{
  "url": "https://openlegislation.uk/eu-regulation-2016-799/annex-1/appendix-12",
  "json_url": "https://openlegislation.uk/eu-regulation-2016-799/annex-1/appendix-12.json",
  "legislation": "eur/2016/799",
  "legislation_title": "Commission Implementing Regulation (EU) 2016/799 of 18 March 2016 implementing Regulation (EU) No 165/2014 of the European Parliament and of the Council laying down the requirements for the construction, testing, installation, operation and repair of tachographs and their components (Text with EEA relevance)",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2016-799",
  "path": "annex/1/appendix/12",
  "kind": "appendix",
  "number": "12",
  "heading": null,
  "text": "POSITIONING BASED ON GLOBAL NAVIGATION SATELLITE SYSTEM (GNSS)\n1.\nINTRODUCTION\nThis Appendix provides the technical requirements for the GNSS data used by the Vehicle Unit, including the protocols that must be implemented to assure the secure and correct data transfer of the positioning information.\nThe main articles in this Regulation (EU) No 165/2014 driving these requirements are: ‘Article 8 Recording of the position of the vehicle at certain points during the daily working period’, ‘Article 10 Interface with Intelligent Transport Systems’ and ‘Article 11 Detailed provisions for smart tachographs’.\n1.1.\nScope\nGNS_1\nThe Vehicle Unit shall collect location data from at least one GNSS to support the implementation of Article 8.\nThe Vehicle Unit may be with or without an external GNSS facility as described in Figure 1:\nFigure 1\nDifferent configurations for GNSS receiver\n1.2.\nAcronyms and notations\nThe following acronyms are used in this appendix:\nDOPDilution of Precision\nEGFElementary file GNSS Facility\nEGNOSEuropean Geostationary Navigation Overlay Service\nGNSSGlobal Navigation Satellite System\nGSAGPS DOP and active satellites\nHDOPHorizontal Dilution of Precision\nICDInterface Control Document\nNMEANational Marine Electronics Association\nPDOPPosition Dilution of Precision\nRMCRecommended Minimum Specific\nSISSignal in Space\nVDOPVertical Dilution of Precision\nVUVehicle Unit\n2.\nSPECIFICATION OF THE GNSS RECEIVER\nRegardless of the configuration of the Smart Tachograph with or without an external GNSS facility, the provision of accurate and reliable positioning information is an essential element of the effective operation of the Smart Tachograph. Therefore, it is appropriate to require its compatibility with the services provided by the Galileo and European Geostationary Navigation Overlay Service (EGNOS) programmes as set out in Regulation (EU) No 1285/2013 of the European Parliament and of the Council. The system established under the Galileo programme is an independent global satellite navigation system and the one established under the EGNOS programme is a regional satellite navigation system improving the quality of the Global Positioning System signal.\nGNS_2\nManufacturers shall ensure that the GNSS receivers in the Smart Tachographs are compatible with the positioning services provided by the Galileo and the EGNOS systems. Manufacturers may also choose, in addition, compatibility with other satellite navigation systems.\nGNS_3\nThe GNSS receiver shall have the capability to support Authentication on the Open Service of Galileo when such service will be provided by the Galileo system and supported by GNSS receiver manufacturers. However, for smart tachographs introduced in the market before the previous conditions are satisfied and not having the capability to support Authentication of the Open Service of Galileo, no retrofitting will be required.\n3.\nNMEA SENTENCES\nThis section describes the NMEA sentences used in the functioning of the Smart Tachograph. This section is valid both for the configuration of the Smart Tachograph with or without an external GNSS facility.\nGNS_4\nThe location data is based on the NMEA sentence Recommended Minimum Specific (RMC) GNSS Data, which contains the Position information (Latitude, Longitude), Time in UTC format (hhmmss.ss), and Speed Over Ground in Knots plus additional values.