Appendix 12

This Appendix provides the technical requirements for the GNSS data used by the Vehicle Unit, including the protocols that must be implemented to assure the secure and correct data transfer of the positioning information.

The main articles in this Regulation (EU) No 165/2014 driving these requirements are: ‘Article 8 Recording of the position of the vehicle at certain points during the daily working period’, ‘Article 10 Interface with Intelligent Transport Systems’ and ‘Article 11 Detailed provisions for smart tachographs’.

The Vehicle Unit shall collect location data from at least one GNSS to support the implementation of Article 8.

The Vehicle Unit may be with or without an external GNSS facility as described in Figure 1:

The following acronyms are used in this appendix:

Regardless of the configuration of the Smart Tachograph with or without an external GNSS facility, the provision of accurate and reliable positioning information is an essential element of the effective operation of the Smart Tachograph. Therefore, it is appropriate to require its compatibility with the services provided by the Galileo and European Geostationary Navigation Overlay Service (EGNOS) programmes as set out in Regulation (EU) No 1285/2013 of the European Parliament and of the Council^f1. The system established under the Galileo programme is an independent global satellite navigation system and the one established under the EGNOS programme is a regional satellite navigation system improving the quality of the Global Positioning System signal.

Manufacturers shall ensure that the GNSS receivers in the Smart Tachographs are compatible with the positioning services provided by the Galileo and the EGNOS systems. Manufacturers may also choose, in addition, compatibility with other satellite navigation systems.

The GNSS receiver shall have the capability to support Authentication on the Open Service of Galileo when such service will be provided by the Galileo system and supported by GNSS receiver manufacturers. However, for smart tachographs introduced in the market before the previous conditions are satisfied and not having the capability to support Authentication of the Open Service of Galileo, no retrofitting will be required.

This section describes the NMEA sentences used in the functioning of the Smart Tachograph. This section is valid both for the configuration of the Smart Tachograph with or without an external GNSS facility.

The location data is based on the NMEA sentence Recommended Minimum Specific (RMC) GNSS Data, which contains the Position information (Latitude, Longitude), Time in UTC format (hhmmss.ss), and Speed Over Ground in Knots plus additional values.

The format of the RMC sentence is the following (as from NMEA V4.1 standard):

The GPS DOP and active satellites (GSA) command can be used by the VU to determine and record the signal availability and accuracy. In particular the HDOP is used to provide an indication on the level of accuracy of the recorded location data (see 4.2.2). The VU will store the value of the Horizontal Dilution of Precision (HDOP) calculated as the minimum of the HDOP values collected on the available GNSS systems.

The GNSS Id. indicates the corresponding NMEA Id. for every GNSS constellation and Satellite-Based Augmentation System (SBAS).

The GSA sentence shall be stored with record number ‘02’ to ‘06’.

The maximum size of the NMEA sentences (e.g., RMC, GSA or others), which can be used for the sizing of the read record command shall be 85 bytes (see Table 1).

In this configuration, the GNSS receiver is a part of the external GNSS facility.

The external GNSS facility must be powered with a specific vehicle interface.

1. (a)

   A commercial GNSS receiver to provide the position data through the GNSS data interface. For example, the GNSS data interface can be NMEA standard V4.10 where The GNSS receiver acts as a talker and transmit NMEA sentences to the GNSS Secure Transceiver with a frequency of 1Hz for the pre-defined set of NMEA sentences, which must include at least the RMC and GSA sentences. The implementation of the GNSS data interface is a choice of the manufacturers of the external GNSS facility.

2. (b)

   A transceiver unit (GNSS Secure Transceiver) with the capability to support standard ISO/IEC 7816-4:2013 (see 4.2.1) to communicate with the vehicle unit and support the GNSS data interface to the GNSS receiver. The unit is provided with a memory to store the identification data of the GNSS receiver and external GNSS facility.

3. (c)

   An enclosure system with tamper detection function, which encapsulate both the GNSS receiver and the GNSS Secure Transceiver. The tamper detection function shall implement the security protection measures as requested in the Protection Profile of the Smart Tachograph.

4. (d)

   A GNSS antenna installed on the vehicle and connected to the GNSS receiver through the enclosure system.

1. (a)

   the interface to the GNSS antenna installed on the vehicle truck, if an external antenna is used.

2. (b)

   the interface to the Vehicle Unit.

In the VU, the VU Secure Transceiver is the other end of the secure communication with the GNSS Secure Transceiver and it must support ISO/IEC 7816-4:2013 for the connection to the external GNSS facility.

