THERE WAS A REPORT OF MALFUNCTION ON THE AUTOTHROTTLE A COUPLE OF DAYS BEFORE - Sriwijaya Flight SJ182 B737-500

 

There was a report of malfunction on the autothrottle a couple of days before to the technician in the maintenance log, said Nurcayho Utomo.

Autothrottle (A/T) Computer Modification

On 16 November 2000, the FAA issued Airworthiness Directive (AD) number FAA AD 2000-23-34 to replace the existing A/T computer with a new P/N. The FAA AD refers to the Boeing Service Bulletin number SB 737-22A1130 dated 24 September 1998.

The AD was applicable to all Boeing Model 737-300, -400, and -500 series airplanes was effective from 8 January 2001. The AD referred to Boeing Alert Service Bulletin number 737-22A1130 which required replacement of the previous A/T computer with improved A/T computer Boeing P/N 10-62017-30 or 10-62017-31.

The AD addressed the problem of split thrust lever movement caused by irregular A/T operation which results in asymmetric thrust conditions causing the airplane to bank excessively and going into a roll.

On 21 October 1998 Boeing issued a Service Letter (SL) number 737-SL-22-039 and on 30 April 2003 issued SL number 737-SL-22-039-A to advice the operator to incorporate the new A/T computer with P/N 10-62017-30 (Smiths P/N 735SUE9-12, 735SUE10-12 or 755SUE2-4) or 10-62017-31 (756SUE3-4).

The 10-62017-30/31 A/T computer has been modified to address in-service reports of asymmetric thrust events and A/T takeoff setting being oscillatory and overshooting the target N1.

The modification included the CTSM function and a revision to the takeoff N1 set logic. The CTSM function is enabled when the flaps are set at less than 15 degrees.

The function will disengage the A/T when the net thrust difference between the two engines exceeds a limit, more than 2.5 degrees of spoiler deployment is used to control the roll attitude of the aircraft, and the aircraft is not on takeoff or go-around.

The A/T new P/N refers to the A/T computer manufacturer (Smiths) SB number 735SUE-22-1266 and 735SUE-22-1267 which is to be enhanced with the following:

• Thrust Split Monitor

• Improved T/O N1 Set-point Algorithm

• Output ARINC bus label 270, bit 27, changed to show internal disengagement.

• Power lever angle (PLA) sensor validity added to disconnect logic.

• Revised forward stop Built-In Test Equipment (BITE) test to improve reliability

• Added the following in-flight BITE messages:

• Improved torque switch bypass logic for thrust levers moving up from aft stop.

• Corrected several BITE nomenclature discrepancies.

The CTSM code was reviewed by Boeing and GE Aviation with no anomalies identified. The A/T computer manufacturer reviewed their historical documents which demonstrated satisfactory completion of required bench testing at the time of certification. The CTSM passed the operational test that was performed during a flight test. This flight test was historical data obtained during the certification program.

The FAA AD 2000-23-34 was performed when the aircraft was being operated in United States and prior to delivered to Sriwijaya Air on 2012 with the updated modification of the A/T computer with P/N 735SUE10-12 or 755SUE2-4.

The Test of Previously Installed Autothrottle Servo

The A/T servo P/N 111RAA3, was manufactured by Smiths Aerospace (now General Electric/GE). The A/T servo of P/N 111RAA3 with S/N 3480 was previously installed on the PK-CLC aircraft and was removed from the aircraft on 22 December 2020 for A/T problem troubleshooting. The maintenance records showed that the unit was installed on PK-CLC aircraft since 1994.

The A/T servo S/N 3480 was sent to Ontic facility in Chatsworth, California, United States of America on 22 January 2021 for testing. During the conduct of the test, it was revealed that the Ontic test bench was unserviceable and the test was rescheduled.

The A/T servo then was sent to Ontic Cheltenham UK and was received on 12 August 2021. The unit was immediately transferred to a secure store for a scheduled test on 9 December 2021.

On 9 December 2021, the test commenced and was witnessed by KNKT, NTSB, Boeing and AAIB UK.

Pilot Duties and Responsibilities

Sriwijaya Air Company Operation Manual (COM) subchapter 1.4.1 described the responsibility and authority of Pilot in Command as follow:

▪ The pilot in command of an aircraft is directly responsible for, and is the final authority as to, the operation and security of the aircraft.