\nThe format of the RMC sentence is the following (as from NMEA V4.1 standard):\nFigure 2\nStructure of the RMC sentence\nThe Status gives indication if the GNSS signal is available. Until the value of the Status is not set to A, the received data (e.g., on Time or Latitude/Longitude) cannot be used to record the position of the vehicle in the VU.\nThe resolution of the position is based on the format of the RMC sentence described above. The first part of the fields 3) and 5) are used to represent the degrees. The rest are used to represent the minutes with three decimals. So the resolution is 1/1000 of minute or 1/60000 of degree (because one minute is 1/60 of a degree).\nGNS_5\nThe Vehicle Unit shall store in the VU database the position information for latitude and longitude with a resolution of 1/10 of minute or 1/600 of a degree as described in Appendix 1 for type GeoCoordinates.\nThe GPS DOP and active satellites (GSA) command can be used by the VU to determine and record the signal availability and accuracy. In particular the HDOP is used to provide an indication on the level of accuracy of the recorded location data (see 4.2.2). The VU will store the value of the Horizontal Dilution of Precision (HDOP) calculated as the minimum of the HDOP values collected on the available GNSS systems.\nThe GNSS Id. indicates the corresponding NMEA Id. for every GNSS constellation and Satellite-Based Augmentation System (SBAS).\nFigure 3\nStructure of the GSA sentence\nGNS_6\nThe GSA sentence shall be stored with record number ‘02’ to ‘06’.\nGNS_7\nThe maximum size of the NMEA sentences (e.g., RMC, GSA or others), which can be used for the sizing of the read record command shall be 85 bytes (see Table 1).\n4.\nVEHICLE UNIT WITH AN EXTERNAL GNSS FACILITY\n4.1.\nConfiguration\n4.1.1\nMain components and interfaces\nIn this configuration, the GNSS receiver is a part of the external GNSS facility.\nGNS_8\nThe external GNSS facility must be powered with a specific vehicle interface.\nGNS_9\nThe external GNSS facility shall consist of the following components (see Figure 4):\n(a)A commercial GNSS receiver to provide the position data through the GNSS data interface. For example, the GNSS data interface can be NMEA standard V4.10 where The GNSS receiver acts as a talker and transmit NMEA sentences to the GNSS Secure Transceiver with a frequency of 1Hz for the pre-defined set of NMEA sentences, which must include at least the RMC and GSA sentences. The implementation of the GNSS data interface is a choice of the manufacturers of the external GNSS facility.\n(b)A transceiver unit (GNSS Secure Transceiver) with the capability to support standard ISO/IEC 7816-4:2013 (see 4.2.1) to communicate with the vehicle unit and support the GNSS data interface to the GNSS receiver. The unit is provided with a memory to store the identification data of the GNSS receiver and external GNSS facility.\n(c)An enclosure system with tamper detection function, which encapsulate both the GNSS receiver and the GNSS Secure Transceiver. The tamper detection function shall implement the security protection measures as requested in the Protection Profile of the Smart Tachograph.\n(d)A GNSS antenna installed on the vehicle and connected to the GNSS receiver through the enclosure system.\nGNS_10\nThe external GNSS facility has at least the following external interfaces:\n(a)the interface to the GNSS antenna installed on the vehicle truck, if an external antenna is used.\n(b)the interface to the Vehicle Unit.\nGNS_11\nIn the VU, the VU Secure Transceiver is the other end of the secure communication with the GNSS Secure Transceiver and it must support ISO/IEC 7816-4:2013 for the connection to the external GNSS facility.\nGNS_12\nFor the physical layer of the communication with the external GNSS facility, the vehicule unit shall support ISO/IEC 7816-12:2005 or another standard able to support ISO/IEC 7816-4:2013. (see 4.2.1).