Requirement #

DO-306 ED 122 Safety Requirement Description

Status

Type of evidence collected

DO306 - ED 122 requirements allocated to the ATS Ground System

SR-1

An indication shall be provided to the initiator when a recipient rejects a data link service request at the application layer.
Note: Rejection can also occur in a communication layer. In this case, a message could be discarded before it is processed by the application

F

System (SSS) and air/ground server software (SRS) requirements of the TIARE system
Test results of the system requirements

SR-2

A detected loss of data link service shall be indicated to the controller/flight crew.

F

SSS and SRS (HMI) requirements of the TIARE system
Tests of these requirements

SR-3

Data link service shall be established in sufficient time to be available for operational use. 

F

Datalink service established at TIARE system startup

SR-4

ATSU shall be notified of planned outage of data link service sufficiently ahead of time. 

F

Contract with ACSP : Each planned outage is advertised 12 hours before by CSP Network Operations Center by fax and email
This procedure is effectively applied in case of outage

SR-5

There shall be an indication to the initiator when a message cannot be successfully transmitted.

F

Software requirements (air/ground server and HMI) of the TIARE system

SR-6

The end system shall provide unambiguous and unique identification of the origin and destination with each message it transmits.

F

Interface control document (ARINC 620 Data Link System Standard and Interface Specification) of the TIARE system with ACARS network

SR-7

A response shall indicate to which messages it refers.

F

SSS requirement of the TIARE system
Test results of these requirements

SR-8

The aircraft and the ATSU shall exchange via data link and process the same route information.

F

SSS requirement of the TIARE system
Test results of these requirements

SR-9

The end system shall time stamp to within one second UTC for each CPDLC message when it is released for onward transmission.

F

Ad hoc tests regarding Air/ground server

SR-11

Any processing (data entry/ encoding/ transmitting/decoding/ displaying) shall not affect the intent of the message. 

F

Messages encoded/decoded according to DO-219 - Minimum Operational Performance Standards for ATC Two Way Data Link Comms (TWDL) - prepared by: SC169
SWAL compliance of the air/ground datalink processor, FDP and HMI

SR-12

The end system shall reject messages not addressed to itself.

F

ACARS ICD
PSSA and SSA Reports
Air/ground server software requirements
TIARE system requirements
Test results of these requirements

SR-13

The initiator shall transmit messages to the designated end system.

F

Interface control document (ARINC 620 Data Link System Standard and Interface Specification) of the TIARE system with ACARS network

SR-14

The ATSU system shall indicate to the controller when a required response for a message sent by the ATSU is not received within the required time (ETTRN). 

F

TIARE system requirements
Operational manual of the SEAC-PF
Value of parameter ETTRN for TIARE CPDLC (CPDLC_PILOT_RESPONSE) set to 180 seconds

SR-15

When the end system receives a message whose time stamp exceeds ETTRN, the end system shall provide appropriate indication.
Note1: Appropriate indication may include the need for real time monitoring and alerting (such as via an uplink delay timer, see Table 4-4 and Table 4-8). This is determined based on further safety assessment and is a local matter. The safety assessment needs to consider message content, intended use, and environmental conditions that could potentially lead to an unacceptable risk of undetected late delivery of a message as determined by the continuity requirement.

F

ADS-C :
TIARE system requirements
Operational manual of the SEAC-PF
Value of parameter MPR-alert (FPL_ETO_REPPOINT) set to 360 seconds
Delta time after transmission time to reject a message if it had not been received (mn) = 10
CPDLC :
TIARE system requirements
Operational manual of the SEAC-PF
Value of parameter ETTRN for TIARE CPDLC (CPDLC_PILOT_RESPONSE) set to 180 seconds
Value of parameter CPDLC_CONTROLLER_RESPONSE set to 120 seconds

SR-16

The ATSU and aircraft end system shall prevent the release of clearance and operational responses without controller or flight crew action.

F

TIARE system requirements
Operational manual of the SEAC-PF (check of the intent of the message in preparation)

SR-17

The recipient system shall prohibit operational processing of corrupted messages. 

F

CRC implemented as per ARINC 622-2, ATS Data Link Applications Over ACARS Air-Ground Network.  Messages with invalid CRC are rejected

SR-18

The recipient shall be able to determine the message initiator.

F

SRS (HMI) requirements of the TIARE system
Ad hoc test with Air/ground server to ensure that AGDP CSCI identifies the which aircraft has initiated CMA, ADS-C and
CPDLC message

SR-19

The recipient system shall prohibit operational processing of messages not addressed to the recipient.

F

Safety check : messages are rejected at the ARINC 620 level if the address does not match offline predefined system addresses

SR-20

ATSU shall only establish and maintain data link services when the aircraft identifiers in data link initiation correlate with the ATSU’s corresponding aircraft identifiers in the current flight plan.

F

System (SSS) and air/ground server software (SRS) requirements of the TIARE system
Test results of the system requirements
Operational manual of SEAC-PF

SR-21

The aircraft identifiers used for data link initiation correlation shall be unique and  unambiguous (e.g. the Aircraft Identification and either the Registration Marking or the Aircraft Address) 

F

System (SSS) and air/ground server software (SRS) requirements of the TIARE system : coupling an aircraft with a flight plan requires matching the Callsign and either one of the following fields from the message with the corresponding fields in the flight plan:
− Registration Number; or
− Aircraft Flight Identification (ICAO 24 bit code).

SR-23

The ATSU shall not permit data link services when there are no compatible version numbers. 

F

System requirement of the TIARE system :  If CM logon is received with no compatible application, it shall be rejected: a warning shall be sent to the Operational Supervisor

SR-24

Messages shall be responded to in
their entirety.

F

Training of controllers

SR-25

The end system shall be capable of detecting errors that would result in mis-delivery introduced by the communication service.
Note: A number of algorithms exist that have demonstrated error detection at acceptable levels of integrity, such as those based on cyclic redundancy check (CRC) or Fletcher’s checksum. The specific algorithms found to be viable need to be defined in the Interoperability Standards appropriate for the technology used

F

CRC implemented as per ARINC 622-2, ATS Data Link Applications Over ACARS Air-Ground Network.  Messages with invalid CRC are rejected
Safety check : messages are rejected at the ARINC 620 level if the address does not match offline predefined system addresses

SR-26

The end system shall be capable of detecting errors that would result in corruption introduced by the communication service.
Note: A number of algorithms exist that have demonstrated error detection at  cceptable levels of integrity, such as those based on CRC or Fletcher’s checksum. The specific algorithms found to be viable need to be defined in the Interoperability Standards appropriate for the technology used.

F

System requirements (semantic checks shall be performed on each received message)
CRC implemented as per ARINC 622-2, ATS Data Link Applications Over ACARS Air-Ground Network.  Messages with invalid CRC are rejected