight Manual. Instructions should be provided to the cabin crew in the case of external interference to the WOBAN system, for example on-board jammers activated by passengers. In such a case the cabin crew may be assisted by tools to determine the source of jamming. Usage of such additional tools would require additional user manuals and training material. However, it should be underlined that any crew interaction should only be introduced if such measures are indispensable. Consideration should be given to the recording of status messages and misbehavior of the network by the aircraft maintenance system or other recording means Maintenance Manual Any specific maintenance activities that need to be carried out should be documented in a maintenance manual. The maintenance manual should identify what activities need to be performed and how often. For example: It may be necessary to periodically check that all the wireless WOBAN communication links have an acceptable performance, including sufficient link margin. If the WOBAN system installation makes use of directional antennas for transmission and/or reception (either as separate antenna or as antenna integrated into the WOBAN node) and there is a possibility for any misalignment of these antennas due to inadvertently wrong orientation or location following a repair, the manual should provide guidance on how to correctly install and align the WOBAN components. If the network performance needs to be re-assessed following a repair or an aircraft re-configuration, guidance on how this should be done should be provided. For each error indication collected by the on-board maintenance system an appropriate recovery or repair instruction should be included in the Aircraft Maintenance Manual.

30 29 To maintain appropriate protections towards cyber security, the software of WOBAN components should be updated as soon as the Certification Applicant will make them available. The maintenance organization of the operator should follow instructions of protected procedures for such software updates. Other means or instructions, addressing cyber security, should be followed (refer to paragraph ).

31 30 CHAPTER 4 GUIDANCE ON DEVELOPMENT PROCESS REQUIREMENTS 4.1 INTRODUCTION The use of WOBAN systems introduces new challenges which must be considered during system development and airworthiness certification. While many aspects of the traditional system development process depicted in FIGURE 7 are covered by existing certification material, the development of WOBAN systems requires additional certification activities related to the use of wireless communications. The requirements associated with these activities can be divided into the following categories: Radio regulatory requirements: Requirements imposed by the radio regulatory framework applicable for the countries/regions in which a WOBAN system equipped aircraft is operated Wireless communication requirements: Requirements on the performance of the wireless communication services provided by a WOBAN system Protection requirements: Requirements on EMC, Human Health and Security of a WOBAN system This chapter proposes requirements to be imposed onto WOBAN systems for each of the above categories which should be considered during system development and the airworthiness certification process. The proposed requirements are not covered by existing certification material. CHAPTER 5 proposes means to validate that a given WOBAN system is able to meet the requirements that are presented in the remainder of this chapter. General System Development Aircraft Level Requirements Allocation of Aircraft Functions to Systems Development of System Architecture System Implementation System/Aircraft Level Integration & Verification Ready for Certification Additional Certification Activities Guidance on Development Process Requirements (see Chapter 4) FIGURE 7: Guidance on development process requirements for WOBAN systems 4.2 RADIO REGULATORY REQUIREMENTS The use of RF spectrum is strictly regulated on national, regional and global levels. General information on the principles of regulating access to RF spectrum is provided

