NEPAL - YETI AIRLINES 9N-ANC ATR 72-212A - NO ENGINES POWER

 

Source: Preliminary Report

On 15 January 2023, an ATR 72-212A was operating scheduled flights between Kathmandu (VNKT) and Pokhara International Airport (VNPR). The same flight crew operated two sectors between VNKT to VNPR and VNPR to VNKT earlier in the morning. The accident occurred during a visual approach for runway 12 at VNPR. This was the third flight by the crew members on that day. The flight was operated by two Captains, one Captain was in the process of obtaining aerodrome familarization for operating into Pokhara and the other Captain being the instructor pilot. The Captain being familarized, who was occupying the left hand seat, was the Pilot Flying (PF) and the instructor pilot, occupying the right hand seat, was the Pilot Monitoring (PM). 1.1.2 The take-off, climb, cruise and descent to Pokhara was normal. During the first contact with Pokhara tower the Air Traffic Controller (ATC) assigned the runway 30 to land. But during the later phases of flight crew requested and received clearance from ATC to land on Runway 12.

At 10:51:36, the aircraft descended (from 6,500 feet at five miles away from 

VNPR and joined the downwind track for Runway 12 to the north of the runway. 

The aircraft was visually identified by ATC during the approach. At 10:56:12, 

the pilots extended the flaps to the 15 degrees position and selected the landing 

gears lever to the down position. The take-off (TO) setting was selected on 

power management panel.

At 10:56:27, the PF disengaged the Autopilot System (AP) at an altitude of 721

feet Above Ground Level (AGL). The PF then called for “FLAPS 30” at 

10:56:32, and the PM replied, “Flaps 30 and descending”. The flight data 

recorder (FDR) data did not record any flap surface movement at that time. 

Instead, the propeller rotation speed (Np) of both engines decreased

simultaneously to less than 25%1 and the torque (Tq) started decreasing to 0%, 

which is consistent with both propellers going into the feathered condition2.

 

On the cockpit voice recorder (CVR) area microphone recording, a single Master 

Caution chime was recorded at 10:56:36. The flight crew then carried out the

“Before Landing Checklist” before starting the left turn onto the base leg. During 

that time, the power lever angle increased from 41% to 44%. At the point, Np

of both propellers were recorded as Non-Computed Data (NCD) in the FDR 

and the torque (Tq) of both engines were at 0%. When propellers are in feather, 

they are not producing thrust.

When both propellers were feathered, the investigation team observed that 

both engines of 9N-ANC were running flight idle condition during the event flight

to prevent over torque. As per the FDR data, all the recorded parameters 

related to engines did not show any anomaly. At 10:56:50 when the radio

altitude callout for five hundred feet3 was annunciated, another “click” sound 

was heard4. The aircraft reached a maximum bank angle of 30 degrees at this 

altitude. The recorded Np and Tq data remained invalid. The yaw damper 

disconnected four seconds later. The PF consulted the PM on whether to 

continue the left turn and the PM replied to continue the turn. Subsequently, 

the PF asked the PM on whether to continue descend and the PM responded 

it was not necessary and instructed to apply a little power. At 10:56:54, another 

click was heard, followed by the flaps surface movement to the 30 degrees

position.

When ATC gave the clearance for landing at 10:57:07, the PF mentioned twice 

that there was no power coming from the engines. At 10:57:11, the power 

levers were advanced first to 62 degrees then to the maximum power position.

It was followed by a “click” sound at 10:57:16. One second after the “click” 

sound, the aircraft was at the initiation of its last turn at 368 feet AGL, the high

pressure turbine speed (Nh) of both engines increased from 73% to 77%. 

It is noted that the PF handed over control of the aircraft to the PM at 10:57:18.

At 10:57:20, the PM (who was previously the PF) repeated again that there was 

no power from the engines. At 10:57:24 when the aircraft was at 311 feet AGL,

the stick shaker was activated warning the crew that the aircraft Angle of Attack 

(AoA) increased up to the stick shaker threshold.

At 10:57:26, a second sequence of stick shaker warning was activated when the aircraft banked towards the left abruptly. Thereafter, the radio altitude alert for two hundred feet was annunciated, and the cricket sound and stick shaker ceased. At 10:57:32, sound of impact was heard in the CVR. The FDR and CVR stopped recording at 10:57:33 and 10:57:35 respectively.