▪ In an in-flight emergency requiring immediate action, the pilot in command may deviate from any rule of part 91 to the extent required to meet that emergency.

▪ The pilot in command must comply with this Company Operations Manual, Company directives, Standard Operating Procedures, and CASR.

The following guidance on crew duties was provided to Sriwijaya’s pilot which was listed in the Sriwijaya Air version of the Boeing 737-300/-500 Flight Crew Operations

Manual (FCOM), “Normal Procedure” page NP 11.2 thru 11.4, dated March 18, 2016.

Crew Duties

The general PF phase of flight responsibilities are:

• taxiing

• flight path and airspeed control

• airplane configuration

• navigation

The general PM phase of flight responsibilities are:

• checklist reading

• communications

• tasks asked for by the PF

• monitoring taxiing, flight path, airspeed, airplane configuration, and navigation

PF and PM duties may change during a flight. For example, the captain could be the PF during taxi but be the PM during takeoff through landing.

The mode control panel is the PF’s responsibility. When flying manually, the PF directs the PM to make the changes on the mode control panel.

The captain is the final authority for all tasks directed and done.

The crew must always monitor:

• airplane course

• vertical path

• speed

When selecting a value on the MCP, verify that the respective value changes on the flight instruments, as applicable.

The crew must verify manually selected or automatic AFDS changes. Use the FMA to verify mode changes for the:

• autopilot

• flight director

• A/T

During LNAV and VNAV operations, verify all changes to the airplane’s:

• course

• vertical path

• thrust

• speed

Announcing changes on the FMA and thrust mode display when they occur is a good CRM practice.

The COM subchapter 8.1.10.6 also required PIC to report and record of mechanical irregularities as follows:

Whenever a pilot finds a defective equipment, the PIC will:

1. Check the Aircraft Maintenance Log to see if the item has been previously reported and properly deferred. If the item has not been previously written up, the PIC will record the pertinent information on the Aircraft Maintenance Log.

2. Check the approved Minimum Equipment List to determine if the defective equipment may be deferred and the conditions that must be met.

3. If the defective equipment is not deferrable, the PIC will not allow the aircraft to take off until mechanical irregularity is corrected or acceptable Dispatch Authorization has been issued.

Policy on the Use of Automation

The COM subchapter 8.3.18 described the policy on the use of automation as follow:

Automatic flight systems are designed to enhance flight safety and efficiency and must be used to their fullest extent.

▪ Company’s policy that the highest level of automation appropriate to the task should be used.

▪ The Flight Crew must not allow automation to detract from the overall management of the flight.

The Sriwijaya Air version of the Boeing 737 CL Flight Crew Training Manual (FCTM), page 1.38 described that during all phases of flight, the use of A/T is recommended when the A/P is engaged.

Normal Procedure on Climb and Pass 10,000 feet

The following guidance on climb and cruise was provided to Sriwijaya’s pilot which is listed in the Sriwijaya Air version of the Boeing 737-300/-500 FCOM, page NP 21.39 dated June 15, 2020:

Upset Recovery Procedure

The Sriwijaya Air version of the Boeing 737 CL FCTM, page 7.33, described upset recovery as follows:

For detailed information regarding the nature of upsets, aerodynamic principles, recommended training and other related information, refer to the Airplane Upset Prevention & Recovery Training Aid (AUPRTA) available through your operator and on the ICAO website.

Historically, an upset has been defined as unintentionally exceeding any one or more of the following conditions:

• pitch attitude greater than 25° nose up

• pitch attitude greater than 10° nose down

• bank angle greater than 45°

• less than the above parameters but flying at an airspeed inappropriate for the conditions.

The latest revision of AUPRTA concludes that an upset condition exists any time that an airplane is deviating from the intended airplane state. The AUPRTA has been updated to emphasize the importance of recognition and avoidance of situations that can lead to airplane upsets and to improve a pilot’s ability to recover control of an airplane that deviates from the intended airplane state. An airplane upset can involve pitch or roll angle deviations as well as inappropriate airspeeds for the conditions.

With the focus on upset recognition and avoidance, pilots should understand how to operate the airplane throughout the entire operational flight envelope. Pilots should have practical knowledge of and demonstrate proficiency in airplane performance and handling characteristics.

Upset prevention and recovery training should emphasize the entire operational flight envelope to develop pilot awareness and handling skills in both manual and automated flight.