32 31 in Appendix B to this PS. This section summarizes radio regulatory requirements for two distinct regulatory regimes which particular WOBAN system implementations may encounter WOBAN systems operated under the regulatory provisions for WAIC systems The following paragraph addresses WOBAN systems operated under the regulatory provisions for WAIC systems within the aeronautical mobile (route) service allocation in the frequency band MHz (see also Appendix B section B.2.1). The International Telecommunication Union (ITU) [29], a United Nations Specialized Agency, is responsible for maintaining the rules governing the use of radio frequency spectrum at an international level. These rules are contained in an international treaty text known as the Radio Regulations (RRs) (see Appendix B) [30]. The RRs provide specific provisions in form of an aeronautical mobile (route) service (AM(R)S) allocation in the frequency band MHz, exclusively reserved for safetyrelated radio communications between aircraft stations on board the same aircraft, known as Wireless Avionics Intra-Communications (WAIC). An AM(R)S frequency allocation is also referred to as an aeronautical safety allocation which receives the highest possible level of regulatory protection against harmful interference from other radio frequency spectrum users within and adjacent to the allocated frequency band. Besides the level of regulatory protection that the AM(R)S allocation provides for WAIC, the frequency band and the conditions for its use are also harmonized across large parts of the world, i.e. among member states of the International Civil Aviation Organization (ICAO). This results in a considerable simplification for the airworthiness certification and transmitter licensing processes of a WOBAN system that operates in the WAIC frequency band compared to a WOBAN system that operates in any other non-aeronautical and non-safety frequency band (see section 4.2.2). The Certification Applicant in this case should provide evidence as specified in section WOBAN systems operated within non-aeronautical frequency bands on the basis of non-interference and non-protection It is possible to implement WOBAN systems in frequency bands for which access is provided by telecom authorities on the basis of non-interference and non-protection (see Appendix B, section B.2.2). This means that radio equipment accessing such a frequency band has to comply with certain minimum requirements ensuring that other users of the same frequency band are granted access on a fair and equal basis. This principle is referred to as operation on the basis of non-interference (see also the discussion on coexistence in section and the discussion of regulatory regimes in Appendix B, section B.3). Such regulatory provision does also not provide any guarantee for freedom from harmful interference. This principle is referred to as operation on the basis of non-protection. The Certification Applicant in this case should provide evidence as specified in section Radio License Considerations Operating a radio transmitter generally requires authorization through the responsible telecom authorities of the countries in which the WOBAN system is operated. Generally, the operator of the aircraft is legally responsible for ensuring such proper authorization of all RF transmitters operated on board its aircraft. This includes all WOBAN system s transmitters. Depending on the licensing regime applicable in a given frequency band and country (see Appendix B), the actual authorization process varies in complexity. For the case of a WOBAN system that is operated under the regulatory regime put in place for WAIC (see above), the aircraft operator only needs to seek authorization through the telecom authority responsible for the country of aircraft registration. The provisions in Article 30 of the Convention of International Civil Aviation (the ICAO Convention) [48] ensure mutual recognition of this authorization among all ICAO member states.

33 32 For the case of a WOBAN system that is operated in a non-aeronautical frequency band the aircraft operator has to seek operational authorization individually from all of the national telecom authorities of all countries in which the aircraft is expected to operate. 4.3 WIRELESS COMMUNICATION REQUIREMENTS Performance and reliability of wire-based avionic networks have been proven through many years of service. The introduction of WOBAN systems using wireless communications for interconnecting avionic systems presents new challenges that have to be assessed. These challenges arise from the following characteristics of wireless communications which differentiate WOBAN systems from wired avionic networks: Wireless communication is performed over an open medium, the radio channel. Therefore, in contrast to wire-based communication systems, wireless communication systems are vulnerable to external sources of interference, e.g., equipment on board aircraft intentionally or unintentionally transmitting signals in the same frequency range. The radio channel characteristics are subject to spatial and temporal variations caused by, e.g., multipath fading and shadowing effects, as well as time-variant modifications of the environment such as moving transmitters, receivers or objects in the radio propagation path. These channel variations may impact the reliability of a wireless communication link. This section proposes requirements which are intended to ensure that wireless communication capabilities provided by WOBAN systems meet the requirements imposed by the aircraft function(s) that make use of them. The corresponding requirements are categorized into three groups as depicted in FIGURE 8: Requirements on application level, Requirements on network level and Requirements on environmental level Requirements on application level concern aspects relevant for ensuring that a particular application is operating in accordance with its performance standards. Requirements on network level relate to the proper functioning of a WOBAN system that provides services to multiple different applications, each with different requirements. Requirements on environmental level relate to the radio frequency propagation environment including coexistence with other radio systems. Paragraph 5.2 provides guidance on the verification of these requirements.

