text: For the date of entry into force of this issue, kindly refer to Decision 2017/001/R in the Official Publication of the Agency. Page 1 of 20

text: Regulation (EC) No 216/2008

text: of the European Parliament and the Council of 20 February 2008 on common rules in the field of civil aviation and establishing a European Aviation Safety Agency, and repealing

text: Council Directive 91/670/EEC

text: Regulation (EC) No 1592/2002

text: and Directive

text: (OJ L 79, 19.3.2008, p. 1). 3

text: Regulation (EC) No 549/2004

text: of the European Parliament and of the Council of 10 March 2004 laying down the framework for the creation of the single European sky (the framework Regulation) - Statement by the Member States on military issues related to the single European sky (OJ L 96, 31.3.2004, p. 1). 4

text: Regulation (EC) No 550/2004

text: of the European Parliament and of the Council of 10 March 2004 on the provision of air navigation services in the single European sky (the service provision Regulation) (OJ L 96, 31.3.2004, p. 10). 5

text: Regulation (EC) No 551/2004

text: of the European Parliament and of the Council of 10 March 2004 on the organisation and use of the airspace in the single European sky (the airspace Regulation) - Commission statement (OJ L 96, 31.3.2004, p. 20). 6

text: Regulation (EC) No 552/2004

text: of the European Parliament and of the Council of 10 March 2004 on the interoperability of the European Air Traffic Management network (the interoperability Regulation) (OJ L 96, 31.3.2004, p. 26).

text: ) e g n a h c ty a ri f e o v s e e s c n ing e

text: s u Don’t

text: e Review

text: re s c n In o c e th

text: f Risk posed by (o change is ‘significant’

text: Increasing probability

text: (of a complex or unfamiliar safety (support) argument being developed)

text: ) nge Increasing ha Risk c ty a ri e of v s e e s Review nc ing ue s a q e re c In ons c e h t (of

text: Don’t Review

text: Risk posed by change is ‘significant’

text: Increasing probability (of an uncomplete and/or incorrect safety (support) argument being developed)

text: Don’t Review

text: Risk posed by change is ‘significant’

identifier: AMC & GM to Part-ATM/ANS.AR

nummer: part-atm-ans-ar

title: AMC & GM to Part-ATM/ANS.AR

text: European Aviation Safety Agency

text: Acceptable Means of Compliance (AMC) and Guidance Material (GM) to Part-ATM/ANS.AR Requirements for competent authorities — oversight of services and other ATM network functions

text: Initial Issue 8 March 2017

text: Annex II to ED Decision 2017/001/R

text: SUBPART A — GENERAL REQUIREMENTS (ATM/ANS.AR.A)

text: AMC1 ATM/ANS.AR.A.005(b) Certification, oversight and enforcement tasks

text: REVIEW OF THE AGREEMENT The agreement on the supervision in a functional airspace block (FAB) or in cases of cross-border provision should include the frequency of the review.

text: GM1 ATM/ANS.AR.A.005(b) Certification, oversight and enforcement tasks

text: CONCLUSION OF AN AGREEMENT The agreement on the supervision in a FAB or in cases of cross-border provision may be concluded among: (a) the competent authorities nominated or established under agreements concluded among Member States in accordance with

text: Article 2(3) of Regulation (EC) No 550/2004

text: ; or (b) the competent authorities of the service providers in cases of cross-border provision.

text: GM2 ATM/ANS.AR.A.005(b) Certification, oversight and enforcement tasks

text: REVIEW OF THE AGREEMENT During the review of the agreement, the competent authorities should address the practical implementation considering the results of the assessment performed in accordance with ATM/ANS.AR.C.001.

text: GM1 ATM/ANS.AR.A.005(c) Certification, oversight and enforcement tasks

text: COORDINATION ARRANGEMENTS BETWEEN COMPETENT AUTHORITIES FOR SELECTION AND REVIEW OF MULTI-ACTOR CHANGES (a) When the notification of a change to a service provider’s functional system indicates, as per AMC1 ATM/ANS.OR.045(a), that the change will affect the services provided by other service providers either directly or by affecting the context in which these services are delivered, these other service providers and the notifying service provider are participating in a multi-actor change. Some or all of these other service providers may also notify their competent authorities because they either have to make a reactive change or they are participating in a cooperative change to their functional systems. (b) If there are service providers participating in the multi-actor change who are proposing to make changes to their functional systems and are under the oversight of more than one competent authority, then the decision to review and the review itself of safety assessments and safety support assessments has to be a coordinated activity involving all the competent authorities that oversee the service providers participating in the multi-actor change. (c) Normally, competent authorities act independently when making decisions on how to select and review safety assessments, but in the case of multi-actor changes that cross State boundaries, the only way to ensure the effective selection and review of the notified changes is through coordination with other competent authorities. Coordination arrangements, which are difficult to define in advance, are to be established when the need arises. The objective of these agreements should be to ensure that the overall change is safe, i.e. the overall safety case is based on a complete and correct set of assumptions and mitigations and the associated risk assessments are valid. (d) The arrangements should ensure that:

text: Annex II to ED Decision 2017/001/R (1) the competent authorities involved evaluate in a harmonised way the risk posed by the change, and as a consequence there is an agreement on what safety (support) assessments will be reviewed by each competent authority; and (2) individual reviews of safety (support) assessments assure the necessary conditions are met, i.e. common assumptions and common mitigations are used correctly in each safety (support) assessment and the identified risks are valid. (e) However, the assurance that the set of common assumptions and common mitigations are complete and correct cannot be provided in each individual safety case. The argument for that assurance has to be made in an overall safety case and reviewed collectively by the competent authorities involved in the overall change. The form of this collective review should be included in the coordination agreement.

text: GM1 ATM/ANS.AR.A.015 Means of compliance

text: GENERAL Alternative means of compliance used by a competent authority or by organisations under its oversight may be used by other competent authorities or service providers only if processed again in accordance with ATM/ANS.AR.A.015(d) and (e).

text: AMC1 ATM/ANS.AR.A.015(d)(3) Means of compliance

text: GENERAL The information to be provided to other Member States following approval of an alternative means of compliance (AltMoC) should contain a reference to the acceptable means of compliance (AMC) to which such means of compliance provides an alternative, where such AMC exists, as well as a reference to the corresponding implementing rule (IR), indicating, as applicable, the point(s) covered by the AltMoC.

text: GM1 ATM/ANS.AR.A.020(b) Information to the Agency

text: MEANING OF SAFETY-SIGNIFICANT INFORMATION STEMMING FROM OCCURRENCE REPORTS The following should be considered safety-significant information stemming from occurrence reports: (a) Conclusive safety analyses that summarise individual occurrence data and provide an in-depth assessment of the safety issue. These safety analyses can be used for Agency regulatory activities or for safety promotion activities such as the European Plan for Aviation Safety; and (b) Individual occurrence data where the Agency is the competent authority.

text: GM2 ATM/ANS.AR.A.020(b) Information to the Agency

text: RECOMMENDED CONTENT FOR CONCLUSIVE SAFETY ANALYSES (a) The following content should be provided in conclusive safety analyses: (1) a detailed description of the safety issue, containing the scenario in which the safety issue takes place; and (2) an indication of the users affected by the safety issue, including types of services and organisations. (b) The content of such safety analyses may additionally include, as appropriate, the following: (1) a risk assessment quantifying the severity and frequency of the safety issue;

text: Annex II to ED Decision 2017/001/R (2) information about the existing safety barriers that the aviation system has in place to prevent the safety issue from releasing its likely consequences; (3) any mitigating actions already being in place or developed to deal with the safety issue; (4) recommendations for future actions to mitigate the reported safety issue; and (5) any other element the competent authority understands as essential in order for the Agency to properly assess the safety issue.

text: GM3 ATM/ANS.AR.A.020(b) Information to the Agency

text: REPORTING CRITERIA FOR SAFETY-SIGNIFICANT INFORMATION STEMMING FROM OCCURRENCE REPORTS WHERE THE AGENCY IS THE COMPETENT AUTHORITY In the case of occurrences related to organisations certified by the Agency, safety-significant information stemming from occurrence reports should be notified to the Agency if: (a) the occurrence is defined as a reportable occurrence for organisations certified as Pan-European service providers and service providers in the airspace of the territory to which the Treaty applies and having their principal place of operation or, if any, their registered office located outside the territory subject to the provisions of the Treaty; and (b) the competent authority has come to the conclusion that: (1) the organisation certified by the Agency to which the occurrence relates, has not been informed of the occurrence; or (2) the occurrence has not been properly addressed or has been left unattended by the organisation certified by the Agency. Such occurrence data should be reported in a format compatible with the European Coordination Centre for Accident and Incident Reporting Systems (ECCAIRS) and should provide all relevant information for its assessment and analysis, including necessary additional files in the form of attachments.

text: GM4 ATM/ANS.AR.A.020(b) Information to the Agency

text: EXCHANGE OF SAFETY-SIGNIFICANT INFORMATION WITH THE AGENCY A coordinator should be appointed by each competent authority, as appropriate, to exchange information regarding safety-significant information between the authority reporting the occurrence and the Agency.

text: GM1 ATM/ANS.AR.A.030 Safety directives

text: GENERAL (a) The safety directive is a document issued by the competent authority, mandating actions to be performed by one or more service providers, when evidence shows that aviation safety may otherwise be compromised. Thus, the competent authority is responsible for the determination of the actions required and their rationale. (b) The competent authority is required to perform a verification of compliance of the service providers with the safety directives in accordance with ATM/ANS.AR.A.030(d). In this respect, ATM/ANS.AR.C.005(a)(6) requires the competent authority to establish a process to verify the implementation of safety directives by the service providers. The actions that need to be taken depend on the content of the safety directive and the nature of the unsafe condition.