 Nose Low, High Bank Angles

The nose low, high angle of bank upset requires prompt action by the pilot as altitude is rapidly being exchanged for airspeed. Even if the airplane is at a high enough altitude that ground impact is not an immediate concern, airspeed can rapidly increase beyond airplane design limits. Simultaneous application of roll and adjustment of thrust may be necessary. It may be necessary to apply nose[1]down elevator to limit the amount of lift, which will be acting toward the ground if the bank angle exceeds 90°. This also reduces wing angle of attack to improve roll capability. Full aileron and spoiler input should be used if necessary to smoothly establish a recovery roll rate toward the nearest horizon. It is important to not increase g force or use nose-up elevator or stabilizer until approaching wings level. The pilot should also extend the speed brakes as needed.

High Bank Angles

If the airplane is not in “zero-angle-of-bank” flight, lift created by the wings is not being fully applied against gravity, and more than 1 g is required for level flight.

At bank angles greater than 67°, level flight cannot be maintained within AFM load factor limits. In high bank angle increasing airspeed situations, the primary objective is to maneuver the lift of the airplane to directly oppose the force of gravity by rolling in the shortest direction to wings level. Applying nose-up elevator at bank angles above 60° causes no appreciable change in pitch attitude and may exceed normal structure load limits as well as the wing angle of attack for stall. The closer the lift vector is to vertical (wings level), the more effective the applied g is in recovering the airplane.

A smooth application of up to full lateral control should provide enough roll control power to establish a very positive recovery roll rate. If full roll control application is not satisfactory, it may even be necessary to apply some rudder in the direction of the desired roll.

Only a small amount of rudder is needed. Too much rudder applied too quickly or held too long may result in loss of lateral and directional control or structural failure.

The Sriwijaya Air version of the Boeing 737 Quick Reference Handbook (QRH), page

MAN.1.7, described the upset recovery procedure as follows:

Historically, an upset has been defined as unintentionally exceeding any one or more of the following conditions:

• pitch attitude greater than 25° nose up

• pitch attitude greater than 10° nose down

• bank angle greater than 45°

• less than the above parameters but flying at an airspeed inappropriate for the conditions.

An upset condition is now considered any time an airplane is diverting from the intended airplane state. An airplane upset can involve pitch or roll angle deviations as well as inappropriate airspeeds for the conditions.

The following actions represent a logical progression for recovering the airplane.

The sequence of actions is for guidance only and represents a series of options to be considered and used dependent on the situation. Not all actions may be needed once recovery is under way. If needed, use minimal pitch trim during initial recovery. Consider careful use of rudder to aid roll control only if roll control is ineffective and the airplane is not stalled.

These actions assume that the airplane is not stalled. A stall condition can exist at any attitude and can be recognized by one or more of the following:

• Stick shaker

• Buffet that can be heavy at times

• Lack of pitch authority

• Lack of roll control

• Inability to stop a descent.

If the airplane is stalled, first recover from the stall by applying and maintaining nose down elevator until stall recovery is complete and stick shaker stops.

 

INDUCED SPOOFING FROM APPROACH TO LANDING - During Taxi and Takeoff as well

 

ABRIDGED RESEARCH ON FLIGHT INDUCED SPOOFING

IET Radar, Sonar & Navigation

University of Texas at Austin

Flight Induced spoofing

Accepted: 29 August 2021

Revised: 22 July 2021

Received: 3 June 2021

Sources:

Wang, W., Wang, J.: GNSS induced spoofing simulation based on path planning.

IET Radar Sonar Navig. 16(1), 103–112 (2022).

https://doi.org/10.1049/rsn2.12167

 

DW INTERNATIOONAL - A NAVTECH COMPANY

John Wilde

Radio Navigation System Engineer at Qascom, Italy

Samuele Fantinato

Signal Processing Engineer at Qascom, Italy

Stefano Montagner

Signal Processing Engineer at Qascom, Italy

Stefano Ciccotosto

Founder and Technical director of Qascom, Italy

Oscar Pozzobon

 

REFERENCES

1. Jafarnia‐Jahromi, A., et al.: GPS vulnerability to spoofing threats and a review of antispoofing techniques. Int. J. Navig. Obs. 2012, 127072 (2012). https://doi.org/10.1155/2012/127072

2. Carroll, J.V.: Vulnerability assessment of the transportation infrastructure relying on global positioning system. J. Navig. 56(2), 185–193 (2003)