34 33 Requirements on Application Level Aircraft Function(s) Application Application FIGURE 8: Categorization of wireless communication requirements Requirements on Application Level Data Rate Jitter Latency Requirements on Network Level Requirements on Environment Level A WOBAN system may provide wireless communications for different applications and respective aircraft functions. Each of these applications could have different communication requirements. The Certification Applicant should provide evidence to the Certification Authority that the WOBAN system under consideration meets the individual requirements of each application using the network. Communication requirements on application level should include but are not limited to those requirements addressed throughout paragraphs to A WOBAN node connected to an application is required to receive and/or transmit data at a certain rate. The certification evidence should show that the minimum data rate required by an application can be provided and maintained by the connected WOBAN node under all operational conditions of the WOBAN system. Applications in a WOBAN system may have different requirements on the maximum tolerable jitter of data communication. The certification evidence should prove that the individual jitter boundaries of each application using the WOBAN system are met under all operational conditions. Applications in a WOBAN system may have different requirements on the maximum tolerable latency of data communication. The certification evidence should show that the individual latency boundaries of each application using the WOBAN system are met under all operational conditions Communication Outage WOBAN Node WOBAN Environment Transmission Channel WOBAN Node Wireless communication systems operating cofrequency The reliability of wireless communications is influenced by environmental factors potentially degrading the performance of a WOBAN system. Performance degradation can cause a violation of the data rate, jitter and latency requirements described above. Such a violation is considered an outage of communication. Applications may accept communication outages (that have a defined probability of occurrence and maximum outage time) depending on the safety criticality of the

35 34 overlaying aircraft function(s). The certification evidence should show that a maximum tolerable outage time is not exceeded in all operational scenarios for X per cent of the time, where X is dependent on the application Requirements on Network Level Failure Propagation A WOBAN system and its components should provide segregation of data traffic of different applications as required, preventing failures in one application from impacting the data traffic of other applications. The Certification Applicant should provide evidence to the Certification Authority substantiating that segregation of data traffic communicated in the WOBAN system is provided as required. Refer also to paragraph Network Management Function Network Recovery A WOBAN system should include dedicated functionality responsible for managing the network. This network management functionality should have the following capabilities: Coordination of wireless communication of all nodes inside the WOBAN system during its operation, Built-In self-testing functionality allowing the Certification Applicant to validate that the requirements on application level described in paragraph and environment level described in paragraph can be met during operation of the WOBAN system, Monitoring of the communication performance during the operation of the WOBAN system, Capability to identify degradations in wireless communication performance and, if appropriate, to report them, Appropriate interfaces to support maintenance and configuration of the WOBAN system by maintenance personnel, Means for granting network access to guest nodes as required. These means should ensure that guest nodes don t compromise operation of WOBAN system and Means to monitor the availability of installed WOBAN nodes (both fixed and movable nodes) on a periodic basis. Monitoring is required to ensure that nodes are physically present and that they have not been removed from the aircraft. The certification application should provide evidence that the network management function of the WOBAN system includes the above capabilities as required. A WOBAN system should be able to recover from a temporary loss of any of its communication links. The Certification Applicant should provide evidence to the Certification Authority substantiating that the WOBAN system is able to recover from a temporary loss of any of its communication links Spectrum Management A WOBAN system should include means for efficient management of the use of the available radio frequency spectrum including but not limited to: An efficient channelization scheme, Adaptable RF output power levels and Efficient modulation techniques.