text: Annex II to ED Decision 2017/001/R

text: GM2 ATM/ANS.AR.A.030(b) Safety directives

text: CONTENT [Name of the competent authority] SAFETY DIRECTIVE SD No/ ISSUE No:[…] [Logo of the competent authority] Date: dd Month YYYY This Safety Directive is issued in accordance with Commission Implementing

text: Regulation (EU) 2017/373

text: [Identification of the affected [Name of the service provider(s)] functional system]

text: Safety Directive Title [Title]

text: [Describe the unsafe condition that is the reason for the Unsafe condition identified: issuance of the SD]

text: [Describe the required action(s) and their rationale; indicate the Required action(s), their rationale compliance time(s) within which the action(s) should be and compliance time(s): accomplished] Date of entry into force of SD: dd Month YYYY (a) [service provider(s) address: Post code, City Country Email address:…] Distributed to:

text: (b) [competent authorities concerned]

text: (c) [European Aviation Safety Agency] Remarks:

text: Annex II to ED Decision 2017/001/R

text: GM3 ATM/ANS.AR.A.030(c) Safety directives

text: FORWARDING OF SAFETY DIRECTIVES For instance, a safety directive that should be forwarded to the Agency under ATM/ANS.AR.A.030 could be a case: (a) where the competent authority has determined that there is an immediate need to take certain actions in order to respond to a safety recommendation; or (b) following an accident or serious incident; or (c) when this or a similar unsafe condition may be present in other service providers of the same Member State.

text: SUBPART B — MANAGEMENT (ATM/ANS.AR.B)

text: AMC1 ATM/ANS.AR.B.001(a)(2) Management system

text: QUALIFIED PERSONNEL The competent authority should: (a) define and document the education, training, technical and operational knowledge, experience and qualifications relevant to the duties of each position involved in oversight activities within their structure; (b) ensure specific training for those involved in oversight activities within their structure; and (c) ensure that personnel designated to conduct safety regulatory audits, including auditing personnel from qualified entities, meet specific qualification criteria defined by the competent authority. The criteria should address: (1) the knowledge and understanding of the requirements related to the services provision in ATM/ANS and other ATM network functions against which safety regulatory audits may be performed; (2) the use of assessment techniques; (3) the skills required for managing an audit; and (4) the demonstration of competence of auditors through evaluation or other acceptable means.

text: AMC2 ATM/ANS.AR.B.001(a)(2) Management system

text: TRAINING PROGRAMME AND RECURRENT TRAINING (a) The competent authority should establish a training programme for its personnel, including its inspectors for the oversight of services provision in ATM/ANS and other ATM network functions, and a plan for its implementation. The training programme should include, as appropriate to the role, current knowledge, experience and skills of the personnel, at least the following: (1) organisation and structure of the aviation legislation;

text: Annex II to ED Decision 2017/001/R (2) the Chicago Convention, relevant ICAO annexes and documents, the applicable requirements of 2 3 4

text: Regulation (EC) No 216/2008

text: , its IRs, as well as Regulations (EC) Nos 549/2004 , 550/2004 , 5 6 551/2004 , and 552/2004 and their IRs and related acceptable means of compliance (AMC), certification specifications (CSs) and guidance material (GM), as well as assessment methodology of the alternative means of compliance and the applicable national legislation; (3) the applicable requirements and procedures; and (4) areas of particular interest. (b) The training programme and the training plan should be updated, as needed, to reflect at least changes in aviation legislation and industry. The training programme should also cover specific needs of the personnel and the competent authority. (c) The competent authority should ensure that its personnel, including its inspectors for the oversight of services provision in ATM/ANS and other ATM network functions, undergo recurrent training at regular intervals as defined by the competent authority or whenever deemed necessary in order to keep being up to date.

text: GM1 ATM/ANS.AR.B.001(a)(2) Management system

text: SUFFICIENT PERSONNEL (a) This guidance material for the determination of the required personnel is limited to the performance of certification and oversight tasks, excluding personnel required to perform tasks subject to any national regulatory requirements. (b) The elements to be considered when determining required personnel and planning their availability may be divided into quantitative and qualitative: (1) Quantitative elements: (i) number of initial certificates to be issued; (ii) number of service providers certified by the competent authority; and (iii) number of flight information services providers having declared their activity to the competent authority. (2) Qualitative elements: (i) size, nature, and complexity of activities of service providers (cf. AMC1 ATM/ANS.OR.B.005(e));

text: Annex II to ED Decision 2017/001/R (ii) results of past oversight activities, including audits, inspections and reviews, in terms of risks and regulatory compliance: (A) number and level of findings; and (B) implementation of corrective actions; and (iii) size of the Member State’s aviation industry and potential growth of activities in the field of civil aviation, which may be an indication of the number of new applications and changes to existing certificates to be expected. (c) Based on existing data from previous oversight planning cycles and taking into account the situation within the Member State’s aviation industry, the competent authority may estimate: (1) the standard working time required for processing applications for new certificates; (2) the standard working time required for processing declarations; (3) the number of new declarations or changed declarations; (4) the number of new certificates to be issued for each planning period; and (5) the number of changes to existing certificates and changes to functional systems to be processed for each planning period. (d) In line with the competent authority’s oversight policy, the following planning data should be determined specifically for each service provider, certified or declared, as well as for the Network Manager: (1) standard number of audits/inspections to be performed per oversight planning cycle; (2) standard duration of each audit/inspection; (3) standard working time for audit/inspection preparation, on-site audit/inspection, reporting and follow-up per inspector for the oversight of services provision and other ATM network functions; and (4) minimum number and required qualification of inspectors for the oversight of services provision and other ATM network functions for each audit/inspection. (e) Standard working time could be expressed either in working hours or in working days per inspector for the oversight of services provision and other ATM network functions. All planning calculations should then be based on the same unit (hours or working days). (f) For each service provider, the number of working hours/days per planning period for each qualified inspector for the oversight of services provision and other ATM network functions that may be allocated for certification, oversight and enforcement activities should be determined taking into account: (1) purely administrative tasks not directly related to oversight and certification; (2) training; (3) participation in other projects; (4) planned absence; and (5) the need to include a reserve for unplanned tasks or unforeseeable events. (g) The determination of working time available for certification, oversight and enforcement activities should also take into account the possible use of third parties.

text: Annex II to ED Decision 2017/001/R

text: AMC1 ATM/ANS.AR.B.001(a)(4) Management system

text: COMPLIANCE MONITORING PROCESS The formal process to monitor the compliance of the management system with the relevant requirements, and the adequacy of the procedures should: (a) include a feedback system of audit findings to ensure implementation of corrective actions as necessary; and (b) be the responsibility of a person or group of persons who should be responsible to the senior management of the competent authority and who perform(s) compliance monitoring activities with functional independence from the units/departments (s)he (they) oversees (oversee) and with direct access to the senior management of the competent authority and to appropriate management for safety matters.

text: AMC1 ATM/ANS.AR.B.005 Allocation of tasks to qualified entities

text: ASSESSMENT OF THE QUALIFIED ENTITIES (1) The competent authority should include in its system to initially and continuously assess the qualified entity’s (ies’) compliance with Annex V to

text: Regulation (EC) No 216/2008

text: , the possibility for the competent authority to perform audits of the qualified entity (ies). (2) The competent authority should verify that all qualified entities’ personnel concerned with the conduct of audits or reviews should be adequately trained and qualified. The competent authority should verify how the qualified entities: (1) define and document the education, training, technical and operational knowledge, experience and qualifications for those involved in oversight activities; (2) ensure specific training for those involved in oversight activities; and (3) ensure that personnel designated to conduct audits meet specific qualification criteria. The criteria should address: (i) the knowledge and understanding of the requirements related to the services provision in ATM/ANS and other ATM network functions against which audits may be performed; (ii) the use of assessment techniques; (iii) the skills required for managing an audit; and (iv) the demonstration of competence of auditors through evaluation or other acceptable means.

text: GM1 ATM/ANS.AR.B.005 Allocation of tasks to qualified entities

text: CERTIFICATION TASKS The tasks that may be performed by a qualified entity on behalf of the competent authority include those related to the initial certification and continuing oversight of service providers as defined in this Regulation, with the exclusion of the issuance of a certificate.

text: Annex II to ED Decision 2017/001/R

text: AMC1 ATM/ANS.AR.B.015(a)(2) Record-keeping

text: DURATION OF RETENTION PERIOD OF RECORDS Records related to the training and qualification of the personnel of the competent authority should be kept until the end of their employment.

text: AMC1 ATM/ANS.AR.B.015(a)(8) Record-keeping

text: RECORD-KEEPING FOR FUNCTIONAL SYSTEMS CHANGE MANAGEMENT PROCEDURES The competent authority should keep a record of all the change management procedures, modifications and deviations it has approved in accordance with ATM/ANS.AR.C.030(a) and those that have been rejected, together with a rationale. The competent authority should be able to cross-reference them to the requirement of the associated requirement in the Regulation that they intend to comply with.

text: SUBPART C — OVERSIGHT, CERTIFICATION AND ENFORCEMENT (ATM/ANS.AR.C)

text: AMC1 ATM/ANS.AR.C.010(a) Oversight

text: AUDITS The audits should include oversight of changes to the functional system in order to: (a) verify that changes made to the functional system: (1) comply with ATM/ANS.OR.A.045; (2) have been managed in accordance with the procedures identified in ATM/ANS.OR.B.010(a) that have been approved; and (3) are being verified against the monitoring criteria that were identified in the assurance argument as a result of complying with ATM/ANS.OR.C.005(b)(2) or ATS.OR.205(b)(6), as appropriate; and (b) verify that if, as a result of the monitoring referred to in (a)(3), the argument, referred to in ATS.OR.205(a)(2) and ATM/ANS.OR.C.005(a)(2), is found to be incomplete and/or incorrect, then the service provider has initiated a change or has revised the argument such that the inferences or evidence are now sufficient to justify the claim.

text: GM1 ATM/ANS.AR.C.010(b)(1) Oversight

text: IMPLEMENTING ARRANGEMENTS Implementing arrangements should be considered to be the service provider’s (safety) management system(s) documentation, manuals, service provision conditions or the certificate and the content of the declaration, as applicable.

