132 The documentation of a PNT-DP should cover at least
133 The documentation should be provided, preferably in an electronic format.
E.1 Operating manual
134 The operating manual should include:
-
.1 the specification of application grades including associated accuracy and
integrity levels of data output supported by the specific version of PNT-DP;
-
.2 a statement on the input data that are necessary for the nominal operation
of PNT-DP;
-
.3 the functional architecture of PNT-DP;
-
.4 a statement on which operating modes are supported by the PNT-DP
(including fall-back options) with details of applied functions and methods,
their arrangement in data processing chains, and resulting implication on
PNT data output provision;
-
.5 relevant information on applied means to achieve spatial and temporal
synchronization of input data coming from different sensors, services and
systems;
-
.6 the description of dependencies between performance of data input (e.g.
availability, accuracy, …), applicable data processing methods including
their capability and supported output data provision (application degree,
accuracy and integrity level);
-
.7 a comprehensive description of the internally applied status and integrity
monitoring in relation to
-
.1 used performance identifiers, test methods, and thresholds for
decision finding;
-
.2 consideration of integrity and status data provided by external
sensors, services as well as systems; and
-
.3 their contribution to integrity and status data at data output of
PNT-DP;
-
.8 a complete list of internal and external failures and disturbances in
accordance with failure analysis (see E.4) including the description of
-
.1 effects on data processing under consideration of applied methods;
-
.2 supported means for detection and compensation; and
-
.3 effects on the provided PNT data output.
135 Additionally, for further harmonization the manufacturer is encouraged to use the
operating manual to inform about
-
.1 nominal operation conditions for the operating modes of the specific
PNT-DP;
-
.2 reliability of PNT data provision per operating mode under nominal
condition (simulation based and/or experimentally evaluated);
-
.3 effectiveness of supported integrity monitoring methods regarding
detectability of failures and disturbances (internal as well as external
error sources); and
-
.4 the residual integrity risk of the provided integrity data for the
intended accuracy level.
E.2 Installation manual
136 The installation manual should include:
-
.1 a list of input data needed for nominal operation of the PNT-DP;
-
.2 comprehensive specification of data interfacing under consideration of all
supported operating modes of PNT-DP;
-
.3 a statement on which operating system environments the installation and
operation of PNT-DP's software is possible; and
-
.4 recommendations for software installation and maintenance.
137 Due to its safety-relevance the PNT-DP should be subjected to integration and
system tests in the operational environment. For this purpose the installation
manual should include:
-
.1 a description of proposed tests and their importance for quality
assurance; and
-
.2 recommendations for test planning, realization, and analysis.
E.3 Configuration manual
138 The configuration of PNT-DP is only realized during installation or
maintenance by authorized personnel. The manufacturer of PNT-DP should additionally
provide a tool supporting the generation and editing of the configuration as well as
samples of configurations containing default values. The configuration manual should
include:
-
.1 recommendations for the use of configuration tool;
-
.2 a list of configuration parameters; and
-
.3 a description of all contained configuration parameters including meaning,
default values and allowed value ranges.
139 Configuration parameters may be used by the manufacturer to adjust:
-
.1 deviations from default conditions;
-
.2 redundancy arrangements;
-
.3 backup arrangements; and
-
.4 threshold-influencing data processing and selection.
E.4 Failure analysis
140 A failure analysis, at functional level, should be performed and documented for
the PNT-DP. The results of the failure analysis serves as evidence that the PNT-DP
is designed on "fail-safe" principle. Within the failure analysis the impact of all
internal and external failures should be considered in relation to feasibility and
performance of operation modes supported by the PNT-DP.
E.5 Onboard familiarization material
141 Familiarization material should be provided to explain the used configuration and
applied functions in relation to benefit and limitations of the data processing
performed by the PNT-DP.
142 The familiarization material should inform about status and integrity data to
enable a correct interpretation of their meaning and safety significance.