36 Requirements on Environmental Level Radio Channel Characteristics Coexistence The radio channel has a significant impact on the performance of wireless communications. Moreover, its characteristics can change over time, e.g., due to passenger or cargo movement. However, a WOBAN system must provide wireless communications that meet the application requirements defined in section The Certification Applicant, the WOBAN System Integrator and\or the WOBAN Component Developer should assess the radio channel characteristics present in the operational environment of the WOBAN system. The assessment should take all dynamic influences into account which arise during operation of the WOBAN system. The assessment results should provide sufficient evidence to certification authorities ensuring that the dynamic nature of the radio channel does not cause a violation of application requirements in any operational condition of the aircraft. In accordance with the IEEE Standard this PS defines coexistence as: [ ] the ability of one system to perform a task in a given shared environment where other systems have an ability to perform their tasks and may or may not be using the same set of rules. In consequence, coexistence relates to the ability of WOBAN systems to operate in an environment shared with other radio systems: intentionally using the same frequencies within mutual interference range that are operating at the same time. Arising coexistence scenarios can be characterized by the area of operation, the type of radio systems operating co-frequency and the entities managing the use of the shared environment. These entities are: The Certification Applicant controlling the use of all radio systems installed on board the aircraft equipped with the WOBAN system under consideration, the Aviation authority approving the operational use of aeronautical radio systems (e.g. WAIC) based on standards such as ICAO Standards and Recommended Practices (SARPs) and EASA/FAA European Technical Standard Orders / Technical Standard Orders (ETSOs/TSOs), which may refer to one or more Minimum Operational Performance Standard(s) (MOPS), Telecom authorities regulating the use of radio frequency spectrum. The Certification Applicant should provide evidence that the WOBAN system under consideration can coexists with other radio systems using the same frequencies within mutual interference range. This evidence should be generated for all applicable scenarios listed TABLE 1. Nr Area of operation Type of radio system(s) operating co-frequency with WOBAN system Entities managing the use of the shared environment 1 Operated on board same aircraft WOBAN system Certification Applicant Aviation Authorities (if applicable) Telecom Authorities 2 Radio system part of the aircraft configuration (e.g. Wireless Passenger Connectivity Systems or Radio Altimeters) Certification Applicant Aviation Authorities (if applicable) Telecom Authorities

37 36 Nr Area of operation Type of radio system(s) operating co-frequency with WOBAN system Entities managing the use of the shared environment 3 Radio system not part of the aircraft configuration (E.g.: T-PEDs) Telecom Authorities 4 Operated on board different Aircraft WOBAN system Aviation Authorities (if applicable) Telecom Authorities 5 Radio system part of the aircraft configuration (E.g. Wireless Pax Connectivity Systems or Radio Altimeter) 6 Radio system not part of the aircraft configuration (E.g.: Passenger owned T- PEDs) 7 Operated off board aircraft Radio systems used for aviation purposes (E.g. WLAN at Airports) 8 Radio system used for nonaviation related purposes 4.4 PROTECTION REQUIREMENTS Aviation Authorities (if applicable) Telecom Authorities Telecom Authorities Aviation Authorities (if applicable)- Telecom Authorities Telecom Authorities TABLE 1: Possible Coexistence Scenarios Since the WOBAN system makes use of an open and shared medium, i.e. the radio channel, the system interactions with the environment can be significant. Therefore, the Certification Applicant has to demonstrate that the WOBAN system is protected from unauthorized interactions with the radio channel and that the WOBAN system tolerates the environment and does not interact with it in an undesirable manner. The protection means are based on certification requirements which were introduced in paragraph The main protection requirements are discussed in paragraphs through below Protection of the aircraft against WOBAN system s electromagnetic emissions The WOBAN system s intentional and non-intentional electromagnetic emissions should not adversely affect other aircraft systems. The Certification Applicant should demonstrate compliance as defined in paragraph Protection of humans against WOBAN system s electromagnetic emissions The WOBAN system s electromagnetic emissions shall under no circumstances lead to any impairment of health for the aircraft occupants. The Certification Applicant should demonstrate compliance as defined in paragraph Protection of the WOBAN system against electromagnetic emissions from the aircraft The WOBAN system should meet its intended performance when exposed to intentional and non-intentional electromagnetic radiation stemming from other systems of the aircraft. The Certification Applicant should demonstrate compliance as defined in paragraph