text: GM2 ATM/ANS.AR.C.010 Oversight

text: DEMONSTRATION OF COMPLIANCE — DAT PROVIDERS In addition to the applicable requirements, the competent authority should assess the standards and processes applied by the DAT provider. The following specific areas should be overseen against EUROCAE ED- 76A/RTCA DO-200B ‘Standards for Processing Aeronautical Data’, dated June 2015: (a) plans and procedures, including:

text: Annex II to ED Decision 2017/001/R (1) alteration procedures (i.e. informing the supplier or data originator of the data alteration and endeavouring to receive concurrence/agreement); (2) data verification and validation (including the procedures that define the level of checking of the database prior to release). These procedures should be reviewed to ensure adequacy; (3) reporting and handling procedures (including occurrence reporting); (4) data configuration management; (5) data transmission practices; (6) tool qualification; and (7) internal audit checks and response mechanisms; (b) internal standards; and (c) definition of ‘Data Quality Requirements’. EUROCAE ED-76/RTCA DO-200A may be also used for the demonstration of compliance.

text: AMC1 ATM/ANS.AR.C.015 Oversight programme

text: GENERAL (a) When establishing an oversight programme appropriate to each provider, the competent authority should take into account the safety performance of the service provider to be audited. Inspectors for the oversight of services provision and other ATM network functions should work in accordance with the schedule provided to them. (b) Having regard to the performance of service providers, the competent authority may vary the frequency of the audits or inspections. (c) When defining the oversight programme, the competent authority should assess the risks related to the activity of each service provider, certified or declared, or the Network Manager, and adapt the audits and inspections to the level of risk identified.

text: AMC1 ATM/ANS.AR.C.015(a) Oversight programme

text: SPECIFIC NATURE AND COMPLEXITY OF THE ORGANISATION (a) When determining the oversight programme for a service provider, the competent authority should consider in particular the following elements, as applicable: (1) the implementation by the service provider of industry standards, directly relevant to the organisation’s activity subject to this Regulation; (2) the procedure applied for and scope of changes not requiring prior approval in accordance with ATM/ANS.OR.A.040(b); and (3) specific procedures implemented by the service provider related to any alternative means of compliance used. (b) For the purpose of assessing the complexity of an organisation’s management system, AMC1 ATM/ANS.OR.B.005(e) should be used.

text: Annex II to ED Decision 2017/001/R

text: AMC1 ATM/ANS.AR.C.015(a)(1) Oversight programme

text: AREA OF POTENTIAL SAFETY CONCERNS — DAT PROVIDERS The competent authority should audit the DAT provider’s procedures for dealing with situations where resolution and corrections could not be obtained with the aeronautical data source or other DAT providers for data that has been called into question in accordance with AMC1 DAT.TR.105(a). Such audits should confirm that effective controls are in place to ensure that an unsafe product is not released and that such concerns are communicated to customers in accordance with the requirements laid down in DAT.OR.200.

text: GM1 ATM/ANS.AR.C.020 Issue of certificates

text: OPERATIONAL CONDITIONS OR LIMITATIONS (a) If, during the certification process, an operational condition or limitation has been determined as necessary to be imposed on or implemented by the service provider, the competent authority should ensure that such operational condition or limitation is prescribed in the service provision conditions attached to the service provider’s certificate. (b) Limitations in the certification may be used to identify restrictions to be applied in the provision of services and any other particularity of the service provided (e.g. intended usage, type of operations). (c) Limitations may also relate to some restrictions on the service(s) provided associated with noncompliances with respect to some performance requirements. (d) Conditions may address actions that require to be accomplished to confirm the validity of the certificate.

text: GM2 ATM/ANS.AR.C.020 Issue of certificates

text: EXAMPLES OF LIMITATIONS IN SERVICES (a) Limitations for the provision of ILS Signal in Space could be: (1) CAT I; (2) CAT II; and (3) CAT III. (b) Limitations for the provision of Global Navigation Satellite System (GNSS) signal could be: (1) based on the system used to provide Signal-in-Space: (i) GNSS Core System; (ii) Satellite-Based Augmentation System (SBAS); and (iii) Ground-Based Augmentation System (GBAS); and/or (2) based on the type of operations supported (e.g. en-route, en-route terminal, NPA, APV-I, APV-II, Cat I, from ICAO Annex 10) (c) Limitations for the Aeronautical Mobile Service (air–ground communication) could be: (1) for flight information services; (2) for area control service; (3) for approach control service; and (4) for aerodrome control service.

text: Annex II to ED Decision 2017/001/R (d) Limitations for the provision of data from the secondary surveillance radar (SSR) could be: (1) mode A/C; and (2) mode S. (e) Limitations for the provision of data from automatic dependant surveillance (ADS) could be: (1) ADS-C; and (2) ADS-B.

text: AMC1 ATM/ANS.AR.C.025(b) Changes

text: CHANGES REQUIRING PRIOR APPROVAL (a) Upon receipt of a notification for a proposed change that requires prior approval, the competent authority should: (1) formally acknowledge the receipt of the notification in writing within 10 working days; (2) assess the proposed change in relation to the service provider’s certificate or the conditions attached or management system of it, and the applicable requirements of Part-ATM/ANS.OR, as well as any other applicable requirements within 30 working days after the receipt of all the evidence supporting the proposed change; (3) assess the actions proposed by the service provider in order to show compliance; and (4) notify the service provider of its approval/rejection without delay. (b) A simple management system documentation system status sheet should be maintained, which contains information on when an amendment was received by the competent authority and when it was approved, if applicable. (c) The competent authority should, in due time, verify the compliance of the service provider and, depending on the change, examine the need for prescribing any condition for the operation of it during the change. (d) For changes requiring prior approval, the competent authority may conduct an audit of the service provider in order to verify the service provider’s compliance with the applicable requirements. (e) When notifying, the competent authority should also inform the service provider of the right of appeal, as exists under the applicable national legislation.

text: AMC2 ATM/ANS.AR.C.025(b) Changes

text: CHANGE OF NAME OF THE SERVICE PROVIDER Upon receipt of the notification and the relevant parts of the service provider’s documentation as required by Part-ATM/ANS.OR, the competent authority should reissue the certificate.

text: GM1 ATM/ANS.AR.C.025(b) Changes

text: CHANGE OF NAME OF THE SERVICE PROVIDER A name change alone does not require the competent authority to audit the organisation unless there is evidence that other aspects of the organisation have changed.

text: Annex II to ED Decision 2017/001/R

text: GM2 ATM/ANS.AR.C.025(b) Changes

text: APPROPRIATE ACTION Appropriate action by the competent authority may include suspension, limitation or revocation of the service provider’s certificate.

text: AMC1 ATM/ANS.AR.C.025(c) Changes

text: CHANGES NOT REQUIRING PRIOR APPROVAL (a) When the service provider submits the name of the nominee for the nominated persons in accordance with AMC2 ATM/ANS.OR.A.040(b), the competent authority should consider his or her qualification. (b) Upon receipt of a notification for a proposed change that does not require prior approval by the competent authority, it should acknowledge receipt of the notification in writing within 10 working days from receipt unless it is not specified under the relevant national legislation.

text: GM1 ATM/ANS.AR.C.030 Approval of change management procedures for functional systems

text: GENERAL The review by the competent authority is focused on the change management procedures and not on the project management part of these procedures that are not required by the regulations, even though they may be useful for the smooth execution of the project dealing with the change. Consequently, not all parts of a procedure may be approved by the competent authority. The approved parts should be identified in the record (see AMC1 ATM/ANS.AR.B.015(a)(8)) and communicated to the service provider.

text: AMC1 ATM/ANS.AR.C.030(a) Approval of change management procedures for functional systems

text: MEANS AND METHOD OF SUBMITTING PROCEDURES The competent authority should agree with the service provider on the means and method of submitting the procedures, modifications and deviations referred to in ATM/ANS.AR.C.030(a). Until an agreement is reached, the competent authority will prescribe the means and method of submission.

text: AMC1 ATM/ANS.AR.C.030(b) Approval of change management procedures for functional systems

text: APPROVAL OF PROCEDURES (a) When approving the change management procedures for functional systems as per ATM/ANS.OR.B.010, the competent authority should perform the following: (1) check that the procedures used by a service provider to manage changes cover the life cycle of a change as defined in ATM/ANS.OR.C.005(a)(1) or ATS.OR.205(a)(1); (2) use the compliance matrix provided by the service provider (referred to in AMC1 ATM/ANS.OR.B.010(a)), when reviewing the content of the procedures, modifications and/or deviations referred to in ATM/ANS.AR.C.030(a); as part of the oversight activity, the competent authority should check that the compliance matrix covers all the aforementioned requirements. (3) check that the procedures make mandatory provisions that require actions to be undertaken and all required evidence to be produced to comply with requirements laid down in ATM/ANS.OR.A.045, ATM/ANS.OR.C.005, ATS.OR.205 and ATS.OR.210; (4) check that the procedures identify the roles and responsibilities of the service provider in the change management processes;

text: Annex II to ED Decision 2017/001/R (5) check that the procedures state that it is not allowed to use new, modified or deviating change management procedures until approval is granted; and (6) check that the procedures state that any change selected for review must not enter into operational service before the approval is granted. (b) The competent authority should provide a response to the service provider’s notification of change referred to in ATM/ANS.OR.A.045(a) without undue delay.

text: GM1 ATM/ANS.AR.C.030(b) Approval of change management procedures for functional systems

text: DEVIATIONS Some changes might stem from the need to implement immediate action and, therefore, their implementation cannot be delayed until they receive approval or communication that the change is not being reviewed from the competent authority such as changes due to urgent unforeseen circumstances that would, if uncorrected, lead to an immediate unsafe condition, presence of volcanic ash, etc. The competent authority may consider this type of changes as part of the approval of change management procedures for functional systems.

text: AMC1 ATM/ANS.AR.C.035(a) Decision to review a notified change to the functional system

text: MEANS AND METHOD OF SUBMITTING NOTIFICATION OF CHANGES TO FUNCTIONAL SYSTEMS The competent authority should agree with the service provider on the means and method of submitting the notification of changes and additional information referred to in ATM/ANS.OR.A.045(a). Until an agreement is reached, the competent authority will prescribe the means of submission.