\n4.1.2\nExternal GNSS facility state at the end of production\nGNS_13\nThe external GNSS facility shall store the following values in the non-volatile memory of the GNSS Secure Transceiver when it leaves the factory:\nthe EGF_MA key pair and corresponding certificate,\nthe MSCA_VU-EGF certificate containing the MSCA_VU-EGF.PK public key to be used for verification of the EGF_MA certificate,\nthe EUR certificate containing the EUR.PK public key to be used for verification of the MSCA_VU-EGF certificate,\nthe EUR certificate whose validity period directly precedes the validity period of the EUR certificate to be used to verify the MSCA_VU-EGF certificate, if existing,\nthe link certificate linking these two EUR certificates, if existing,\nthe extended serial-number of the external GNSS facility,\noperating system identifier of the GNSS facility,\ntype approval number of the external GNSS facility;\nIdentifier of the security component of the external GNSS module.\n4.2.\nCommunication between the external GNSS facility and the vehicle unit\n4.2.1\nCommunication Protocol\nGNS_14\nThe communication protocol between the external GNSS facility and the vehicle unit shall support three functions:\n1..The collection and distribution of GNSS data (e.g., position, timing, speed),\n2..The collection of the configuration data of the external GNSS facility,\n3..The management protocol to support the coupling, mutual authentication and session key agreement between the external GNSS facility and the VU.\nGNS_15\nThe communication protocol shall be based on standard ISO/IEC 7816-4:2013 with the VU Secure Transceiver playing the master role and the GNSS Secure Transceiver playing the slave role. The physical connection between the external GNSS facility and the vehicule unit is based on ISO/IEC 7816-12:2005 or another standard able to support ISO/IEC 7816-4:2013\nGNS_16\nIn the communication protocol, extended length fields shall not be supported.\nGNS_17\nThe communication protocol of ISO 7816 (both *-4:2013 and *-12:2005) between the external GNSS facility and the VU shall be set to T = 1.\nGNS_18\nRegarding the functions 1) the collection and distribution of GNSS data and 2) the collection of the configuration data of the external GNSS facility and 3) management protocol, the GNSS Secure Transceiver shall simulate a smart card with a file system architecture composed by a Master File (MF), a Dedicated File (DF) with Application Identifier specified in Appendix 1 chapter 6.2 (‘FF 44 54 45 47 4D’) and with 3 EFs containing certificates and one single Elementary File (EF.EGF) with file identifier equal to ‘2F2F’ as described in Table 1.\nGNS_19\nThe GNSS Secure Transceiver shall store the data coming from the GNSS receiver and the configuration in the EF.EGF. This is a linear, variable-length record file with an identifier equal to ‘2F2F’ in hexadecimal format.\nGNS_20\nThe GNSS Secure Transceiver shall use a memory to store the data and be able to perform at least 20 millions write/read cycles. Apart from this aspect, the internal design and implementation of the GNSS Secure Transceiver is left to the manufacturers.\nThe mapping of record numbers and data is provided in Table 1. Note that there are five GSA sentences for the GNSS constellations and Satellite-Based Augmentation System (SBAS).\nGNS_21\nThe file structure is provided in Table 1. For the access conditions (ALW, NEV, SM-MAC) see Appendix 2 chapter 3.5.\nTable 1\nFile Structure\nAccess conditions\nFile\nFile ID\nRead\nUpdate\nEncrypted\nMF\n3F00\nEF.ICC\n0002\nALW\nNEV\n(by VU)\nNo\nDF GNSS Facility\n0501\nALW\nNEV\nNo\nEF EGF_MACertificate\nC100\nALW\nNEV\nNo\nEF CA_Certificate\nC108\nALW\nNEV\nNo\nEF Link_Certificate\nC109\nALW\nNEV\nNo\nEF.EGF\n2F2F\nSM-MAC\nNEV\n(by VU)\nNo\nFile / Data element\nRecord no\nSize (bytes)\nDefault values\nMin\nMax\nMF\n552\n1 031\nEF.ICC\nsensorGNSSSerialNumber\n8\n8\nDF GNSS Facility\n612\n1 023\nEF EGF_MACertificate\n204\n341\nEGFCertificate\n204\n341\n{00..00}\nEF CA_Certificate\n204\n341\nMemberStateCertificate\n204\n341\n{00..00}\nEF Link_Certificate\n204\n341\nLinkCertificate\n204\n341\n{00..00}\nEF.EGF\nRMC NMEA Sentence\n‘01’\n85\n85\n1st GSA NMEA Sentence\n‘02’\n85\n85\n2nd GSA NMEA Sentence\n‘03’\n85\n85\n3rd GSA NMEA Sentence\n‘04’\n85\n85\n4th GSA NMEA Sentence\n‘05’\n85\n85\n5th GSA NMEA Sentence\n‘06’\n85\n85\nExtended serial-number of the external GNSS facility defined in Appendix 1 as SensorGNSSSerialNumber.