3. Humphreys, T.E., et al.: The Texas spoofing test battery: Toward a standard for evaluating GPS signal authentication techniques. In: Proceedings of the ION GNSS+ meeting, pp. 3569–3583. Nashville. September 2012

4. Kerns, A.J., et al.: Unmanned aircraft capture and control via GPS spoofing. J. Field Robot. 31(4), 617–636 (2014)

5. Morales, F.R., et al.: A survey on coping with intentional interference in satellite navigation for manned and unmanned aircraft. IEEE Commun. Surv. Tut. 22(1), 249–291 (2020)

6. Ioannides, R.T., Pany, T., Gibbons, G.: Known vulnerabilities of global navigation satellite systems, status, and potential mitigation techniques. Proc. of IEEE. 104(6), 1174–1194 (2016)

7. Humphreys, T.E., et al.: Assessing the spoofing threat: Development of a portable GPS civilian spoofer. In: Proceedings of the ION GNSS meeting, pp. 16–19. Savannah. September 2008

8. Gao, Y., Lv, Z., Zhang, L.: Asynchronous lift‐off spoofing on satellite navigation receivers in the signal tracking stage. IEEE Sens. J. 20(15), 8604–8613 (2020)

Global Navigation Satellite Systems (GNSS) are highly susceptible to various interferences.

By 2030 it is expected that GNSS will be the main navigation system for most of the flight phases. GNSS is nowadays also as an essential component for other aviation systems, such as the Enhanced Ground Proximity Warning System (EGPWS) and Ground Based Augmentation System (GBAS).

It is expected that GNSS based air routes will be able to accommodate up to three times the current traffic volume.

Intentional Spoofing during Approach

An instrument approach may be divided into four approach segments: initial, intermediate, final, and missed approach.

Depending on speed of the aircraft, availability of weather information, and the complexity of the approach procedure or special terrain avoidance procedures for the airport of intended landing, the in-flight planning phase of an instrument approach can begin as far as 100-200 nautical miles (NM) – from the destination,

The ILS system

The major risk for aircraft navigation (most likely during bad visibility conditions) is at the beginning of the approach phase.

The spoofing detection algorithms configurations as:

• Spoofing Doppler could have an offset of several KHz from the authentic.

• Spoofing delay might have an offset up hundreds of chips from the authentic

• Spoofing power offset depends on the relative distance between the aircraft under attack and the sensor

Non Intentional Spoofing during Taxi-in or Take Off

Certain non-aeronautical systems transmit radio signals intended to supplement GNSS coverage in areas where GNSS signals cannot be readily received (e.g. inside buildings). These systems include GNSS repeaters and pseudolites. GNSS repeaters (also known as “reradiators”) are systems that amplify existing GNSS signals and re-radiate them in real-time.

The interference caused alerts of the Enhanced Ground Proximity Warning System providing the messages ”pull-up” and ”FMS/GPS Position disagree” during Taxi-in and departure of the airplanes.

In these interferences, induced spoofing is very difficult to be detected because it can gradually drag off the tracking points without unlocking the tracking loops of the attacked receiver and cause the victim to obtain a wrong position and/or time information.

The importance of GNSS makes it an increasingly attractive target for hackers and criminals.

The openness of the civil GNSS signal structure and the weak transmitting and receiving power make GNSS vulnerable to variable natural and malicious interferences.

The spoofing, as a kind of malicious interference, can possibly make GNSS victims produce wrong positioning and/or time information.

The spoofing attack mainly includes meaconing and generative spoofing attack [5, 6]. For meaconing, spoofers first receive the authentic satellite signals and then amplify and retransmit the signals to the target receivers. However, for generative spoofing, spoofers usually use GNSS simulation software to generate forged signals, which have the same structure as authentic signals but have false navigation data information.

Generative spoofing can be classified as:

Simplistic spoofing - the spoofing and authentic signals received by victims have asynchronous parameters including code phase, carrier phase and other parameters. Simplistic spoofing usually adopts the ‘jamming‐spoofing’ mode, which first unlocks the target receiver by high power jamming and then enables the victim recapture and lock on spoofing signals.

Intermediate spoofing - is also called induced spoofing or lift‐off spoofing. The spoofer first controls the spoofing to synchronise with the authentic signals in the code phase and Doppler frequency so as to disguise as the authentic signals and then gradually controls the tracking loop of the target receiver. Induced spoofing does not destroy the tracking state of the target receiver and smoothly induces the victim to a false position/time, which is more threatening and difficult to be detected.