text: GM1 ATM/ANS.AR.C.035(b) Decision to review a notified change to the functional system

text: SELECTION CRITERIA FOR REVIEWING A NOTIFIED CHANGE TO THE FUNCTIONAL SYSTEM The need for review should be based on a combination of the likelihood that the safety (support) argument may be complex or unfamiliar to the service provider undertaking the change and the severity of the consequences associated with the change. This is a risk function and is referred to as the ‘risk posed by the change’. The following two aspects of the change: — the novelty of the change; and — the capabilities of the service provider (e.g. the effectiveness of the service provider’s (safety) management system), as well as the service provider performing the change contribute to the service provider’s unfamiliarity of the necessary argument. The assessment of the severity of the consequence is made at a very early stage in the development of the change and, therefore, will be based on coarse data. It should, therefore, be conservative. The risk posed by a change could be a scalar measure associated with the change and be some combination of the two inputs: the probability of a complex or unfamiliar argument and the severity of the consequences of the proposed change. The result is that the risk posed by a particular change is the sum of the inputs. One possibility may be based on the use of a risk matrix in which risk parameters are represented according to a coarse-grained measurement scheme, and the selection criteria establish the boundary beyond which changes will be selected for review, as shown below:

text: Annex II to ED Decision 2017/001/R

text: The selection criterion, a function of risk with the value ‘significant’, is then a straight line, if the scales are logarithmic.

text: GM1 ATM/ANS.AR.C.035(c) Decision to review a notified change to the functional system

text: OTHER SELECTION CRITERIA

text: (a) Some changes may not necessarily need to be reviewed providing that, even though they relate to safety, they can be considered as routine by the provider as they have been consistently assessed, implemented and proved safe in the past and, therefore, the competent authority has sufficient confidence that the provider will address them in a similar manner.

text: (b) The selection criterion for review may deviate from a simple threshold on the scalar risk metric (distance from the origin), to deal with concerns due to the coarse grain and high uncertainty of the inputs. For instance, a separate threshold on the ‘severity’ axis may be used to specify, for instance:

text: (1) that changes with very high potential severity should always be reviewed, irrespective of the probability of the safety argument being incomplete and/or incorrect (Figure below). This criterion may well respond to common perceptions and could be justified by the fact that judgements of low probabilities based on limited information are often unreliable, and errors in the judgment of risk are proportional to the error on probability and the size of the loss; and

text: (2) that changes with minor potential severity need not be reviewed, irrespective of the probability of the safety argument being incomplete and/or incorrect (Figure below) (though the process may retain the option for the competent authority to review the change, since the estimate itself of potential severity may be suspected of being erroneous).

text: (c) It is also possible that deviations be required on the basis of some of the component factors that affect either probability or severity, e.g. exempting changes based on small size of change and high competence of the air traffic services provider.

text: Annex II to ED Decision 2017/001/R

text: (d) In order to validate the process or provide data for the evolution of the process, it may be advisable to randomly select changes to review and then assess whether the safety argument is complete and/or correct or not and whether or not the case would have been selected for review using the current criteria for the selection process.

text: Figure 1: Criteria that may be used when severity is high

text: Figure 2: Criteria that may be used when severity is low

text: GM1 ATM/ANS.AR.C.050 Findings, corrective actions, and enforcement measures

text: CATEGORIES OF FINDINGS — DOCUMENTARY EVIDENCE

text: Documentary evidence may include but is not limited to:

text: (a) operations or technical manuals;

text: Annex II to ED Decision 2017/001/R (b) contracts or other types of arrangements; (c) training, qualification or medical records; (d) inspection records; (e) test or exercise results; (f) internal audit results; (g) maintenance records; and (h) other similar material required to be maintained by the service provider, etc.

text: GM2 ATM/ANS.AR.C.050 Findings, corrective actions, and enforcement measures

text: ENFORCEMENT MEASURES — FINANCIAL PENALTIES In accordance with Article 7(7) of Regulation No 550/2004 and Articles

text: a(d), 25, and 68 of

text: Regulation (EC) No 216/2008

text: , the competent authority may additionally, and depending on the nature and the repetitiveness of the findings or the level of implementation of the corrective actions, impose appropriate enforcement measures that may include financial penalties, which are effective, proportionate, and dissuasive.

text: AMC1 ATM/ANS.AR.C.050(e) Findings, corrective actions, and enforcement measures

text: CORRECTIVE ACTION AND CORRECTIVE ACTION IMPLEMENTATION PERIOD — DAT PROVIDERS (a) In case of a Level 1 finding, the competent authority may extend the initial 21-working-day period for demonstration of corrective action by the DAT provider, depending on the nature of the finding. (b) In case of a Level 2 finding, the initial corrective action implementation period granted by the competent authority should be appropriate to the nature of the finding but should not, in any case, exceed 3 months. At the end of this period and subject to the nature of the finding, the competent authority may extend the 3-month period subject to a satisfactory corrective action plan agreed by the competent authority.

text: GM1 ATM/ANS.AR.C.050(e) Findings, corrective actions, and enforcement measures

text: CORRECTIVE ACTION IMPLEMENTATION PERIOD At the end of the corrective action implementation period included in an action plan approved by the competent authority and subject to the nature of the finding, the competent authority may extend it. It should be subject to a satisfactory corrective action plan agreed by the competent authority.

text: GM1 ATM/ANS.AR.C.050(f) Findings, corrective actions, and enforcement measures

text: OBSERVATIONS The observation should be a way to communicate and draw future audit teams’ attention on specific matters that deserve scrutiny. It should be communicated to the audited service provider.


text: For the date of entry into force of this Issue, kindly refer to ED Decision 2024/001/R at the Official Publication of EASA.

text: Annex II to ED Decision 2024/001/R Page 1 of 4

text: AMC & GM to Part-ATM/ANS.EQMT.AR — Issue 1

text: Annex II to ED Decision 2024/001/R Page 3 of 4

text: Annex II to ED Decision 2024/001/R Page 4 of 4

beslut: ED Decision 2024/001/R

publisher: Europeiska unionens byrå för luftfartssäkerhet

sprak: en

serie: amc-gm

text: Acceptable Means of Compliance and Guidance Material for the certification and declaration of air traffic management/air navigation services systems and air traffic management/air navigation services constituents AMC & GM to Annex I (Part- ATM/ANS.EQMT.AR) to Commission Delegated

text: Regulation (EU) 2023/1768

type: rubrik

text: Issue 1 22 March 2024

type: stycke

text: GM1 ATM/ANS.EQMT.AR.A.030 ATM/ANS equipment directives

text: ATM/ANS EQUIPMENT DIRECTIVE IN CASE OF DISCONTINUATION OF DPO APPROVAL

text: Certificates of ATM/ANS equipment issued in accordance with

text: Article 4

text: and declarations of design compliance of ATM/ANS equipment issued in accordance with

text: Article 5

text: lose their validity in case the holder of the certificate/issuer of the declaration of design compliance is no longer compliant with Implementing

text: Regulation (EU) 2023/1769

text: . In the above situations, EASA would typically: (a) revoke the certificate or deregister the declaration of design compliance, as appropriate; (b) inform ATM/ANS providers that are users of the ATM/ANS equipment concerned and their competent authorities, as in the absence of an approved DPO with appropriate privileges from that moment on: — the affected ATM/ANS equipment cannot be integrated into any functional system as the requirements in ATM/ANS.OR.A.045 (g) of Implementing

text: Regulation (EU) 2017/373

text: will be no longer met; — the affected ATM/ANS equipment already integrated into a functional system cannot be modified until a valid certificate or declaration is in place, in accordance with points ATM/ANS.OR.A.045 (g)(1) and (g)(2) of Implementing

text: Regulation (EU) 2017/373

text: . This requires another DPO with appropriate privileges to take responsibility for the compliance of the equipment with the applicable technical specifications; — the continuous operation of the ATM/ANS equipment already integrated into the functional system of ATM/ANS providers may not necessarily be immediately impacted. However, ATM/ANS providers will have to consider how the absence of the DPO impacts the suitability for use of the equipment, the defined conditions of use, and any prescribed limitations; and (c) issue an ATM/ANS equipment directive to replace the ATM/ANS equipment concerned in case an unsafe, insecure, under-performing or non-interoperability condition has been identified or is likely to develop, as in the absence of a DPO with appropriate privileges and responsibility for ensuring that the equipment continues complying with the applicable technical specifications, design changes to the ATM/ANS equipment to restore performance are not possible. This ATM/ANS equipment directive will be addressed to all known users of the ATM/ANS equipment and their competent authorities. Note: In case the DPO approval is still valid, e.g. during a suspension/revocation process, EASA will require the DPO to make appropriate descriptive data and accomplishment instructions available to all known users of the ATM/ANS equipment and their competent authorities. Urgent operational needs might require certain exceptions to the principles described above, allowing integration or modification of equipment without a valid certificate or declaration. In those cases, the exemptions are to be managed under the flexibility provisions in

text: Article 71 of Regulation (EU) 2018/1139

text: , subject to all relevant conditions laid down in such article. In particular, the Member State must provide adequate justification for the following aspects:

text: (1) it is not possible for another DPO to obtain a valid certificate or issue a declaration for the equipment; (2) safety, environmental protection and compliance with the applicable essential requirements are ensured, where necessary through the application of mitigation measures; (3) any possible distortion of market conditions as a consequence of the granting of the exemption will be mitigated as far as possible; and (4) the exemption is limited in scope and duration to the extent strictly necessary and it is applied in a non-discriminatory manner; and (d) take any other necessary further enforcement measures which are necessary to mitigate the consequences of the discontinuation of a DPO approval.

text: GM1 ATM/ANS.EQMT.AR.B.001(a)(1) ATM/ANS equipment certification basis

text: DETAILED SPECIFICATIONS

text: The ATM/ANS equipment certification basis is established on the basis of the detailed specifications that were effective on the date of application and applicable for that certificate. The validity period of an application for the issue of an ATM/ANS equipment certificate may be extended, as per point ATM/ANS.EQMT.CERT.015(e)(2). In such a case, the certification basis is then revised accordingly. It is also possible for an applicant to elect to comply with a detailed specification that became applicable after the date of the submission of the application. EASA will assess whether the proposed certification basis is appropriate. During the transitional period, detailed specifications may not be fully developed, and only the general part of the detailed specifications might be available and applicable for the ATM/ANS equipment. Additional technical specifications will then be proposed by the DPO to be part of the certification basis.