\n‘07’\n8\n8\nOperating system identifier of the GNSS Secure Transceiver defined in Appendix 1 as SensorOSIdentifier.\n‘08’\n2\n2\nType approval number of the external GNSS facility defined in Appendix 1 as SensorExternalGNSSApprovalNumber.\n‘09’\n16\n16\nIdentifier of the security component of the external GNSS facility defined in Appendix 1 as SensorExternalGNSSSCIdentifier\n‘10’\n8\n8\nRFU — Reserved for Future Use\nFrom ‘11’ to ‘FD’\n4.2.2\nSecure transfer of GNSS data\nGNS_22\nThe secure transfer of GNSS position data shall be allowed only in the following conditions:\n1..The coupling process has been completed as described in Appendix 11. Common security mechanisms.\n2..The periodic mutual authentication and session key agreement between the VU and the external GNSS facility also described in Appendix 11. Common security mechanisms has been executed with the indicated frequency.\nGNS_23\nEvery T seconds, where T is a value lower or equal to 10, unless coupling or mutual authentication and session key agreement takes place, the VU requests from the external GNSS facility the position information on the basis of the following flow:\n1..The VU requests location data from the External GNSS facility together with Dilution of Precision data (from the GSA NMEA sentence). The VU Secure Transceiver shall use the ISO/IEC 7816-4:2013 SELECT and READ RECORD(S) command in secure messaging authentication-only mode as described in Appendix 11 section 11.5 with the file identifier ‘2F2F’ and RECORD number equal to ‘01’ for RMC NMEA sentence and ‘02’,‘03’,‘04’,‘05’,‘06’ for GSA NMEA sentence.\n2..The last location data received is stored in the EF with identifier ‘2F2F’ and the records described in Table 1 in the GNSS secure transceiver as the GNSS secure transceiver receives NMEA data with a frequency of at least 1 Hz from the GNSS receiver through the GNSS data interface.\n3..The GNSS Secure Transceiver sends the response to the VU Secure Transceiver by using the APDU response message in secure messaging authentication-only mode as described in Appendix 11 section 11.5.\n4..The VU Secure Transceiver checks the authenticity and integrity of the received response. In case of positive outcome, the location data is transferred to the VU processor through the GNSS data interface.\n5..The VU processor checks the received data extracting the information (e.g., latitude, longitude, time) from the RMC NMEA sentence. The RMC NMEA sentence includes the information if the position is valid. If the position is not valid, the location data is not available yet and it cannot be used to record the position of the vehicle. If the position is valid, the VU processor also extracts the values of HDOP from GSA NMEA sentences and calculate the minimum value on the available satellite systems (i.e., when the fix is available).\n6..The VU processor stores the received and processed information such as latitude, longitude, time and speed in the VU in the format defined in Appendix 1 Data Dictionary as GeoCoordinates together with the value of HDOP calculated as the minimum of the HDOP values collected on the available GNSS systems.\n4.2.3\nStructure of the Read Record command\nThis section describes in detail the structure of the Read Record command. Secure messaging (authentication-only mode) is added as described in Appendix 11 Common security mechanisms.\nGNS_24\nThe command shall support the Secure Messaging authentication-only-mode, see Appendix 11.\nGNS_25\nCommand Message\nByte\nLength\nValue\nDescription\nCLA\n1\n‘0Ch’\nSecure messaging asked.\nINS\n1\n‘B2h’\nRead Record\nP1\n1\n‘XXh’\nRecord number (‘00’ references the current record)\nP2\n1\n‘04h’\nRead the record with the record number indicated in P1\nLe\n1\n‘XXh’\nLength of data expected. Number of Bytes to be read.