WAS IT A FLARE ACCIDENT OR LANDING ACCIDENT?

 

INVESTIGATION MUST REPORT IF THE ACCIDENT WAS A LANDING ACCIDENT OR A FLARE ACCIDENT

Mastering the Landing Flare/Round out

Pilot Perception

Analysis of 6,676 aircraft accident reports published by the National Transportation Safety Board

134 pilots with varying experience levels

Sources:

•           THE INTERNATIONAL JOURNAL OF AVIATION PSYCHOLOGY, 12(2), 137–152
•      Oklahoma State University
•      Department of Psychology
•      Laboratory of Comparative and  Behavioral Biology

           Danny Benbassat and Charles I. Abramson

•  Razia Rashid - founder of Psychology To Safety
•  ATSB RESEARCH AND ANALYSIS REPORT
• Aviation Safety Research Grant – B2005/0119

Aerial perspective is a monocular cue which is used for depth perception [the atmosphere causes distant objects to look hazy or blurry], which is used to judge how far away objects are. Monocular cues are named because they can occur only using one eye (as opposed to binocular cues which only occur with the use of both eyes).

Critical perceived time to contact (TTC)

Time remaining until the aircraft’s wheels make contact with the runway if no further action is taken (Mulder et al 2000).

TTC must be estimated directly, without first estimating speed and distance, based on the following ratio (known as tau):

TTC ≈ θ/(dθ/dt)

Where θ is the visual angle between the aimpoint and any other point on the ground plane at time one (see Figure above); and dθ/dt is the rate of change of this angle over time (Hoyle F 1957; Kaiser & Mowafy 1993; Lee, DN 1976).

Tau is a monocular cue to time-to-contact. During a landing, tau can be defined as the ratio of the angular distance between any two points on the ground (which happen to lie along the aiming line) divided by how fast this angular distance is increasing. Several other versions of tau have been proposed (see Regan & Gray 2000).

In more recent aviation research, Mulder and colleagues (2000) found mixed support for the proposals that flare timing is based on perceived runway angle (ψ) and perceived TTC (based on tau).

Study

The effects of pilot’s critical flare operation on long and hard landing events based on real flight Quick Access Recorder (QAR) data.

Flare accident rates

Causes for improper flares

The flare is the transition from a controlled descent to actual contact with the landing surface (Federal Aviation Administration [FAA], 1999; Grosz et al., 1995) and is also known as the flare out, round out, or level off (Jeppesen, 1985).

The task of determining the aircraft altitude above ground is crucial to a successful flare (Green, Muir, James, Gradwell, & Green, 1996) and is accomplished by the use of vision more than any other sense (FAA, 1999; Jeppesen, 1985; Menon, 1996; Nagel, 1988; Thom, 1992).

Depth Perception

Depth perception deals with the ability to see the environment in three dimensions and estimate distances of objects from us and from each other.

Aerial Perspective, objects at larger distances from us are affected by natural scattering of light and form less of a contrast with their background; making it harder to gauge a distance between the two and us.

Monocular cues operate when a person is looking with only one eye

 Pilots rely on monocular depth perception cues rather than binocular depth perception cues (Benson, 1999; Bond, Bryan, Rigney, & Warren, 1962; Langewiesche, 1972; Nagel, 1988).

Monocular depth perception is learned or dependent on experience (Benson, 1999; Bramson, 1982; Langewiesche, 1972; Love, 1995; Marieb, 1995; Tredici, 1996).

-          It is used by artists to induce depth in their two dimensional paintings. Thus, they are also called as the pictorial cues.

The monocular cues that help us in judging the depth and distance in two-dimensional surfaces:

·         Linear perspective: Imagine you are standing between the rail tracks and looking in the distance. You would see that the rail track become smaller and smaller, until there is a point where they meet each other. Linear perspective reflects this phenomena. It says that the distant between two objects far away appear to be smaller than what the distance actually is.

·         Interposition or overlapping:  This monocular cue occurs when one object covers the other. The object that is completely visible seems to be nearer and the object that is partially visible seems to be farther away.

·         Clearness: The more clear the object the nearer it seems. For example, on a hazy day a distant mountain would appear far away than on a clear day, because haze blurs the fine details. Therefore, if we see details of an object we perceive it closer.

·         Relative height: We perceive large objects to be closer to us and smaller objects to be farther away.