text: AMC1 ATM/ANS.EQMT.AR.B.001(b) ATM/ANS equipment certification basis

text: Additional features, characteristics or functions not specified into the applicable detailed specifications should be addressed through demonstration to provide assurance that their inclusion in the certification basis does not detrimentally interfere with those specified in the applicable detailed specifications, as per point ATM/ANS.EQMT.CERT.025(f), when demonstrating the suitability of the ATM/ANS equipment for its intended use.

type: vagledning

utgivare: easa


text: For the date of entry into force of this Issue, kindly refer to ED Decision 2024/001/R at the Official Publication of EASA.

text: Annex III to ED Decision 2024/001/R Page 1 of 6

text: AMC & GM to Part-ATM/ANS.EQMT.CERT — Issue 1

text: Annex III to ED Decision 2024/001/R Page 3 of 6

text: Annex III to ED Decision 2024/001/R Page 4 of 6

text: Associated compliance Type of compliance Means of compliance documents

text: MC0: (a) compliance statement (b) reference to design data (a) Design data Engineering evaluation (c) election of methods, factors, (b) Recorded statements etc. (d) definitions (c) Descriptions MC1: design review (d) Drawings

text: MC2: calculation/analysis (e) Substantiation reports

text: MC3: safety assessment (f) Safety analysis

text: Tests MC4: laboratory tests MC5: tests on related ATM/ANS (g) Test programmes equipment (h) Test reports (i) Test interpretations MC6: simulation Inspection MC7: design inspection/audit (j) Inspection or audit reports Note: Equipment qualification is MC8: ATM/ANS equipment a process that may include all Equipment qualification qualification previous means of compliance at equipment level.

text: Annex III to ED Decision 2024/001/R Page 5 of 6

text: Annex III to ED Decision 2024/001/R Page 6 of 6

text: Acceptable Means of Compliance and Guidance Material for the certification and declaration of air traffic management/air navigation services systems and air traffic management/air navigation services constituents AMC & GM to Annex II (Part- ATM/ANS.EQMT.CERT) to Commission Delegated

text: Regulation (EU) 2023/1768

text: Issue 1 22 March 2024

text: GM1 ATM/ANS.EQMT.CERT.015(b)(2) Application for an ATM/ANS equipment certificate

text: DEFINITION OF CERTIFICATION PROGRAMME

text: The certification programme is a document used to establish a protocol of communication between the applicant and EASA in the context of certification of ATM/ANS equipment under Article 4 of Delegated

text: Regulation (EU) 2023/1768

text: , which allows to manage and control the evolving design, as well as the process of compliance demonstration and its verification. The certification programme may be based on modules/sections that may be updated independently.

text: CONTENT OF THE CERTIFICATION PROGRAMME

text: The following information is typically included in a certification programme:

text: Description of the ATM/ANS equipment

text: An overview of the equipment will be provided, covering, as a minimum, the description of the following: — type of system, architecture and functions; — performance; — dimensions, if applicable; — materials, if applicable, and technologies; — operational limitations; — electronic hardware, and software; — additional features, characteristics or functionalities not covered by applicable detailed specifications, as per point ATM/ANS.EQMT.AR.B.001(b); — considerations of intended use of the equipment and operating characteristics; and — other items, if considered to be more appropriate, that are relevant to the specific ATM/ANS equipment. A special emphasis on novelties being part of the design (e.g. new technologies, new materials, etc.) and peculiarities of the configuration will be included. The certification programme must be detailed enough, in particular on aspects related to novelty and complexity, to allow EASA to properly estimate its level of involvement as required by point ATM/ANS.EQMT.AR.B.010.

text: Certification aspects

text: The following information related to certification will be provided:

text: — a proposal for the initial certification basis, in accordance with point ATM/ANS.EQMT.CERT.015(b)(2)(iv), including applicable detailed specifications, reference to special conditions, and reference to equivalent safety findings; — a proposal for deviations that are requested at the time of establishing the certification programme, which provide an equivalent level of safety; — a proposal for limitations that are expected at the time of establishing the certification programme; and — the identification of applicable industry standards, certification memoranda, and guidance material. Where AMC to detailed specifications specifies a certain industry standard(s), and the applicant does not elect to comply with it (them) (partly or completely), the certification programme must identify the request to deviate from the AMC, propose alternative industry standard(s), and demonstrate its (their) equivalence. For equipment embedding software, the description will identify the main failure conditions that will drive the architecture of the equipment, the classification of the software assurance level (SWAL) to use, and any associated assumption made to define the SWAL.

text: Equipment configuration

text: The certification programme must define the equipment model name, part number, and provide the means to configure anticipated minor changes when previously agreed with EASA as part of the DPO change management procedure as required in point DPO.OR.B.005(b) of Implementing

text: Regulation (EU) 2023/1769

text: Demonstration of compliance

text: The certification programme will include the following, as far as this information is available at the time of submission to EASA: — the proposed means of compliance, and the related compliance document(s) as specified in Appendix 1; — identification of technical procedures, technical documents and specifications that were followed in the demonstration of compliance; — when the compliance demonstration involves testing, a description of the test article(s), test method(s), test location(s), test schedule, test house(s), test conditions, as well as of the intent/objective(s) of the testing; and — when the compliance demonstration involves analyses/calculations, a description/identification of the tools (e.g. name and version/release of the software programmes) and methods used, the associated assumptions, limitations and/or conditions, as well as of the intended use and purpose; furthermore, the validation and verification of such tools and methods will be addressed. For every aspect mentioned above, the applicant will clearly identify whether the demonstration of compliance involves any method (analysis or test) which is novel to or unusual for the applicant. The applicant will detail the list of documents generated during the development and that will be used to demonstrate compliance with the applicable certification basis.

text: The applicant will break down the certification programme into one or more meaningful groups of compliance-demonstration activities and data, in accordance with point ATM/ANS.EQMT.CERT.015(b)(2)(v), hereafter referred to as compliance-demonstration items (CDIs), and provide their proposal for EASA’s LoI.

text: A CDI will be used as a meaningful group of compliance-demonstration activities and data identified in the certification programme which can be considered in isolation for the purpose of performing the certification risk assessment that allows EASA to determine its LoI using a risk-based approach.

text: The applicant must provide sufficient detailed information about the novelty, complexity, and criticality aspects of the proposed CDI.

text: Desing organisation and schedule aspects

text: — Identification of the relevant personnel who make decisions affecting safety, security and interoperability, and who will interface with EASA, unless otherwise communicated to EASA (e.g. within the DPO procedures);

text: — A project schedule including the major milestones;

text: — Subcontracting arrangements for design and/or production.

text: Appendix 1 to GM2 ATM/ANS.EQMT.CERT.015(b)(2) Application for an ATM/ANS equipment certificate GM1 ATM/ANS.EQMT.CERT.025(e) Demonstration of compliance with the ATM/ANS equipment certification basis

text: DECLARATION AT THE END OF COMPLIANCE DEMONSTRATION

text: Upon completion of all compliance-demonstration activities, the DPO will provide a final declaration indicating that all compliance-demonstration activities have been performed in accordance with the certification programme. This declaration will be provided in the form of a document signed by the DPO accountable manager. The document will typically contain the following: — a description of the final equipment configuration; — a statement confirming the completion of all compliance-demonstration activities that are performed in accordance with the certification programme as accepted by the Agency; — a list of all the applicable life cycle data that supports the demonstration of compliance; — a list of the applicable deviations; — a list of the applicable limitations; — a declaration that: — it has demonstrated compliance with the certification basis, as established and notified by the Agency; — no feature or characteristic has been identified that may render the ATM/ANS equipment unsuitable for its intended use; and — the features, characteristics or functions that do not form part of the certification basis have no interference or detrimental effect on the suitability of the ATM/ANS equipment for its intended use.


identifier: AMC & GM to Part-ATM/ANS.OR — Issue 1, Amendment 1

beslut: ED Decision 2019/022/R

text: AMC and GM to Part-ATM/ANS.OR Annex III to ED Decision 2019/022/R

text: Issue 1, Amendment 1

text: ‘AMC and GM to Part-ATM/ANS.OR — Issue 1, Amendment 1’

text: Annex III to Decision 2017/001/R is amended as follows: The text of the amendment is arranged to show deleted text, new or amended text as shown below: (a) deleted text is marked with strikethrough; (b) new or amended text is highlighted in blue; (c) an ellipsis (…) indicates that the remaining text is unchanged in front of or following the reflected amendment.

text: AMC and GM to Part-ATM/ANS.OR Issue 1, Amendment 1

text: GM2 ATM/ANS.OR.A.045(a) Changes to a functional system

text: NOTIFICATION — SOFTWARE CRITICALITY Depending on the complexity of the change to the functional system and the criticality of the software, the depth of the evaluation may vary. The service provider should coordinate as soon as possible with the competent authority in order to define a software oversight strategy as part of the change review activities, if a decision for change review is taken.

text: GM1 ATM/ANS.OR.A.050 Facilitation and cooperation

text: AUDITS — SOFTWARE ASSURANCE PROCESSES BY THE COMPETENT AUTHORITY (a) The assessment of an effective application of the documented software assurance processes may necessitate a technical evaluation of the evidence and arguments produced for the software assurance by the competent authority when reviewing a notified change. In this context, the service provider should ensure access to the configuration management system for the competent authority, which may need to verify: (1) the consistency of all the evidence; and (2) the fact that all the evidence is derived from a known version of the software (i.e. all evidence and arguments are actually available and can be traced without ambiguity to the executable version). (b) The service provider should: (1) anticipate the possibility for on-site audits or inspections by the competent authority; and (2) when evidence and arguments are developed by contracted organisations, include the corresponding rights of the competent authority to assess said organisations during onsite audits or inspections.