Sophisticated spoofing - based on induced spoofing, uses multiple transmit antennas and controls the directions of transmitting antennas so that the spoofing signals have the same arrival directions as the authentic ones [10]. It can defend against angle‐of‐arrival detection but needs a huge increase in cost and complexity.

Data generation algorithm based on path planning

Induced spoofing and anti‐spoofing

Signal model

Induced spoofing has the same structure as that of the authentic satellite signal but different parameters.

Take GPS L1 C/A as an example; they can be denoted as

When there is an induced spoofing, the victim will simultaneously receive the authentic signal and spoofing as follows:

For induced spoofing, the key feature is that it can gradually drag off the tracking points without unlocking the code loop and carrier loop of the victim. In order to achieve this goal, the spoofer has to first estimate the parameters of the authentic signals received by the target receiver and then adjust the parameters of the spoofing signals to synchronize the code and carrier phases with the authentic signal. After that, the spoofing can drag off the tracking loop of the victim by increasing the power.

However, it is difficult for the spoofer to produce the spoofing signals whose carrier phase is exactly the same as that of authentic signals.

When the spoofer shifts the code phase of the spoofing signals, there are two modes of carrier phase alignment between the spoofing and authentic signals. The first one is the non‐frequency lock mode, where the change rate of the carrier phase is proportional to that of the code phase as follows:

where fc is the carrier frequency in Hz, ϕ and τ represent the change rates of the code phase and carrier phase in seconds per second and cycles per second, respectively.

 

The second one is the frequency lock mode in which the spoofing and authentic signals have a certain initial carrier phase offset, and the fixed offset is maintained in the process of changing the code phase. Thus, the spoofing signal and the authentic signal have the same carrier Doppler frequency.

 

 

It should also be noted that, in the non‐frequency lock mode, the carrier phase difference between the spoofing and authentic signals cannot be kept fixed, which leads to the rapid amplitude variation of the blended signal. The frequency lock mode can avoid the above situation, that is amplitude fluctuation.

Thus, spoofing detection methods based on amplitude fluctuation cannot detect the spoofing.

 

However, the method, based on code rate and Doppler frequency consistency, can be used to detect the frequency lock mode. On the contrary, due to the continuous movement of the satellites, the Doppler frequency of the authentic signals constantly changes even if the victim is stationary. The movement of the victim will intensify this change. In other words, it is difficult for the spoofer to estimate the accurate Doppler frequency of the authentic signals. Therefore, the frequency lock mode is not easy to implement.

The induction process of induced spoofing can be demonstrated by the auto‐correlation function (ACF) model of the authentic and spoofing signals. Depending on the methods of code phase alignment, induced spoofings can be classified as synchronous and asynchronous. Figure 1 shows the induction processes of the two methods.

The green dot marks indicate the code phase discrimination result, that is, the tracking point of the receiver. As the correlation peak of the spoofing signal moves, the tracking point of the receiver will shift gradually and finally completely transfer to the spoofing signal. Then, the tracking loop is controlled by the induced spoofing.

As shown in Figure 1a, synchronous induced spoofing mainly has two phases:

(1) T0 ‐T1: alignment phase and

(2) T2: drag‐off phase.

 In the alignment phase T0, the power of the spoofing is initially lower than that of the authentic signal when the spoofing is injected, but the code phase and carrier frequency are synchronised with those of the authentic signal.

Then, in T1, the power of the spoofing signal increases gradually until it exceeds the power of the authentic signal. With the power advantage, the tracking loop will be controlled by the spoofing signal. Subsequently, in T2, the spoofing increases its code rate, which causes the spoofing correlation peak to move away from the authentic correlation peak during the drag‐off phase. Thus, the tracking point shifts gradually until it is completely transferred to the spoofing correlation peak as T3.

Synchronous induced spoofing signals can effectively forge the authentic signals, but it is necessary to know the precise geographical location and velocity of the target receiver to accurately estimate the code phase and carrier Doppler frequency of the authentic signal. However, it is very difficult to implement in a real spoofing scenario. Therefore, at the beginning, the spoofing generated by the spoofer usually has a certain code phase and Doppler frequency difference with the authentic signal. In this case, the generated spoofing is an asynchronous induced spoofing.