·         Motion parallax/ Movement: This cue occurs when the objects are in motion. The distant object appears to move slowly than the objects that are close.

Binocular cues operate when both our eyes are working together

Binocular depth perception is innate or acquired very early in life (Fox, Aslin, Shea, & Dumais, 1980; Kalat, 1998; Reading, 1983; Reinecke & Simons, 1974).

The cues that are provided by both the eyes working together:

·         Retinal or binocular disparity: Humans have two eyes which are horizontally separated by a distance of 6.5 centimeters. Because of this distance between two eyes the images formed on retina of a same object is slightly different. This difference in the images of two eyes is retinal disparity.

·         Convergence: when we see a closer object our eyes turn inward or converge, so that the image is formed on the fovea. Some muscles in our eyes send signal to the brain regarding the degree of convergence and our brain interprets it as a cue for depth perception. The more your eyes turn inward or converge the nearer the objects appear in the space.

·         Accommodation: The process by which ciliary muscles change the focal length of the eyes so that the image is clearly formed on the retina is called the accommodation of the eye. The accommodation varies for near and distant objects and also for objects moving away or towards the eye.

Failure to accurately determine aircraft altitude may result in flaring the aircraft too high (Gleim, 1998; King, 1999; Quinlan, 1999) or too low above the runway (Christy, 1991; Kershner, 1981; Love, 1995).

Improper flares also increase brake, nosewheel tire, and nosewheel shimmy dampener wear (on Cessnas; Christy, 1991; Jorgensen & Schley, 1990).

Improper flares may affect pilot self-esteem and selfefficacy.

The flare maneuver was defined as the ability to determine 10 to 20 ft from the ground and initiate the leveloff.

Three groups of pilots (novice, intermediate, and expert) were surveyed with purposive sampling.

Participants were 134 pilots (novice = 55, intermediate = 45, expert = 34) from three Part 141-approved flight schools in the state of Oklahoma.

Pilot perceptions were assessed with a 21-item questionnaire.

Pilots were asked to rate the flare maneuver and nine other randomly selected standard flight maneuvers for the level of difficulty on a scale ranging from 1 (extremely easy) to 7 (extremely difficult) under optimal conditions (i.e., no wind, 10 miles visibility).

After rating the 10 items, pilots turned the page and learned that the study was specific to the landing flare.

In Item 11

Pilots were provided with the number of total annual U.S. landing accidents and were asked to estimate the number of annual flare accident frequencies.

In Item 12

Pilots were asked to indicate how confident they were in their estimates of annual flare accident frequencies on a scale ranging from 1 (low confident) to 7 (high confidence).

The next items were not only specific to the landing flare but also to their ability to determine when to initiate the flare, that is, estimate 10 to 20 ft from the ground.

In Item 13

Pilots imagined that they were transitioning from descent attitude to flare attitude and indicated how confident they were that their aircraft was 10 to 20 ft from the ground on a scale ranging from 1 (low confidence) to 7 (high confidence).

In Item 14

Pilots recalled their first solo flare attempts and rated factors that assisted them in determining the aircraft altitude before initiating the flare (CFI instruction, instrument readings, practice, pilot manual, ground-school training, other) on a 7-point-scale ranging from 1 (not at all) to 7 (to great extent).

In Item 15

After a reminder that pilots flare the aircraft 10 to 20 ft from the ground, ascertained how pilots rated the task of judging altitude when initiating the flare on a scale ranging from 1 (very easy) to 7 (very difficult).

In Item 16

Pilots imagined that they were on approach for landing and were asked to choose how they determine when to initiate the flare. how did they know they were 10 to 20 ft from the ground (instrument readings, gut reaction, I don’t, sense of sight, sense of balance, other).

In Item 17

Pilots were asked to indicate if there was a need for improved flare-training methods, on a scale ranging from 1 (definitely yes) to 7 (definitely no).

In Item 18

To what factors (pattern practice, natural ability, sheer luck, aviation books, my instructor, other) did they attribute their current successful landing flares, on a scale ranging from 1 (not at all) to 7 (to great extent).

Items 19 and 20 (reiterated Items 16 and 18)

Required pilots to elaborate and explain their responses. Pilots were instructed to think carefully before they answered and be as specific as possible.

In Item 21

Pilots were asked to indicate what type of visual information assisted them in determining when to initiate the flare.