text: AMC5 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

text: ASSURANCE — SOFTWARE (a) When a change to a functional system includes the introduction of new software or modifications to existing software, the service provider should ensure the existence of documented software assurance processes necessary to produce evidence and arguments

text: Annex III to ED Decision 2019/022/R Page 2 of 8

text: that demonstrate that the software behaves as intended (software requirements), with a level of confidence consistent with the needs of the required application. (b) The service provider should use feedback of software experience to confirm that the software assurance processes are effective and, when used, the allocated software assurance levels (SWALs) and the rigour of the assurances are appropriate. For that purpose, the effects from software malfunctions (i.e. the inability of a programme to perform a required function correctly) or failures (i.e. the inability of a programme to perform a required function) reported according to the relevant requirements on reporting and assessment of service occurrences should be assessed in comparison with the effects identified for the system concerned as per the service specification demonstration.

text: ASSURANCE — SOFTWARE ASSURANCE PROCESSES (a) The software assurance processes should provide evidence and arguments that they, as a minimum, demonstrate the following: (1) The software requirements correctly state what is required by the software, in order to meet the service and safety support requirements, as identified by the safety support assessment (AMC2.ATM/ANS.OR.C005(a)(2)). For that purpose, the software requirements should: (i) be correct, complete and compliant with the upper level requirements; and (ii) specify the functional behaviour, in nominal and downgraded modes, timing performances, capacity, accuracy, resource usage on the target hardware, robustness to abnormal operating conditions and overload tolerance, as appropriate, of the software. (2) The traceability is addressed in respect of all software requirements as follows: (i) Each software requirement should be traced to the same level of design at which its satisfaction is demonstrated. (ii) Each software requirement allocated to a component should either be traced to an upper level requirement or its need should be justified and assessed that it does not affect the satisfaction of the safety support requirements allocated to the component. (3) The software implementation does not contain functions that adversely affect the satisfaction of the service specification. (4) The functional behaviour, timing performances, capacity, accuracy, resource usage on the target hardware, robustness to abnormal operating conditions and overload tolerance, of the implemented software comply with the software requirements.

text: Annex III to ED Decision 2019/022/R Page 3 of 8

text: (5) The software verification is correct and complete, and is performed by analysis and/or testing and/or equivalent means, as agreed with the competent authority. (b) The evidence and arguments produced by the software assurance processes should be derived from: (1) a known executable version of the software; (2) a known range of configuration data; and (3) a known set of software items and descriptions, including specifications, that have been used in the production of that version, or can be justified as applicable to that version. (c) The software assurance processes should determine the rigour to which the evidence and arguments are produced. (d) The software assurance processes should include the necessary activities to ensure that the software life cycle data can be shown to be under configuration control throughout the software life cycle, including the possible evolutions due to changes or problems’ corrections. They should include, as a minimum: (1) configuration identification, traceability and status accounting activities, including archiving procedures; (2) problem reporting, tracking and corrective actions management; and (3) retrieval and release procedures. (e) The software assurance processes should also cover the particularities of specific types of software such as commercial-off-the-shelf (COTS), non-developmental software and previously developed software where generic assurance processes cannot be applied. The software assurance processes should include other means to give sufficient confidence that the software meets the service and safety support requirements. If sufficient assurance cannot be provided, complementary mitigation means aiming at decreasing the impact of specific failure modes of this type of software, should be applied. This may include but is not limited to: (1) software and/or system architectural considerations; (2) existing service level experience; and (3) monitoring.

text: GM2 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

text: ASSURANCE LEVELS (a) The use of assurance level concepts, e.g. design assurance levels (DALs), software assurance levels (SWALs), hardware assurance levels (HWALs), can be helpful in generating an appropriate and sufficient body of evidence to help establish the required confidence in the argument.

text: Annex III to ED Decision 2019/022/R Page 4 of 8

text: (b) The term ‘software assurance level (SWAL)’ is understood to be the level of rigour of the software assurances throughout the software lifecycle. In this context, the software life cycle is understood to be: (1) an ordered collection of processes determined by an organisation to be sufficient and adequate to produce a software item; (2) the period of the time that begins with the decision to produce or modify a software item and ends when the item is retired from service.

text: GM1 to AMC6 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

text: ASSURANCE — SOFTWARE ASSURANCE PROCESS (a) The term ‘correct and complete software verification’ is understood to be all software safety requirements, which correctly state what is required of the software component by the risk assessment and mitigation process and their implementation is demonstrated to the level required by the software assurance level. (b) The term ‘software timing performances’ is understood to be the time allowed for the software to respond to given inputs or to periodic events, and/or the performance of the software in terms of transactions or messages handled per unit time. (c) The term ‘software capacity’ is understood to be the ability of the software to handle a given amount of data flow. (d) The term ‘software accuracy’ is understood to be the required precision of the computed results. (e) The term ‘software resource usage’ is understood to be the amount of resources within the computer system that can be used by the application software. (f) The term ‘software robustness’ is understood to be the behaviour of the software in the event of unexpected inputs, hardware faults and power supply interruptions, either in the computer system itself or in connected devices. (g) The term ‘overload tolerance’ is understood to be the behaviour of the system in the event of, and in particular its tolerance to, inputs occurring at a greater rate than expected during normal operation of the system. (h) The term ‘software life cycle data’ is understood to be the data that is produced during the software life cycle to plan, direct, explain, define, record, or provide evidence of activities; this data enables the software life cycle processes, system or equipment approval and post-approval modification of the software item. (i) The term ‘COTS’ is understood to be a commercially available application sold by vendors through public catalogue listings and not intended to be customised or enhanced.

text: Annex III to ED Decision 2019/022/R Page 5 of 8

text: GM2 to AMC6 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

text: ASSURANCE — SOFTWARE ASSURANCE LEVELS (a) The assurance required by AMC6 ATM/ANS.OR.C.005(a)(2) can be provided with different levels of confidence depending on the rigour to which the evidence and arguments are produced. Whereas, for air traffic services (ATS) providers, the use of the SWAL concept can be helpful to provide an explicit link between the criticality of the software and the rigour of the assurance, for service providers other than ATS providers, the use of the SWAL concept may not be relevant considering that non-ATS providers may not be aware of the safety aspects of the ATS provider using their services. However, considering that the safety support assessment will be based on the evidence and arguments generated by the software assurance processes and that the safety support assessment will support a safety assessment, it is foreseen that, in many changes, the software assurance evidence and arguments will have to demonstrate a certain level of confidence and therefore will have to show compliance with the SWAL allocated by the ATS provider. (b) The use of multiple SWALs would also allow the possibility of managing several criticalities of the different software components within the system (with partitioning or other architectural strategies) by the same set of software assurance processes. When the software assurance processes employ several SWALs, they should define for each SWAL the rigour of the assurances to achieve compliance with the objectives set out in AMC6 ATM/ANS.OR.C.005(a)(2). As a minimum: (1) the rigour should increase as the criticality of the service supported by the software solution increases; and (2) the variation in rigour of the evidence and arguments per SWAL should include a classification of the activities and objectives according to the following criteria: (i) required to be achieved with independence, i.e. the verification process activities are performed by a person (or persons) other than the developer of the item being verified; (ii) required to be achieved; and (iii) not required.

text: GM3 to AMC6 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

text: ASSURANCE — SOFTWARE ASSURANCE LEVELS ALLOCATION The process to allocate a SWAL to a software consistently with its foreseen criticality, as identified by the safety support assessment and requirements, should consider the following elements:

text: Annex III to ED Decision 2019/022/R Page 6 of 8

text: (a) The SWAL allocation should relate the rigour of the software assurances to the foreseen criticality of the software. (b) The allocated SWAL should be commensurate with the worst credible effect that software malfunctions (i.e. the inability of a programme to perform a required function correctly) or failures (i.e. the inability of a programme to perform a required function) may cause, as assessed by the ATS provider that is planning to make use of the non-ATS services. (c) The software components that cannot be shown to be independent of one another should be allocated to the SWAL of the most critical of the dependent components. In this context, the term ‘software components’ is understood to be a building block that can be fitted or connected together with other reusable blocks of software to combine and create a custom software application, and ‘independent software components’ are those software components which are not rendered inoperative by the same failure condition. (d) The allocated SWALs should be consistent with the levels defined in the software assurance processes.

text: GM4 to AMC6 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

text: ASSURANCE — EXAMPLES OF EXISTING INDUSTRIAL STANDARDS (a) The service provider is responsible for the definition of the software assurance processes. In this definition of processes, the service provider may consider the guidance material contained in existing industrial standards for the software assurance considerations of software. It should be considered that not all standards address all aspects required and the service provider may need to define additional software assurance processes. The guidance material typically includes: (1) objectives of the software life cycle processes; (2) activities for satisfaction of those objectives; (3) descriptions of the evidence, in the form of software life cycle data, that indicates that the objectives have been satisfied; (4) variations according to the SWAL, to accommodate the different levels of rigour of the software assurances; and (5) particular aspects (e.g. previously developed software) that may be applicable to certain applications. (b) The following table presents some of the existing industrial standards (at the latest available issue) used by the stakeholders:

text: Annex III to ED Decision 2019/022/R Page 7 of 8

text: Document title Reference Date Software Integrity Assurance Considerations for EUROCAE ED- January 2012 Communication, Navigation, Surveillance and Air Traffic 109A/ RTCA DO- Management (CNS/ATM) Systems 278A Guidelines for ANS Software Safety Assurance EUROCAE ED-153 August 2009 Standards for Processing Aeronautical Data (only for AIS EUROCAE ED-76A/ June 2015 providers) RTCA DO-200B Functional safety of electrical/electronic/programmable IEC 61508 – Part 3 April 2010 electronic safety-related systems – Part 3: Software requirements Software Considerations in Airborne Systems and EUROCAE ED-12C/ January 2012 Equipment Certification RTCA DO-178C EUROCAE ED-109A/RTCA DO-278A and EUROCAE ED-12C/RTCA DO-178C make reference to some external documents (supplements), which are integral part of the standard for the use of some particular technologies and development techniques. The supplements are the following: (1) Formal Methods Supplement to ED-12C and ED-109A (EUROCAE ED-216/RTCA DO-333) (2) Object-Oriented Technology and related Techniques Supplement to ED-12C and ED-109A (EUROCAE ED-217/RTCA DO-332) (3) Model-Based Development and Verification Supplement to ED-12C and ED-109A (EUROCAE ED-218/RTCA DO-331) When tools are used during the software development lifecycle, EUROCAE ED-215/RTCA DO- 330 ‘Software Tool Qualification Considerations’ may be considered in addition to EUROCAE ED- 12C RTCA/DO-178C and EUROCAE ED-109A/RTCA DO-278A. (c) The definition of the software assurance processes may be based on one of these industrial standards, without combining provisions from different standards as far as the consistency and validation of each of the industrial standards have only been performed at individual level by each specific standardisation group.

