The way ATM system providers and ANSPs work together is changing. Regulations (EU) 2023/1768 on the certification and declaration of ATM/ANS equipment and 2023/1769 on Design or Production Organisation (DPO) approval introduce a new European framework that shifts part of the technical assurance from ANSPs to system providers. Under the new regime, EASA becomes the central approval authority for certified ATM/ANS equipment across Europe.
The five year transition period ends on September 12, 2028 and the industry is adjusting but many questions remain unanswered. In this two article series, I’ll look at the reasoning behind this change, what it means for ANSPs and industry providers alike, and the implications for all stakeholders.
Shifting the certification onus from ANSPs to industry
The DPO acronym is new to the ATM industry but not to EASA: it is well known in the aircraft and aircraft equipment industry. Aircraft manufacturers and equipment manufacturers, like avionics or engine providers, design and produce equipment and are therefore DPOs. They provide aircraft to airlines and other aircraft operators which operate and maintain them without changing their design. EASA maintains oversight of both, making certification valid throughout the European continent.
ANSPs are essentially responsible for ensuring that their ATM system (comprised of equipment, humans and procedures) is fit for purpose, including the technical aspects. When the DPO framework is fully in place, equipment provided by DPOs will come with a seal of approval by EASA, valid everywhere in Europe. ANSPs will still be in charge of demonstrating the fitness for purpose of the integrated system but the technical responsibility should be easier as it will rely on the same equipment certification.
What will EASA certify?
Under regulation 2023/1768, EASA will oversee the certification and continued design approval of ATM equipment throughout its lifecycle. DPOs will have to inform the agency about every change and obtain formal approval for some, depending on their criticality. Once approved, the changes can be rolled-out everywhere in Europe without needing local recertifications, as long as each ANSP demonstrates that the overall system remains safe.
To get their equipment certified, providers themselves will require certification as a DPO by EASA, under 2023/1769. Certifying organisations rather than reviewing every engineering activity individually enables EASA to place greater reliance on approved design processes.
The certification process is open and the first certificates have been issued already. The first DPO, MEP in the Netherlands, is a radio equipment manufacturer. Several organisations are currently progressing through the approval process.
DPOs and the new software delivery model
The new software delivery model (SDM) promoted by SESAR, industry providers and some ANSPs aims at splitting the monolithic ATM system from the past into smaller modules, using modern software technologies. Typical modules could be one safety net, a trajectory prediction module or a surveillance data processor. The underlying idea is that each module can be picked from the catalogue of multiple providers, and evolve and be maintained in isolation of the overall technical system, as long as its interface complies with the SDM.
On paper, combining the new software delivery model and the DPO framework will facilitate the evolution of ATM systems across Europe. The SDM will ensure an easy technical integration while the DPO framework will shorten certification times. Once a module is certified once, it can then be put in place everywhere without recertification.
There are still grey areas and experience will demonstrate how it works in practice, which is the topic for our second article in this series.
Will ANSPs have to be DPOs?
The purpose of the DPO framework is to mark a clear separation between system providers and ANSPs. At the moment, that separation is not always so clear. Some ANSPs develop parts of their own software or modify their systems to an extent that it sometimes crosses the line of design. To circle back to the airlines vs. aircraft manufacturer parallel, it would be like an airline redesigning parts of the cockpit equipment.
If an ANSP adjusts a system’s configuration within certain limits, they will not need to be certified as DPOs but if they make deeper modifications or are in charge of the system integration, it is another story – more about this in the second part…