\nGNS_26\nThe record referenced in P1 becomes the current record.\nByte\nLength\nValue\nDescription\n#1-#X\nX\n‘XX..XXh’\nData read\nSW\n2\n‘XXXXh’\nStatus Words (SW1,SW2)\nIf the command is successful, the GNSS secure transceiver returns ‘9000’.\nIf the current file is not record oriented, the GNSS secure transceiver returns ‘6981’.\nIf the command is used with P1 = ‘00’ but there is no current EF the GNSS secure transceiver returns ‘6986’ (command not allowed).\nIf the record is not found, the GNSS secure transceiver returns ‘6A 83’.\nIf the external GNSS facility has detected tampering, it shall return status words ‘66 90’.\nGNS_27\nThe GNSS Secure Transceiver shall support the following tachograph generation 2 commands specified in Appendix 2:\nCommand\nReference\nSelect\nAppendix 2 chapter 3.5.1\nRead Binary\nAppendix 2 chapter 3.5.2\nGet Challenge\nAppendix 2 chapter 3.5.4\nPSO: Verify Certificate\nAppendix 2 chapter 3.5.7\nExternal Authenticate\nAppendix 2 chapter 3.5.9\nGeneral Authenticate\nAppendix 2 chapter 3.5.10\nMSE:SET\nAppendix 2 chapter 3.5.11\n4.3.\nCoupling, mutual authentication and session key agreement of the external GNSS facility with vehicle unit\nThe coupling, mutual authentication and session key agreement of the external GNSS facility with the vehicle unit is described in Appendix 11. Common security mechanisms, Chapter 11.\n4.4.\nError Handling\nThis section describes how potential error conditions by the external GNSS facility are addressed and recorded in the VU.\n4.4.1\nCommunication error with the external GNSS facility\nGNS_28\nIf the VU does not manage to communicate to the coupled external GNSS facility for more than 20 continuous minutes, the VU shall generate and record in the VU an event of type EventFaultType with the value of enum ‘0E’H Communication error with the external GNSS facility and with the timestamp set to the current time. The event will be generated only if the following two conditions are satisfied: (a) the Smart Tachograph is not in calibration mode and (b) the vehicle is moving. In this context, a communication error is triggered when the VU Secure Transceiver does not receive a response message after a request message as described in 4.2.\n4.4.2\nBreach of the physical integrity of the external GNSS facility\nGNS_29\nIf the external GNSS facility has been breached, the GNSS Secure Transceiver shall erase all its memory including cryptographic material. As described in GNS_25 and GNS_26, the VU shall detect tampering if the Response has status ‘6690’. The VU shall then generate an event of type EventFaultType enum ‘19’H Tamper detection of GNSS. Alternately, the external GNSS facility may not respond to any external request anymore.\n4.4.3\nAbsence of position information from GNSS receiver\nGNS_30\nIf the GNSS Secure Transceiver does not receive data from the GNSS receiver for more than 3 continuous hours, the GNSS Secure Transceiver shall generate a response message to the READ RECORD command with RECORD number equal to ‘01’ with a Data Field of 12 bytes all set to 0xFF. Upon reception of the Response message with this value of the data field, the VU shall generate and record an event of type EventFaultType enum ‘0D’H Absence of position information from GNSS receiver event with a timestamp equal to the current value of time only if the following two conditions are satisfied: a) the Smart Tachograph is not in calibration mode and b) the vehicle is moving.\n4.4.4\nExternal GNSS facility certificate expired\nGNS_31\nIf the VU detects that the EGF certificate used for mutual authentication is not valid any longer, the VU shall generate and record a recording equipment event of type EventFaultType enum ‘ 1B ’ H External GNSS facility certificate expired with a timestamp equal to the current value of time. The VU shall still use the received GNSS position data.\nFigure 4\nSchema of the external GNSS facility\n5.\nVEHICLE UNIT WITHOUT AN EXTERNAL GNSS FACILITY\n5.1.