text: Annex III to ED Decision 2019/022/R Page 8 of 8


text: Annex III to ED Decision 2020/008/R

text: AMC and GM to Part-ATM/ANS.OR Issue 1, Amendment 2

text: air traffic management

text: communication service

text: navigation service

text: air traffic services

text: ATC surveillance service air traffic control service

text: - area control service - approach control service

text: - aerodrome control service meteorological service

text: air traffic advisory service

text: flight information services AIS

text: - Aerodrome FIS aeronautical information service - En-route FIS

text: ASM data services DAT

text: airspace management - Type 1 data service - Type 2 data service

text: ATFM FPD

text: air traffic flow management flight procedure design service

text: network func.

text: ATM/ANS ATM network functions

text: Annex III to ED Decision 2020/008/R Page 2 of 13

text: Annex III to ED Decision 2020/008/R Page 3 of 13

text: Table 1: Applicability of annexes to service providers

text: X = Applicable annexes for each service provider. Note 1: Section 3 of Annex IV (Part-ATS) only applies to providers of air traffic control services and not to providers of alerting, air traffic advisory, and flight information services. Note 2: The applicability of Annex XIII is dependent upon the scope as specified within each of the subparts of Annex XIII. * to be introduced under RMT.0445, as necessary.

text: Annex III to ED Decision 2020/008/R Page 4 of 13

text: Annex III to ED Decision 2020/008/R Page 5 of 13

text: Annex III to ED Decision 2020/008/R Page 6 of 13

text: Annex III to ED Decision 2020/008/R Page 7 of 13

text: Annex III to ED Decision 2020/008/R Page 8 of 13

text: Annex III to ED Decision 2020/008/R Page 9 of 13

text: Annex III to ED Decision 2020/008/R Page 10 of 13

text: Annex III to ED Decision 2020/008/R Page 11 of 13

text: Annex III to ED Decision 2020/008/R Page 12 of 13

text: Annex III to ED Decision 2020/008/R Page 13 of 13

identifier: AMC & GM to Part-ATM/ANS.OR — Issue 1, Amendment 2

beslut: ED Decision 2020/008/R

title: AMC & GM to Part-ATM/ANS.OR — Issue 1, Amendment 2

text: ‘AMC and GM to Part-ATM/ANS.OR — Issue 1, Amendment 2’

text: Annex III to Decision 2017/001/R is amended as follows: The text of the amendment is arranged to show deleted text, new or amended text as shown below: (a) deleted text is struck through; (b) new or amended text is highlighted in blue; (c) an ellipsis [...] indicates that the rest of the text is unchanged.

text: GM1 ATM/ANS.OR.A.001 Scope

text: DEFINITIONS AND SCOPE IN RELATION TO SERVICE PROVIDERS

text: [...] (d) In this Regulation, ‘services’ means refers to those specified in Annex Vb VIII(2) to

text: Regulation (EC) No 216/2008

text: (EU) 2018/1139

text: . This Annex includes an additional service (airspace design) that is neither directly included in the definition of ATM/ANS nor in the definition of ‘Air Traffic Management’ or ‘Air Navigation Service’. [...] (g) Figure 1 indicates both a further breakdown of ATS into air traffic control services (ATC), alerting services, air traffic advisory services, and flight information services and groupings of: (1) air traffic management (ATM): comprising ATS, ASM, and ATFM; (2) air navigation services (ANS): comprising ATS, CNS, MET, and AIS; and (3) airspace flight procedure design services (ASDFPD) and data provision services (DAT) and ATM network functions. [...]

text: air navigation services

text: Figure 1: The scope of the services, subject to certification, as specified in Annex Vb to

text: Regulation (EC) No 216/2008

text: (EU) 2018/1139

text: and, additionally, the other ATM network functions.

text: Annex III Annex Annex Annex Annex Annex Annex Annex Annex Annex Annex IV V VI VII VIII IX X XI XII XIII (Part-ATM/ANS.OR) (Part- (Part- (Part- (Part- (Part- (Part- (Part- (Part- (Part- (Part- ATS) MET) AIS) DAT) CNS) ATFM) ASM) FPDASD) NM) PERS)

text: Subpart Subpart Subpart Subpart A B C D

text: Air traffic services providers X X X X (see Note 1)

text: Meteorological X

text: X X X X

text: services providers

text: Aeronautical X information services X X X X providers

text: Data services X

text: X X X

text: providers

text: Communication, X navigation and

text: X X X X

text: surveillance service providers

text: Air traffic flow X management service X X X X providers

text: Airspace management X

text: X X X

text: service providers

text: Airspace design X X X tbd*

text: Flight procedure X design services providers

text: Network Manager X X X X X

text: service providers

text: X

text: (see Note 2)

text: GM3 ATM/ANS.OR.A.005 Application for a service provider certificate

text: GENERAL — AIS PROVIDER

text: Terrain data sets are part of the digital data sets, but are typically originated and maintained by organisations different than AIS providers. The provision of terrain data sets by an AIS provider for the purpose of air navigation is consequently limited to the mere distribution of a finished product or even only the provision of information on how the product can be obtained, in accordance with the applicable requirements of

text: Regulation (EU) 2017/373

text: GM2 ATM/ANS.OR.A.035 Demonstration of compliance

text: RELEVANT EVIDENCE

text: ATM/ANS.OR.B.005(e) requires ‘The management system shall be proportionate to the size of the service provider and the complexity of its activities, taking into account the hazards and associated risks inherent in those activities.’ Consequently, the relevant evidence to demonstrate compliance with the applicable requirements of this Regulation should be also proportionate to the size of the service provider and the complexity of its activities.

text: GM1 ATM/ANS.OR.A.045(a) Changes to a functional system

text: NOTIFICATION

text: […] (b) Early and accurate notification facilitates the interactions between the provider and the competent authority and, thus, maximises the likelihood of introducing a change into service in due time and according to the service provider’s initial schedule when the competent authority has decided to review an assurance case. Therefore, it is advisable that the change description identified in AMC1 ATM/ANS.OR.A.045(a) is completed as soon as possible and contains the following data: […] (6) Consequence of the change, i.e. the harmful effects of the hazards associated with the change — see (f) below and also the definition of ‘risk’ in Annex I (805).

text: GM1 ATM/ANS.OR.085 Aeronautical data quality management

text: URGENT DISTRIBUTION OF AERONAUTICAL INFORMATION

text: The obligation to comply with the relevant provisions of ATM/ANS.OR.085 should not inhibit the urgent distribution of aeronautical information necessary to ensure the safety of flight. It is recognised that in this case it is not always possible to comply with all the relevant provisions. However, it is also not possible to determine a priori all cases where this exception may apply; hence, this shall be dependent on a case-by-case individual assessment made by competent staff.

text: GM1 ATM/ANS.OR.A.085(a) Aeronautical data quality management

text: AERONAUTICAL DATA CATALOGUE

text: The aeronautical data catalogue presents the scope of data that can be collected and maintained by the AIS providers and provides a common terminology that can be used by data originators and service providers.

text: GM1 ATM/ANS.OR.A.085(b) Aeronautical data quality management

text: GENERAL

text: Minimum requirements for the processing of aeronautical data may be found in EUROCAE ED-76A, ‘Standards for Processing Aeronautical Data’, June 2015, which aims to assist aeronautical data chain actors.

text: GM1 ATM/ANS.OR.A.085(b)(4) Aeronautical data quality management

text: RESOLUTION

text: (a) Stating that resolution needs to be commensurate with the actual accuracy means that digital data needs to have sufficient resolution to maintain accuracy. Typically, if an accuracy of .1 unit is needed, then a resolution of 0.01 or .001 units would enable a data chain to preserve the accuracy without issue. A finer resolution could be misleading as one could assume that it supports a finer accuracy. This factor range of 10 to 100 between accuracy and resolution is applicable regardless of the units of measurements used. (b) The resolution should be enough to capture the accuracy of the data.

text: GM1 ATM/ANS.OR.A.085(b)(5) Aeronautical data quality management

text: TRACEABILITY

text: Traceability is supported by maintaining the metadata.

text: AMC1 ATM/ANS.OR.A.085(b)(8) Aeronautical data quality management

text: FORMAT

text: The format requirements should be specified in the formal arrangements.

text: AMC1 ATM/ANS.OR.A.085(d) Aeronautical data quality management

text: VALIDATION AND VERIFICATION

text: (a) The processes implemented to carry out validation and verification should define the means used to: (a) verify received data and confirm that the data has been received without corruption; (b) preserve data quality and ensure that stored data is protected from corruption; and (c) confirm that originated data has not been corrupted prior to being stored. (b) Those processes should define the: (1) actions to be taken when data fails a verification or validation check; and (2) tools required for the verification and validation process.