CONCLUSION

 Overall, 6,676 accident reports produced by the NTSB were analyzed for flare accident rates.

Flare accidents

Proper flares depend on monocular cues, and monocular cues depend on experience (Hawkins, 1993; Rinalducci, Patterson, Forren, & Andes, 1985).

On average, the flare only lasts approximately 6 sec and a pilot with a total time of 5,000 hr only has approximately 8 hr of flare time (King, 1998).

In more recent aviation research, Mulder and colleagues (2000) found mixed support for the proposals that flare timing is based on perceived runway angle (ψ) and perceived TTC (based on tau).

Critical perceived runway angle (ψ)

Pilots could initiate the landing flare when the visual angle (ψ) formed between the left and right edges of the runway at the aiming line reaches a critical value (Mulder et al, 2000).

In fact, pilots use different cues or combinations of monocular cues. For example, overall, the horizon and end of runway, shape of runway or runway markings, and familiar objects were the most frequent visual cues that pilots used to estimate their altitude during the flare.

However, University of Oklahoma pilots most frequently used the horizon or end of runway, whereas Oklahoma State University pilots used the shape of runway or runway markings.

Softer throttle reduction is helpful for a better flare performance. Not immediately IDLE. 

The force of the engines and of gravity are driving the airplane down and forward. When you rotate the nose up for the flare, some of the energy that was used to propel the airplane forward is now used to further arrest the force of gravity. You have less force available for forward motion, your speed necessarily decreases.

Flare energy

The rotation-to-flare requires energy to arrest downward momentum; the amount of energy required depends on the glide path angle, any differences in aircraft speed from target speed, and any acceleration/deceleration. It will be to your advantage to make the angle and speed differences the same for every landing.

The rotation-to-flare may or may not bleed airspeed, depending on aircraft flight idle and ground effect characteristics. Here are three examples:

 B747 — The combination of a very large wing span induced ground effect perfectly compensates for energy needed to arrest the descent. Once the descent has been arrested, the flight idle and ground effect result in no airspeed loss at all under most conditions. The airplane has to be flown onto the runway, it will not run out of speed and sit itself down.

GV — The GV also has a very large wing span and high flight idle engines. The descent can be arrested with very little loss of speed, but the airplane does lose speed gradually if held inches off the runway. But, once again, it should be flown onto the runway to avoid a long landing.

G450 — The G450 will lose about 5 knots in the rotation to flare, which is precisely the minimum speed increment to VREF. Once the rotation to flare is made, speed decay continues as flight idle and ground effect are not enough to maintain speed. Any exaggerated flare for the sake of touchdown will result in a significant loss of speed. Once again, the airplane should be flown onto the runway.

VERY SOFT LANDING

The FLARE curve it has two breaking points: The first, it is on (Xf, Hf) [Glide Slope breaking point] and the second one it is on Xtd flare breaking point [Flare breaking point it is at the touchdown point]. Ideally, from this point on the flare curve must be tangent to runway surface to make a soft landing.

Very soft landing, it is that the Pilot Flying does not let the green curve flare segment [beyond Xtd point] to descend below X axis.

That green curve segment after the touchdown point it can NOT descend below the X axis. 

It does tangent on the runway surface plane for smoothing landing.

When to flare

What "the book" says:

"Very few manufacturers specify a flare height. Gulfstream, for example, leaves you off at 50 feet and the next thing you know, you are in the touchdown zone. Some Bombardier manuals say, "at or below 50 feet." About the only manufacturer that does print a height is Boeing. In their Boeing 777 Flight Crew Training Manual, they say this: "Initiate the flare when the main gear is approximately 20 to 30 feet above the runway by increasing pitch attitude approximately 2° - 3°. This slows the rate of descent." That pretty much agrees with what we did in the Boeing 747." 

You should consult your manufacturer's books.

HINT

Pilot after crossing over threshold at the height 50 ft for landing MUST NOT LET his/her eye corners to capture any lateral vision, mainly Pilot Flying, because of lateral vision illusion which induces pilot to see a relative movement speeding up the plane. That false relative speed up produces a sensation of runway length it would be shortening very quickly. Runway excursion.