\nConfiguration\nIn this configuration, the GNSS receiver is inside the Vehicle Unit as described in Figure 1.\nGNS_32\nThe GNSS receiver shall act as a talker and transmit NMEA sentences to the VU processor, which shall act as a listener with a frequency of 1/10 Hz or faster for the pre-defined set of NMEA sentences, which shall include at least the RMC and GSA sentences.\nGNS_33\nAn external GNSS antenna installed on the vehicle or an internal GNSS antenna shall be connected to the VU.\n5.2.\nError Handling\n5.2.1\nAbsence of position information from GNSS receiver\nGNS_34\nIf the VU does not receive data from the GNSS receiver for more than 3 continous hours, the VU shall generate and record an event of type EventFaultType enum ‘0D’H Absence of position information from GNSS receiver event with a timestamp equal to the current value of time only if the following two conditions are satisfied: (a) the Smart Tachograph is not in calibration mode and (b) the vehicle is moving.\n6.\nGNSS TIME CONFLICT\nIf the VU detects a discrepancy of more than 1 minute between the time of the vehicle unit's time measurement function and the time originating from the GNSS receiver, the VU will record an event of type EventFaultType enum ‘ 0B ’ H Time conflict (GNSS versus VU internal clock) . After a time conflict event has been triggered, the VU will not check the time discrepancy for the next 12 hours. This event shall not be triggered in cases no valid GNSS signal was detectable by the GNSS receiver within the last 30 days.\n7.\nVEHICLE MOTION CONFLICT\nGNS_35\nThe VU shall trigger and record an Vehicle Motion Conflict event (see in requirement 84 in this Annex) with a timestamp equal to the current value of time, in case motion information calculated from the motion sensor is contradicted by motion information calculated from the internal GNSS receiver or from the external GNSS facility. For the purpose of detecting such contradictions, the median value of the speed differences between these sources shall be used, as specified below:\nevery 10 seconds maximum, the absolute value of the difference between the vehicle speed estimated from the GNSS and the one estimated from the motion sensor shall be computed.\nall the computed values in a time window containing the last five minutes of movement shall be used to compute the median value.\nthe median value shall be computed as the average of 80 % of the remaining values, after having eliminated the highest ones in absolute values\nThe Vehicle Motion Conflict event shall be triggered if the median value is above 10 Km/h for five uninterrupted minutes of vehicle movement. Other independent sources of vehicle motion detection may optionnally be used, so that a more reliable detection of tachograph manipulations is provided. (Note: the use of the median on the last 5 minutes is applied to mitigate the risk of measurement outliers and transient values). This event shall not be triggered in the following conditions: (a) during a ferry/train crossing, (b) when the position information from the GNSS receiver shall not be available and (c) while in calibration mode.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Substituted by Commission Implementing Regulation (EU) 2018/502 of 28 February 2018 amending Implementing Regulation (EU) 2016/799 laying down the requirements for the construction, testing, installation, operation and repair of tachographs and their components (Text with EEA relevance)."
    },
    {
      "type": "footnote",
      "label": "f1",
      "text": "Regulation (EU) No 1285/2013 of the European Parliament and of the Council of 11 December 2013 on the implementation and exploitation of European satellite navigation systems and repealing Council Regulation (EC) No 876/2002 and Regulation (EC) No 683/2008 of the European Parliament and of the Council (OJ L 347, 20.12.2013, p. 1)."
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2016/799/annex/1/appendix/12",
    "retrieved_at": "2026-11-01T14:45:49.686558+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}