38 Protection of the WOBAN system against malicious human interaction - Cyber Security - The WOBAN system must be protected against unauthorized access to aircraft data. The Certification Applicant should demonstrate compliance as defined in paragraph Protection of the WOBAN system from physical access by non-authorized persons Sensitive components of the WOBAN system, such as WOBAN nodes and their transmit and receive antennas, should be protected against physical access by nonauthorized persons in order to prevent manipulation and signal blockage. Furthermore, measures should be taken to maintain a minimum separation between these components and any equipment or object which could block signal propagation within the WOBAN system. The Certification Applicant should demonstrate compliance as defined in paragraph Protection of the aircraft its crew and passengers from threat caused by use of Lithium batteries The use of wireless communications systems such as WOBAN systems may require the use of autonomous power supplies (i.e. batteries) for its components. The Certification Applicant should demonstrate compliance as defined in paragraph VALIDATION OF REQUIREMENTS Validation of requirements and specific assumptions is the process of ensuring that the specified requirements are correct and complete so that the product will meet applicable airworthiness requirements. Validation is a combination of objective and subjective processes. While the format of the validation effort is left to WOBAN Component Developer, the Application Developer and the Certification Applicant, a structured process should be defined in the Validation Plan. Particular guidelines for the Validation Plan of system requirements are defined in ED-79 [4] / SAE ARP 4754 [25]. From the point of view of facilitating a smooth development process, requirements should be validated before design implementation commences. However, in practice, particularly for complex and integrated systems like a WOBAN system, the necessary visibility of the whole set of consequences that flow from the requirements may not be obtainable until the system implementation is available and can only be tested in its operational context. In consequence, validation is normally a staged process continuing through the development cycle. At each stage the validation activity provides increasing confidence in the correctness and completeness of the requirements. The validation process at each level of the requirements hierarchy should involve all relevant technical disciplines, including the safety assessment process. Experience indicates that careful attention to requirements development and validation can identify subtle errors or omissions early in the development cycle and reduce exposure to subsequent redesign or inadequate system performance. Individual tests may simultaneously serve the purposes of verification as well as validation when the system implementation is used as part of the requirements validation process. One purpose of this activity is to check that the requirements are met by the implemented system, while a separate purpose is checking that the requirements are appropriate to the context in which the system is operating. Such dual purposes should be reflected by coordination of the verification and validation plans.

39 38 CHAPTER 5 GUIDANCE ON REQUIREMENT VERIFICATION This chapter provides guidance on the verification of requirements introduced in CHAPTER 5. The verification means proposed in the following particularly address aspects related to use wireless communications, which are not covered by existing certification guidelines. Allocation of Aircraft Functions to Systems FIGURE 9: Guidance on requirement verification for WOBAN systems 5.1 RADIO REGULATORY REQUIREMENTS VERFICATION WOBAN systems operated under the regulatory provisions for WAIC systems With regards to the airworthiness certification and transmitter licensing processes for WOBAN systems operating under the regulatory provision in place for WAIC, the Certification Applicant should provide evidence proving, that: the WOBAN system implementation compiles with the provisions within the RRs for operating WAIC systems in the frequency band MHz (including applicable Recommendations and Resolutions referred to therein); the WOBAN system implementation complies with applicable international aeronautical standards. These standards are usually Standards and Recommended Practices (SARPs) issued by the International Civil Aviation Organization (ICAO) and Minimum Operational Performance Standards (MOPS) issued by international aeronautical standards bodies such as EUROCAE and RTCA. NOTE: General System Development Aircraft Level Requirements Development of System Architecture System Implementation System/Aircraft Level Integration & Verification Ready for Certification Additional Certification Activities Guidance on Requirement Verification (see Chapter 5) At the time of development of this EUROCAE PS neither SARPs nor MOPS for WAIC exist. It is expected that such standards will be developed by the responsible organizations.

