Global Aircraft Tracking Team Requirements Overview

ARINC Airline Electronic Engineering Committee (AEEC) Systems Architecture and Interfaces (SAI) Subcommittee Global Aircraft Tracking (GAT) Team Requirements Discussions/Issues Overview August 31, 2017 Rev NEW Charles Adler, Project Engineer Boeing Commercial Airplanes, Avionics (charles.o.adler@boeing.com) Cell: 206-578-2533

Phased Approach to Autonomous Distress Tracker (ADT) and Timely Recovery of Flight Data (TRFD) Typical Participation Demographics Telecon 2 (2017-05-22) Telecon 3 (2017-05-31) Telecon 4 (2017-06-07) EUROCAE ED-237, EU and EASA Rules Date GADSS CONOPS Draft 5.11 ICAO Annex 6 and Annex 11 Subjects Discussed # of # of # of # of # of # of Organization Participants Organizations participants Organizations participants Organizations 6 9 3 6 9 3 11 5 12 2 1 3 34 3 3 9 2 1 2 6 4 3 4 Airframer Airline/Air Freight Avionics Supplier Other Regulatory/Government Service Provider 12 4 21 5 1 4 41 12 3 1 3 26 3 1 34 22 20 Totals

GAT Team Requirements Discussions/Issues (1 of 4) Tamper-Proof (explicit unlawful behavior removed in CONOPS 6.) A. 1) Appendix C scenarios (2.6 and 2.7) strongly imply this is a significant consideration 2) Concern is that regulators will add this back to local/regional requirements. 3) Truly adversarial crew is possible, but is very small % of cases 4) At some level of control of aircraft systems, tamperproof cannot be guaranteed. This adds significant complexity to systems without guarantee of security. 5) Some moderate level should be relatively supportable and may be consistent with human factors considers (e.g. cannot be turned off by flight deck controls) see for example: the EuroCAE regulation 2015/2338: 1) "Whenever possible, the aircraft tracking means should be robust to loss of normal electrical power on board and should not offer any control to disable it during the flight." 6) Our current assumptions are: Uncooperative but non-adversarial crew 7) Security as a more general consideration especially if we add in a ground uplink to the aircraft.

GAT Team Requirements Discussions/Issues (2 of 4) B. Power Resilience (1 of 2) The onboard component of the ADT function will be designed such that, in the event of aircraft electrical power loss, it will continue transmitting for the expected duration of the remaining flight. 1) Concern is that implies a prescriptive battery sizing requirement e.g. potentially 20 hours to cover long haul flight Li-ion battery aircraft integration and certification with current FAA/EASA special conditions and methods of compliance is very challenging, even for simple configurations. Continuing high scrutiny/control/push-back by airframers to addition batteries, COSPAS-SARSAT has locked in 20 hours of flight 2) 3) Group has multiple perspectives a) Why not allow rechargeable batteries b) Some want the flexibility to develop airplane level solutions using diverse power sources and other methods in addition to batteries. c) Some see a long-life battery as the simplest, most robust way forward d) Another perspective; we have ELT stds already accepted is that the model we should be following? e) Maintain ability to utilize complementary capabilities (e.g. if ELTs are also available etc ), aircraft system level view

GAT Team Requirements Discussions/Issues (3 of 4) B. Power Resilience (2 of 2) 4) Tamper-proof requirements significantly impact this discussion. 5) Potential distress and abnormal modes on the advent of power loss at less then 1/min transmit rates may support reduced power consumption modes 6) One approach would be to develop a probabilistic requirement focused on the continuity (following the approach taken for ADS-B) to support continued functionality at airplane systems level approach, an example of this: 1) The transmission of aircraft distress tracking information required shall be capable of continuing its functioning for the expected remain duration of flight, in any foreseeable condition, with a probability of loss of functionality of less than 10^(-5)/flight hour 2) NOTE: In the condition to be analyzed is included systems failures, human factors aspects, and security aspects

GAT Team Requirements Discussions/Issues (4 of 4) A view of key assurance requirements: Integrity (system), Availability (detector logic), Continuity (transmitter and position source) C. System Integrity; Design Assurance Levels Our approach is to assume DAL D: a) Follows DAL levels for other localization and data recovery equipment, i.e. recorders b) If system fails, there is no safety implication -> this would be DAL E c) One perspective, failure condition is a minor nuisance (call-backs from AOC etc ) d) From quality considerations, we think that DAL D is applicable (but this is not unanimous) e) Would depend on implementation could be higher for example ADS-B is DAL C. D. Distress vs potential distress vs abnormal a) Potential benefits for having intermediate states b) Potential to take advantage of highly capable ground segments c) Potentially allows greater system integration approaches.

Discussions/Questions?