As shown in Figure 1b, the strategy of asynchronous induced spoofing is similar to that of synchronous induced spoofing, and the whole induction process includes three phases: 

In T0', the spoofing initially has some code phase difference from the authentic signal. Then, the spoofing signal will continuously adjust its code phase so that its correlation peak gradually approaches that of the authentic signal until they are aligned. And the subsequent process is similar to synchronous induced spoofing. In this induction process, the spoofer does not know the accurate code phase and Doppler frequency of the authentic signals, which makes it impossible to know when it is synchronised with the authentic signal. Therefore, the spoofing correlation peak must always be higher than the authentic correlation peak to ensure that the spoofing signal can successfully lift off the tracking point after alignment.

In short, by adjusting the change rate of the code phase of spoofing based on a given strategy, the induced spoofing can gradually change the relative code phase difference between the authentic signal and spoofing.

Then, the induced spoofing can control the tracking loop of the victim, which will eventually lead to a wrong position and/or time information output. Therefore, the key step of induced spoofing is to gradually change the relative code phase difference between authentic signal and spoofing.

On the other hand, it is well known that the code phase received by the receiver is related to the transmission time of the satellite signal and the distance between the satellite and receiver based on the principle of satellite navigation. Thus, signals received by receivers in different locations have different code phases even for signals coming from the same satellite and the same transmission time.

Path planning

Suppose there are two receivers; one is called target receiver whose received satellite signals simulate the authentic signals received by the victim receiver. The other is called spoofing receiver whose received satellite signals simulate the spoofing generated by the spoofer.

When the target and spoofing receivers are located at the same three‐dimensional geographical positions at the same time, the distances from them to each satellite are equal, that is. Similarly, when the target and spoofing receivers are in different three‐dimensional geographic locations (in a small area), ∆=τⁱ will change and approximately satisfy 

where d_r is the distance between the target receiver and the spoofing receiver as

Example of asynchronous induced spoofing to illustrate the algorithm of path planning. The path planning consists of three phases:

(1) As shown in Figure 2a, the target and the spoofing receivers separately move along the solid line and the dotted line at different speeds from time t₀ and meet at M₁ at time t₁, which corresponds to the T₀^’  of Figure 1(b).

Then, Δτⁱ  will change from Δτⁱ  > 0 to Δτⁱ  ¼ = 0.

(2) As shown in Figure 2b, from time t₁ to time t₂, two receivers move at the same speed along the same path. This process corresponds to the T₀^’ of Figure 1b.

(3) After time t₂, as shown in Figure 2c, two receivers begin to move along different paths and the distance between them continuously increases. Thus, the Δτⁱ  changes from Δτⁱ  ¼ = 0 to Δτⁱ  >0. This process corresponds to the T₂’  of Figure 1b.

The power control of spoofing

The power of spoofing signals is another crucial factor affecting the success of the inducing process. It is worth noting that it is not that the higher the power of the spoofing signal, the better. For the victim, the intrusion of the spoofing will increase the noise floor and affect the carrier-to‐ noise ratio. Excessive power will cause the victim to issue an abnormal alarm. Nevertheless, if the power of spoofing is too low and not synchronized with the authentic signal in the carrier phase, the stability of the tracking loop will be affected. Consequently, the power of the spoofing should be higher than the authentic signal, but not too high.

FIGURE 2 An example of path planning for the target and spoofing receivers to produce an asynchronous induced spoofing (a) Path from time t₀ to time t₁ (b) Path from time t₀ to time t₂ (c) Path from start t₀ to the end of time.

FIGURE 6 Positioning solutions of authentic, spoofing and mixed signals. (a) Latitude (b) Longitude (c) Height

Non Intentional Spoofing: Repeaters

Intentional Spoofing, Landing Case (Simulated)

Spoofing detection techniques

 The spoofing detection engine has been designed according to the following requirements:

• Capability to Monitor Spoofing with:

– Power Offset: between -3 dB and +15 dB. Lower bound is related to receiver acquisition sensitivity, upper bound is a limit over which the spoofing signal can be considered as an interferer.

– Frequency Offset: related to the maximum relative velocity between the sensor and a plane during the approach phase.

– Delay Offset linked to common distance from the airport of the approach phase beginning.

• Spoofing Detection probability 95% and False Alarm lower than 10-4

• Time to Alarm lower than 5 seconds.