40 WOBAN systems operated within non-aeronautical frequency bands on the basis of non-interference and non-protection With regards to the airworthiness certification and transmitter licensing processes for WOBAN systems operating in non-aeronautical frequency bands on the basis of noninterference and non-protection, the Certification Applicant should provide evidence proving, that: airborne use of the frequency band intended for operating the WOBAN system is not prohibited by telecom authorities of all countries in which the aircraft is expected to operate; the technical properties of the WOBAN system comply with the regulatory provisions as well as the technical and operational conditions in force for the intended operational frequency band in all countries in which the WOBAN system is expected to operate. (e.g. through demonstration of conformity to the applicable requirements of the ETSI harmonized standard for the respective radio communication application and frequency band [49] and applicable FCC Rules CFR Title 47 Part 15 requirements [46], [50]); in cases when the aircraft enters the territory of a country which has not authorized WOBAN system operation in the intended frequency band, that the WOBAN system ceases operation (i.e. it stops RF transmissions). 5.2 WIRELESS COMMUNICATION REQUIREMENTS VERIFICATION Wireless communication links inside a WOBAN system must meet the requirements of the applications making use of them. In contrast to wire-based communication systems, WOBAN systems use a wireless communication medium which is: an open resource, potentially used by other WOBAN systems and/or other radio systems and which is subject to environmental factors that can influence the RF environment. In consequence, the RF environment may change subject to aircraft operational conditions, which may impact the performance of the WOBAN system. These changes may result from e.g.: moving objects such as passengers, luggage or cargo, presence of interference sources such as other WOBAN systems, on-board T- PEDs or other transmitting equipment on ground, changes in the aircraft interior that affect the RF propagation such as cabin layout modifications. Hence, verification of requirements on the wireless communication performance of a WOBAN system, as described in paragraph 4.3, should be performed with respect to possible changes of the RF environment that occur during the operation of an aircraft. This section provides guidance on the verification of requirements on the wireless communication performance of a WOBAN system that accounts for the time-variant nature of the RF environment influencing the wireless communications. The methods for requirement verification proposed in the following are based on a combination of: Aircraft-level Verification, Component-level Verification and Model-based Verification. Generally, aircraft-level verification as part of Task 4 defined in section 3.2 is considered mandatory for acquiring approval of a WOBAN system. However, it might not be feasible to test the WOBAN system behavior against all possible conditions of the RF environment. Thus, additional certification evidence not covered by the aircraftlevel verification may be required. Additional certification evidence may have to be produced by a combination of WOBAN component-level and model-based verification, as depicted in FIGURE 10 below. Modelling assumptions as well as test environments and tools used for this purpose should be recognized by the Certification Authority and should meet the

41 40 requirements introduced in paragraph 4.3. This particularly concerns assumptions on RF environment and interference sources within the operational frequency band of the WOBAN system. The following sections provide a brief description of the verification of requirements on applications level using the methods introduced above. A more elaborated example explaining how these methods can be used to support the approval of a WOBAN system is given in Appendix E. Requirement verification on application level Application Model-based verfication Aircraft function(s) RF environment WOBAN Aircraft-level verification FIGURE 10: Application requirement verification Application Data Rate, Jitter and Latency Requirements Verification The Certification Applicant should provide evidence that the WOBAN system is capable of simultaneously serving all applications assigned to the WOBAN system while meeting the data rate, latency and jitter requirements of each of these applications. This evidence can be provided by means of testing of the WOBAN system within the aircraft and a representative RF propagation environment. In addition, a combination of model-based and component-level performance verification may be used to account for RF propagation conditions not covered by aircraft-level verification as described in Appendix E Application communication Outage Requirement Verification Application Componentlevel verification The Certification Applicant should provide evidence that the communication outage requirements of all applications served by the WOBAN system are met. Since communication outage is a statistical measure of the quality of communication in a wireless network, its verification relies on an extensive observation of a significant amount of communications events (i.e. transmitted application messages) within the WOBAN system. Making such extensive observations by testing is often impractical and their statistical relevance is questionable. Hence, evidence for communication outage may be provided on the basis of model-based analysis of the relevant parts of the WOBAN