For the physical layer of the communication with the external GNSS facility, the vehicule unit shall support ISO/IEC 7816-12:2005 or another standard able to support ISO/IEC 7816-4:2013. (see 4.2.1).

• the EGF_MA key pair and corresponding certificate,

• the MSCA_VU-EGF certificate containing the MSCA_VU-EGF.PK public key to be used for verification of the EGF_MA certificate,

• the EUR certificate containing the EUR.PK public key to be used for verification of the MSCA_VU-EGF certificate,

• the EUR certificate whose validity period directly precedes the validity period of the EUR certificate to be used to verify the MSCA_VU-EGF certificate, if existing,

• the link certificate linking these two EUR certificates, if existing,

• the extended serial-number of the external GNSS facility,

• operating system identifier of the GNSS facility,

• type approval number of the external GNSS facility;

• Identifier of the security component of the external GNSS module.

1. 1..

   The collection and distribution of GNSS data (e.g., position, timing, speed),

2. 2..

   The collection of the configuration data of the external GNSS facility,

3. 3..

   The management protocol to support the coupling, mutual authentication and session key agreement between the external GNSS facility and the VU.

The communication protocol shall be based on standard ISO/IEC 7816-4:2013 with the VU Secure Transceiver playing the master role and the GNSS Secure Transceiver playing the slave role. The physical connection between the external GNSS facility and the vehicule unit is based on ISO/IEC 7816-12:2005 or another standard able to support ISO/IEC 7816-4:2013

In the communication protocol, extended length fields shall not be supported.

The communication protocol of ISO 7816 (both *-4:2013 and *-12:2005) between the external GNSS facility and the VU shall be set to T = 1.

Regarding the functions 1) the collection and distribution of GNSS data and 2) the collection of the configuration data of the external GNSS facility and 3) management protocol, the GNSS Secure Transceiver shall simulate a smart card with a file system architecture composed by a Master File (MF), a Dedicated File (DF) with Application Identifier specified in Appendix 1 chapter 6.2 (‘FF 44 54 45 47 4D’) and with 3 EFs containing certificates and one single Elementary File (EF.EGF) with file identifier equal to ‘2F2F’ as described in Table 1.

The GNSS Secure Transceiver shall store the data coming from the GNSS receiver and the configuration in the EF.EGF. This is a linear, variable-length record file with an identifier equal to ‘2F2F’ in hexadecimal format.

The mapping of record numbers and data is provided in Table 1. Note that there are five GSA sentences for the GNSS constellations and Satellite-Based Augmentation System (SBAS).

1. 1..

   The coupling process has been completed as described in Appendix 11. Common security mechanisms.

2. 2..

   The periodic mutual authentication and session key agreement between the VU and the external GNSS facility also described in Appendix 11. Common security mechanisms has been executed with the indicated frequency.

1. 1..

   The VU requests location data from the External GNSS facility together with Dilution of Precision data (from the GSA NMEA sentence). The VU Secure Transceiver shall use the ISO/IEC 7816-4:2013 SELECT and READ RECORD(S) command in secure messaging authentication-only mode as described in Appendix 11 section 11.5 with the file identifier ‘2F2F’ and RECORD number equal to ‘01’ for RMC NMEA sentence and ‘02’,‘03’,‘04’,‘05’,‘06’ for GSA NMEA sentence.

2. 2..

   The last location data received is stored in the EF with identifier ‘2F2F’ and the records described in Table 1 in the GNSS secure transceiver as the GNSS secure transceiver receives NMEA data with a frequency of at least 1 Hz from the GNSS receiver through the GNSS data interface.

3. 3..

   The GNSS Secure Transceiver sends the response to the VU Secure Transceiver by using the APDU response message in secure messaging authentication-only mode as described in Appendix 11 section 11.5.

4. 4..

   The VU Secure Transceiver checks the authenticity and integrity of the received response. In case of positive outcome, the location data is transferred to the VU processor through the GNSS data interface.

5. 5..

   The VU processor checks the received data extracting the information (e.g., latitude, longitude, time) from the RMC NMEA sentence. The RMC NMEA sentence includes the information if the position is valid. If the position is not valid, the location data is not available yet and it cannot be used to record the position of the vehicle. If the position is valid, the VU processor also extracts the values of HDOP from GSA NMEA sentences and calculate the minimum value on the available satellite systems (i.e., when the fix is available).

6. 6..

   The VU processor stores the received and processed information such as latitude, longitude, time and speed in the VU in the format defined in Appendix 1 Data Dictionary as GeoCoordinates together with the value of HDOP calculated as the minimum of the HDOP values collected on the available GNSS systems.