INDUCED SPOOFING FROM APPROACH TO LANDING - During Taxi and Takeoff as well

 

ABRIDGED RESEARCH ON FLIGHT INDUCED SPOOFING

IET Radar, Sonar & Navigation

University of Texas at Austin

Flight Induced spoofing

Accepted: 29 August 2021

Revised: 22 July 2021

Received: 3 June 2021

Sources:

Wang, W., Wang, J.: GNSS induced spoofing simulation based on path planning.

IET Radar Sonar Navig. 16(1), 103–112 (2022).

https://doi.org/10.1049/rsn2.12167

 

DW INTERNATIOONAL - A NAVTECH COMPANY

John Wilde

Radio Navigation System Engineer at Qascom, Italy

Samuele Fantinato

Signal Processing Engineer at Qascom, Italy

Stefano Montagner

Signal Processing Engineer at Qascom, Italy

Stefano Ciccotosto

Founder and Technical director of Qascom, Italy

Oscar Pozzobon

 

REFERENCES

1. Jafarnia‐Jahromi, A., et al.: GPS vulnerability to spoofing threats and a review of antispoofing techniques. Int. J. Navig. Obs. 2012, 127072 (2012). https://doi.org/10.1155/2012/127072

2. Carroll, J.V.: Vulnerability assessment of the transportation infrastructure relying on global positioning system. J. Navig. 56(2), 185–193 (2003)

3. Humphreys, T.E., et al.: The Texas spoofing test battery: Toward a standard for evaluating GPS signal authentication techniques. In: Proceedings of the ION GNSS+ meeting, pp. 3569–3583. Nashville. September 2012

4. Kerns, A.J., et al.: Unmanned aircraft capture and control via GPS spoofing. J. Field Robot. 31(4), 617–636 (2014)

5. Morales, F.R., et al.: A survey on coping with intentional interference in satellite navigation for manned and unmanned aircraft. IEEE Commun. Surv. Tut. 22(1), 249–291 (2020)

6. Ioannides, R.T., Pany, T., Gibbons, G.: Known vulnerabilities of global navigation satellite systems, status, and potential mitigation techniques. Proc. of IEEE. 104(6), 1174–1194 (2016)

7. Humphreys, T.E., et al.: Assessing the spoofing threat: Development of a portable GPS civilian spoofer. In: Proceedings of the ION GNSS meeting, pp. 16–19. Savannah. September 2008

8. Gao, Y., Lv, Z., Zhang, L.: Asynchronous lift‐off spoofing on satellite navigation receivers in the signal tracking stage. IEEE Sens. J. 20(15), 8604–8613 (2020)

Global Navigation Satellite Systems (GNSS) are highly susceptible to various interferences.

By 2030 it is expected that GNSS will be the main navigation system for most of the flight phases. GNSS is nowadays also as an essential component for other aviation systems, such as the Enhanced Ground Proximity Warning System (EGPWS) and Ground Based Augmentation System (GBAS).

It is expected that GNSS based air routes will be able to accommodate up to three times the current traffic volume.

Intentional Spoofing during Approach

An instrument approach may be divided into four approach segments: initial, intermediate, final, and missed approach.

Depending on speed of the aircraft, availability of weather information, and the complexity of the approach procedure or special terrain avoidance procedures for the airport of intended landing, the in-flight planning phase of an instrument approach can begin as far as 100-200 nautical miles (NM) – from the destination,

The ILS system

The major risk for aircraft navigation (most likely during bad visibility conditions) is at the beginning of the approach phase.

The spoofing detection algorithms configurations as:

• Spoofing Doppler could have an offset of several KHz from the authentic.

• Spoofing delay might have an offset up hundreds of chips from the authentic

• Spoofing power offset depends on the relative distance between the aircraft under attack and the sensor

Non Intentional Spoofing during Taxi-in or Take Off

Certain non-aeronautical systems transmit radio signals intended to supplement GNSS coverage in areas where GNSS signals cannot be readily received (e.g. inside buildings). These systems include GNSS repeaters and pseudolites. GNSS repeaters (also known as “reradiators”) are systems that amplify existing GNSS signals and re-radiate them in real-time.

The interference caused alerts of the Enhanced Ground Proximity Warning System providing the messages ”pull-up” and ”FMS/GPS Position disagree” during Taxi-in and departure of the airplanes.

In these interferences, induced spoofing is very difficult to be detected because it can gradually drag off the tracking points without unlocking the tracking loops of the attacked receiver and cause the victim to obtain a wrong position and/or time information.