42 41 system, taking into account the installed configuration and the electromagnetic environment in which it is intended to operate. 5.3 PROTECTION REQUIREMENTS VERFICATION Protection of the aircraft against WOBAN system s electromagnetic emissions The Certification Applicant should demonstrate compliance to applicable EMC requirements (refer also to paragraph ) for the case of non-intentional radiation. With respect to intentional radiation of the WOBAN system, the Certification Applicant should demonstrate through analysis or testing, that other aircraft systems are not interfered with and are continuing to meet their intended performance (see also Appendix F) Protection of humans against WOBAN system s electromagnetic emissions Human health can be affected by electromagnetic radiation. The Certification Applicant should demonstrate that the electromagnetic radiation from the WOBAN system will not exceed the safe limits for exposure of the general public to electromagnetic fields published by the International Commission on Non-Ionizing Radiation Protection [28]. This can be achieved, e.g., by setting proper transmit power levels and/or by introducing means which ensure a minimum separation between the radiating elements of the WOBAN system and a human being, e.g., through the use of physical separators (refer also to paragraph ) Protection of the WOBAN system against electromagnetic emissions from the aircraft The Certification Applicant should demonstrate that the WOBAN system is adequately protected against intentional and non-intentional electromagnetic emissions from other aircraft systems. Protection against non-intentional electromagnetic radiation is usually demonstrated through electromagnetic susceptibility testing as specified in ED-14 [3]. The protection of a WOBAN system against intentional electromagnetic emissions from other aircraft systems (e.g., WAIC systems that share a frequency band with radio altimeters) can be achieved by properly chosen coexistence mechanisms (see also paragraphs , and Appendix F) Protection of the WOBAN system against malicious human interaction - Cyber Security - The Certification Applicant should demonstrate compliance with the requirements derived from the security assessment performed. The guidance provided in ED202A [9] should be followed (refer also to paragraph ). In Appendix G some WOBAN system specific security measures are described as example cases Protection of the WOBAN system from physical access by non-authorized persons The Certification Applicant should demonstrate that physical access to the WOBAN system and its components or the intentional blocking of a wireless communication link of the WOBAN system has been taken into consideration during the system design and is satisfactory for the certification authorities (refer also to paragraph ). In order to increase the difficulty to directly access WOBAN nodes, the following measures might be considered: WOBAN nodes might be placed in an area, which is not readily accessible to passengers. Physical access to the nodes might be restricted by technical measures, i.e. by two-factor authentication, a key or key-card, etc. Signs might indicate that access to the respective items (i.e. WOBAN nodes) is prohibited for passengers. Access to the nodes might be monitored and any unauthorized opening should be indicated to the crew.

43 42 In order to increase the difficulty of intentionally inhibiting the WOBAN communication links of a WOBAN system, the following measures might be considered: Design rules to guarantee minimum distances between passenger items and WOBAN nodes, e.g. spacing in the lining and housing, Crew instructions to check the surroundings of WOBAN nodes in the cabin for items, which do not belong there Protection of the aircraft its crew and passengers from threat caused by use of Lithium batteries The Certification Applicant should demonstrate compliance with RTCA DO-347 Certification Test Guidance for Small and Medium Sized Rechargeable Lithium Batteries and Battery Systems [24] (refer also to paragraph ).

44 Type Airline Networks for passengers, crew and maintenance NOTE: Application Group Commercially driven applications for passenger usage of extended IFE, or connectivity services (Internet access) Crew and operators applications to support operational services Maintenance terminals connected to aircraft access points for maintenance/ inspection/ troubleshooting purposes 43 APPENDIX A TYPES OF USE CASES FOR WIRELESS COMMUNICATION ON BOARD AIRCRAFT grey-shaded applications groups are out of scope of this Process Specification; However, they are mentioned here in order to list all possible use cases of wireless networks on board aircraft Members / Examples Cabin WLAN systems for passengers, T-PEDs Wireless EFB, Cabin Operation Applications Portable Maintenance Terminals Certification Aspects Wireless technology Radio Regulatory Aspects Common Certification Requirements apply (mainly installation related; CS (a)(2)) Used for non-aeronautical purposes, without impacts for safe flight and landing. Performance and availability are not certification relevant. Equipment approval may be obtained through ETSO-2C514 AIRBORNE SYSTEMS FOR NON REQUIRED TELECOMMUNICATION SERVICES (IN NON AERONAUTICAL FREQUENCY BANDS) (ASNRT) Some applications may require an operational approval from national aviation administration before it will be activated by the operator. IEEE WLAN Standards: IEEE b/g 2.4 GHz (ISM) IEEE p/j/n 2.4 GHz (ISM) & 5 GHz (RLA N) bands License exempt operation Caution: No global harmonization of operational conditions in 5GHz bands. Interoperability defined by IEEE standards and Wi-Fi-Alliance.