This section describes in detail the structure of the Read Record command. Secure messaging (authentication-only mode) is added as described in Appendix 11 Common security mechanisms.

The command shall support the Secure Messaging authentication-only-mode, see Appendix 11.

• If the command is successful, the GNSS secure transceiver returns ‘9000’.

• If the current file is not record oriented, the GNSS secure transceiver returns ‘6981’.

• If the command is used with P1 = ‘00’ but there is no current EF the GNSS secure transceiver returns ‘6986’ (command not allowed).

• If the record is not found, the GNSS secure transceiver returns ‘6A 83’.

• If the external GNSS facility has detected tampering, it shall return status words ‘66 90’.

The coupling, mutual authentication and session key agreement of the external GNSS facility with the vehicle unit is described in Appendix 11. Common security mechanisms, Chapter 11.

This section describes how potential error conditions by the external GNSS facility are addressed and recorded in the VU.

If the VU does not manage to communicate to the coupled external GNSS facility for more than 20 continuous minutes, the VU shall generate and record in the VU an event of type EventFaultType with the value of enum ‘0E’H Communication error with the external GNSS facility and with the timestamp set to the current time. The event will be generated only if the following two conditions are satisfied: (a) the Smart Tachograph is not in calibration mode and (b) the vehicle is moving. In this context, a communication error is triggered when the VU Secure Transceiver does not receive a response message after a request message as described in 4.2.

If the external GNSS facility has been breached, the GNSS Secure Transceiver shall erase all its memory including cryptographic material. As described in GNS_25 and GNS_26, the VU shall detect tampering if the Response has status ‘6690’. The VU shall then generate an event of type EventFaultType enum ‘19’H Tamper detection of GNSS. Alternately, the external GNSS facility may not respond to any external request anymore.

If the GNSS Secure Transceiver does not receive data from the GNSS receiver for more than 3 continuous hours, the GNSS Secure Transceiver shall generate a response message to the READ RECORD command with RECORD number equal to ‘01’ with a Data Field of 12 bytes all set to 0xFF. Upon reception of the Response message with this value of the data field, the VU shall generate and record an event of type EventFaultType enum ‘0D’H Absence of position information from GNSS receiver event with a timestamp equal to the current value of time only if the following two conditions are satisfied: a) the Smart Tachograph is not in calibration mode and b) the vehicle is moving.

If the VU detects that the EGF certificate used for mutual authentication is not valid any longer, the VU shall generate and record a recording equipment event of type EventFaultType enum ‘ 1B ’ H External GNSS facility certificate expired with a timestamp equal to the current value of time. The VU shall still use the received GNSS position data.

In this configuration, the GNSS receiver is inside the Vehicle Unit as described in Figure 1.

The GNSS receiver shall act as a talker and transmit NMEA sentences to the VU processor, which shall act as a listener with a frequency of 1/10 Hz or faster for the pre-defined set of NMEA sentences, which shall include at least the RMC and GSA sentences.

An external GNSS antenna installed on the vehicle or an internal GNSS antenna shall be connected to the VU.

If the VU does not receive data from the GNSS receiver for more than 3 continous hours, the VU shall generate and record an event of type EventFaultType enum ‘0D’H Absence of position information from GNSS receiver event with a timestamp equal to the current value of time only if the following two conditions are satisfied: (a) the Smart Tachograph is not in calibration mode and (b) the vehicle is moving.

If the VU detects a discrepancy of more than 1 minute between the time of the vehicle unit's time measurement function and the time originating from the GNSS receiver, the VU will record an event of type EventFaultType enum ‘ 0B ’ H Time conflict (GNSS versus VU internal clock) . After a time conflict event has been triggered, the VU will not check the time discrepancy for the next 12 hours. This event shall not be triggered in cases no valid GNSS signal was detectable by the GNSS receiver within the last 30 days.

• every 10 seconds maximum, the absolute value of the difference between the vehicle speed estimated from the GNSS and the one estimated from the motion sensor shall be computed.

• all the computed values in a time window containing the last five minutes of movement shall be used to compute the median value.

• the median value shall be computed as the average of 80 % of the remaining values, after having eliminated the highest ones in absolute values

The Vehicle Motion Conflict event shall be triggered if the median value is above 10 Km/h for five uninterrupted minutes of vehicle movement. Other independent sources of vehicle motion detection may optionnally be used, so that a more reliable detection of tachograph manipulations is provided. (Note: the use of the median on the last 5 minutes is applied to mitigate the risk of measurement outliers and transient values). This event shall not be triggered in the following conditions: (a) during a ferry/train crossing, (b) when the position information from the GNSS receiver shall not be available and (c) while in calibration mode.