text: GM1 ATM/ANS.OR.A.085(d) Aeronautical data quality management

text: VALIDATION AND VERIFICATION — GENERAL

text: (a) Validation (1) Validation is the activity where a data element is checked as having a value that is fully applicable to the identity ascribed to the data element, or where a set of data elements are checked as being acceptable for their intended use. (2) The application of validation techniques considers the entire aeronautical data chain. This includes the validation performed by prior data chain participants and any requirements levied on the data supplier. (3) Examples of validation techniques (i) Validation by application One method of validation is to apply data under test conditions. In certain cases, this may not be practical. Validation by application is considered to be the most effective form of validation. For example, flight inspection of final approach segment data prior to publication can be used to ensure that the published data is acceptable. (ii) Logical consistency Logical consistency validates by comparing two different data sets or elements and identifying inconsistencies between values based on operative rules (e.g. business rules). (iii) Semantic consistency Semantic consistency validates by comparing data to an expected value or range of values for the data characteristics. (iv) Validation by sampling

text: Validation by sampling evaluates a representative sample of data and applies statistical analysis to determine the confidence in the data quality. (b) Verification (1) Verification is a process for checking the integrity of a data element whereby the data element is compared to another source, either from a different process or from a different point in the same process. While verification cannot ensure that the data is correct, it can be effective to ensure that the data has not been corrupted by the data process. (2) The application of verification techniques considers only the portion of the aeronautical data chain controlled by the organisation. Yet, verification techniques may be applied at multiple phases of the data processing chain. (3) Examples of verification techniques (i) Feedback Feedback testing is the comparison between the output and input state of a data set. (ii) Independent redundancy Independent redundancy testing involves processing the same data through two or more independent processes and comparing the data output of each process. (iii) Update comparison Updated data can be compared to its previous version. This comparison can identify all data elements that have changed. The list of changed elements can then be compared to a similar list generated by the supplier. A problem can be detected if an element is identified as changed on one list and not on the other.

text: GM2 ATM/ANS.OR.A.085(d) Aeronautical data quality management

text: VALIDATION AND VERIFICATION TECHNIQUES

text: Validation and verification techniques are employed throughout the data processing chain to ensure that the data meets the associated DQRs. More explanatory material may be found in Appendix C (Guidance on compliance with data processing requirements) to EUROCAE ED-76A ‘Standards for Processing Aeronautical Data’.

text: GM1 ATM/ANS.OR.A.085(e) Aeronautical data quality management

text: ELECTRONIC MEANS

text: The transmission of aeronautical data and aeronautical information may be done by various electronic means.

text: AMC1 ATM/ANS.OR.A.085(f) Aeronautical data quality management

text: FORMAL ARRANGEMENTS

text: Formal arrangements should include the following minimum content: (a) the aeronautical data to be provided; (b) the data quality requirements (DQRs) for each data item supplied according to the aeronautical data catalogue; (c) the method(s) for demonstrating that the data provided conforms with the specified requirements; (d) the action to be taken in the event of discovery of a data error or inconsistency in any data provided; (e) the following minimum criteria for notification of data changes: (1) criteria for determining the timeliness of data provision based on the operational or safety significance of the change; (2) any prior notice of expected changes; and (3) the means to be adopted for notification; (f) the party responsible for documenting data changes; (g) data exchange details such as format or format change processes; (h) any limitations on the use of data; (i) requirements for the production of data origination quality reports; (j) metadata to be provided; and (k) contingency requirements concerning the continuity of data provision.

text: GM1 ATM/ANS.OR.A.085(f) Aeronautical data quality management

text: FORMAL ARRANGEMENTS

text: ATM/ANS providers may use the predetermined template ‘Data Provision Agreement’ developed by EUROCONTROL (ADQ Formal Arrangement Template, version 1.1. issued on 22 February 2016.)

text: GM1 ATM/ANS.OR.A.085(i) Aeronautical data quality management

text: SOFTWARE

text: (a) A means by which the requirement in ATM/ANS.OR.A.085(i) can be met, is through the verification of software applied to a known executable version of the software in its target operating environment.

text: (b) The verification of software is a process of ensuring that the software meets the requirements for the specified application or intended use of the aeronautical data and aeronautical information. (c) The verification of software is an evaluation of the output of an aeronautical data and/or aeronautical information software development process to ensure correctness and consistency with respect to the inputs and applicable software standards, rules and conventions used in that process.

text: GM2 ATM/ANS.OR.A.085(i) Aeronautical data quality management

text: TOOLS

text: Tools can be qualified meeting point 2.4.5 Aeronautical Data Tool Qualification of EUROCAE ED- 76A/RTCA DO-200B ‘Standards for Processing Aeronautical Data’, dated June 2015.

text: GM1 ATM/ANS.OR.A.085(j) Aeronautical data quality management

text: DATA ERROR DETECTION TECHNIQUES

text: (a) Digital error detection techniques can be used to detect errors during the transmission or storage of data. An example of a digital error detection technique is the use of cyclic redundancy checks (CRCs). Coding techniques can be effective regardless of the transmission media (e.g. computer disks, modem communication, or internet). (b) Transmission of data via electronic/digital means (e.g. file transfer protocol (FTP) sites, web downloads, or email) may be subject to malicious attack that can corrupt the integrity of data for its intended use. Provision of means to mitigate the intentional corruption of digitally transmitted data may already exist within the organisational construct and operating procedures of participating entities. (c) The objective of data security is to ensure that data is received from a known source and that there is no intentional corruption during processing and exchange of data. (d) Records should be maintained to show what data security provisions have been implemented. (e) Provisions supporting this objective may include: (1) implementation of technical data security measures to provide authentication and prevent intentional corruption during exchange of data (e.g. secure hashes, secure transmissions, digital signatures); and (2) implementation of organisational data security measures to protect processing resources and prevent intentional corruption during processing of data.

text: GM2 ATM/ANS.OR.A.085(j) Aeronautical data quality management

text: DATA ERROR PROCESSING

text: More explanation and guidance may be found in Appendix C (Guidance on compliance with data processing requirements) to EUROCAE ED-76A.

text: GM1 ATM/ANS.OR.A.085(l) Aeronautical data quality management

text: ERROR HANDLING

text: (a) The term ‘error’ is understood as being defective, degraded, lost, misplaced or corrupted data elements, or data elements not meeting stated DQRs. (b) Guidance on how to detect, identify, report and address/resolve aeronautical data errors may be found in Appendix C (Guidance on compliance with data processing requirements) to EUROCAE ED-76A ‘Standards for Processing Aeronautical Data’.

text: GM1 ATM/ANS.OR.A.090(a) Common reference systems for air navigation

text: HORIZONTAL REFERENCE SYSTEM — WGS-84

text: (a) A reference system provides a definition of a coordinate system in terms of the position of an origin in space, the orientation of an orthogonal set of Cartesian axes, and a scale. A terrestrial reference system defines a spatial reference system in which positions of points anchored on the Earth’s solid surface have coordinates. Examples are WGS-84, ITRS/European Terrestrial Reference System (ETRS) and national reference systems. (b) WGS-84 defines, inter alia, a conventional terrestrial reference system, a reference frame and a reference ellipsoid. WGS-84 is currently the reference system ICAO requires for georeferencing aeronautical information. (c) Further explanation and guidance may be found in Annex B (Horizontal reference systems) to EUROCONTROL Specification for the Origination of Aeronautical Data, Volume 2: Guidance material (EUROCONTROL-SPEC-154, Edition 1.0 of 04/02/2013).

text: GM2 ATM/ANS.OR.A.090(a) Common reference systems for air navigation

text: TEMPORARY NON-COMPLIANCE OF GEOGRAPHICAL COORDINATES

text: In those particular cases where geographical coordinates have been transformed into WGS-84 coordinates by mathematical means and whose accuracy of original field work does not meet the applicable requirements contained in the aeronautical data catalogue, they should be identified until the time when they can be compliant.

text: AMC1 ATM/ANS.OR.A.090(b) Common reference systems for air navigation

text: VERTICAL REFERENCE SYSTEM

text: (a) A service provider should use the Earth Gravitational Model — 1996 (EGM-96), as the global gravity model. (b) When a geoid model other than the EGM-96 model is used, a description of the model used, including the parameters required for height transformation between the model and EGM-96, should be provided in the aeronautical information publication (AIP).

text: GM1 ATM/ANS.OR.A.090(b) Common reference systems for air navigation

text: MEAN SEA LEVEL

text: (a) The geoid globally most closely approximates mean sea level (MSL). It is defined as the equipotential surface in the gravity field of the Earth which coincides with the undisturbed MSL extended continuously through the continents. (b) Gravity-related heights (elevations) are also referred to as ‘orthometric heights’, while distances of points above the ellipsoid are referred to as ‘ellipsoidal heights’. (c) Global and local geoids differ in their origin: global geoids consider only the long- and middlewave part of the Earth’s gravity field, whilst local geoids also consider the short-wave part of the gravity field. Global geoids are used when consistent orthometric heights, over long distances (continent or earth surveying), are required. Currently, the world’s best global geoid model is EGM 200846. It was determined using satellite tracking, gravity anomalies and satellite altimetry. Its accuracy is in the range of ± 0.05 m (oceans) and ± 0.5 m (on land). This accuracy is higher in flat regions than in topographically mountainous terrain, such as the Alps. (d) For local engineering applications and cadastre-surveying, global geoids are not as accurate as needed. For such applications, local geoid models are calculated. These can only be developed using local field measurements. They offer centimetre accuracy over several hundred kilometres, with a high resolution. Local geoids are not suitable for height comparison over large distances since they are based on different origins and reference heights (different equipotential levels).

text: GM2 ATM/ANS.OR.A.090(b) Common reference systems for air navigation

text: VERTICAL REFERENCE SYSTEM

text: Further explanation and guidance may be found in Annex C (Vertical reference systems) to EUROCONTROL Specification for the Origination of Aeronautical Data, Volume 2 (EUROCONTROL- SPEC-154, Edition 1.0 of 04/02/2013).

text: GM1 ATM/ANS.OR.A.090(c) Common reference systems for air navigation

text: TEMPORAL REFERENCE SYSTEM

text: (a) A value in the time domain is a temporal position measured relative to a temporal reference system. (b) ISO Standard 8601 specifies the use of the Gregorian calendar and 24-hour local or UTC for information interchange, while ISO Standard 19108 prescribes the Gregorian calendar and UTC as the primary temporal reference system for use with geographic information.

text: GM1 ATM/ANS.OR.B.005 Management system

text: DEFINITIONS AND CONCEPT OF MANAGEMENT SYSTEM

text: (a) ISO 9000:2005 series of standards defines a management system as a 'set of interrelated or interacting elements to establish policy and objectives and to achieve those objectives'. [...]