45 Type WOBAN-NAS (Non- Aeronautical Standard) WOBAN / Wireless Avionics Intra- Communications System (WAIC) Application Group On-board communication between approved aircraft parts Members / Examples Members are installed as certified equipment covered by a Type Certificate (TC), Design Change to TC, or Supplemental TC. Examples: wireless temperature sensor network; wireless tire pressure sensor system. 44 Certification Aspects Wireless technology Radio Regulatory Aspects Common Certification Requirements apply (CS (a)). Guidance is given by this PS. Justification of impacts for operation of the aircraft and safe flight and landing. An application has to tolerate communication link performance degradation, which may include temporary loss of the network. It requires appropriate safety mitigations (e.g. backup) if used for communication links contributing to effects for safe flight and landing. Equipment approval may be obtained through ETSO-2C514 AIRBORNE SYSTEMS FOR NON REQUIRED TELECOMMUNICATION SERVICES (IN NON AERONAUTICAL FREQUENCY BANDS) (ASNRT) Common Certification Requirements apply (CS (a)). Guidance is given by this PS. WAIC network shall only be used for aeronautical related communications functions contributing to aircraft safety. Safety mitigations would still be required IEEE WLAN Standards: IEEE b/g 2.4 GHz (ISM) IEEE p/j/n 2.4 GHz (ISM) & 5 GHz (RLAN) bands ITU WRC-15 decision: 4.2 to 4.4 GHz (also used for radio altimetry) License exempt operation Caution: No global harmonization of operational conditions in 5GHz bands. Interoperability defined by IEEE standards and Wi-Fi-Alliance Licensed operation Globally harmonized operational conditions in aeronautical frequency band reserved for Wireless Avionics Intra-

46 Type Application Group Members / Examples portable attendant devices (e.g. flight attendant control panel) 45 Certification Aspects Wireless technology Radio Regulatory Aspects depending on the network s contribution of impacts for safe flight and landing. MOPS Standard for Wireless Avionics Intra- Communications (WAIC) systems within MHz (EUROCAE WG- 96/RTCA SC-236), expected publishing in ETSO/TSOs are envisaged for WAIC network components. Communications (WAIC) Internationally accepted aeronautical standards apply via ITU/ICAO

47 46 APPENDIX B RADIO REGULATORY FRAMEWORK B.1 RADIO REGULATIONS B.1.1 The electromagnetic radio-frequency (RF) spectrum is a finite natural resource that can neither be modified nor extended. Given its high economical relevance, countries reserve their rights in governing the use of the RF-spectrum within their national territories. However, electromagnetic waves do not stop at national borders, hence, the international coordination of its use is essential to avoid potential conflicts. Given the global nature of air transportation this is particularly true for airborne use of RFtransmitters and receivers. Global Radio Regulations Since 1932 rules governing the allocation and international coordination of RFspectrum have been the subject of inter-governmental conferences under the auspices of the International Telecommunication Union (ITU) [29], a specialized agency recognized by the United Nations. The recognized competence of the ITU embraces all aspects of telecommunications, whether by line (i.e. wire) or by radio transmission. The ITU has the authority to set standards for systems, technical parameters and procedures. The agreements made under its auspices for these matters are incorporated in the Final Acts of World Radiocommunication Conferences (WRCs) (prior to 1993 known as World Administrative Radio Conferences (WARCs)) are accorded treaty status and have full mandatory force without any possibility for variation in regard to their scope or their substance except by agreement at a further conference. Treaty requirements are exercised through the Radio Regulations (RRs) [30], parts of which are reviewed at WRCs held approximately every four years. Within the RRs, the finite useable RF-spectrum, from currently 8.3 khz to 275 GHz, is allocated to user services in response to their recognized demands, and among three world regions in accordance with the major regional use (refer also to [30]). These provisions (allocations) are contained in Article 5 of the RRs which, together with the other provisions on licensing, interference resolution, safety and distress procedures and other aspects, are the treaty requirements. FIGURE 11: Map of ITU world regions