The importance of GNSS makes it an increasingly attractive target for hackers and criminals.

The openness of the civil GNSS signal structure and the weak transmitting and receiving power make GNSS vulnerable to variable natural and malicious interferences.

The spoofing, as a kind of malicious interference, can possibly make GNSS victims produce wrong positioning and/or time information.

The spoofing attack mainly includes meaconing and generative spoofing attack [5, 6]. For meaconing, spoofers first receive the authentic satellite signals and then amplify and retransmit the signals to the target receivers. However, for generative spoofing, spoofers usually use GNSS simulation software to generate forged signals, which have the same structure as authentic signals but have false navigation data information.

Generative spoofing can be classified as:

Simplistic spoofing - the spoofing and authentic signals received by victims have asynchronous parameters including code phase, carrier phase and other parameters. Simplistic spoofing usually adopts the ‘jamming‐spoofing’ mode, which first unlocks the target receiver by high power jamming and then enables the victim recapture and lock on spoofing signals.

Intermediate spoofing - is also called induced spoofing or lift‐off spoofing. The spoofer first controls the spoofing to synchronise with the authentic signals in the code phase and Doppler frequency so as to disguise as the authentic signals and then gradually controls the tracking loop of the target receiver. Induced spoofing does not destroy the tracking state of the target receiver and smoothly induces the victim to a false position/time, which is more threatening and difficult to be detected.

Sophisticated spoofing - based on induced spoofing, uses multiple transmit antennas and controls the directions of transmitting antennas so that the spoofing signals have the same arrival directions as the authentic ones [10]. It can defend against angle‐of‐arrival detection but needs a huge increase in cost and complexity.

Data generation algorithm based on path planning

Induced spoofing and anti‐spoofing

Signal model

Induced spoofing has the same structure as that of the authentic satellite signal but different parameters.

Take GPS L1 C/A as an example; they can be denoted as

When there is an induced spoofing, the victim will simultaneously receive the authentic signal and spoofing as follows:

For induced spoofing, the key feature is that it can gradually drag off the tracking points without unlocking the code loop and carrier loop of the victim. In order to achieve this goal, the spoofer has to first estimate the parameters of the authentic signals received by the target receiver and then adjust the parameters of the spoofing signals to synchronize the code and carrier phases with the authentic signal. After that, the spoofing can drag off the tracking loop of the victim by increasing the power.

However, it is difficult for the spoofer to produce the spoofing signals whose carrier phase is exactly the same as that of authentic signals.

When the spoofer shifts the code phase of the spoofing signals, there are two modes of carrier phase alignment between the spoofing and authentic signals. The first one is the non‐frequency lock mode, where the change rate of the carrier phase is proportional to that of the code phase as follows:

where fc is the carrier frequency in Hz, ϕ and τ represent the change rates of the code phase and carrier phase in seconds per second and cycles per second, respectively.

 

The second one is the frequency lock mode in which the spoofing and authentic signals have a certain initial carrier phase offset, and the fixed offset is maintained in the process of changing the code phase. Thus, the spoofing signal and the authentic signal have the same carrier Doppler frequency.

 

 

It should also be noted that, in the non‐frequency lock mode, the carrier phase difference between the spoofing and authentic signals cannot be kept fixed, which leads to the rapid amplitude variation of the blended signal. The frequency lock mode can avoid the above situation, that is amplitude fluctuation.

Thus, spoofing detection methods based on amplitude fluctuation cannot detect the spoofing.

 

However, the method, based on code rate and Doppler frequency consistency, can be used to detect the frequency lock mode. On the contrary, due to the continuous movement of the satellites, the Doppler frequency of the authentic signals constantly changes even if the victim is stationary. The movement of the victim will intensify this change. In other words, it is difficult for the spoofer to estimate the accurate Doppler frequency of the authentic signals. Therefore, the frequency lock mode is not easy to implement.

The induction process of induced spoofing can be demonstrated by the auto‐correlation function (ACF) model of the authentic and spoofing signals. Depending on the methods of code phase alignment, induced spoofings can be classified as synchronous and asynchronous. Figure 1 shows the induction processes of the two methods.

The green dot marks indicate the code phase discrimination result, that is, the tracking point of the receiver. As the correlation peak of the spoofing signal moves, the tracking point of the receiver will shift gradually and finally completely transfer to the spoofing signal. Then, the tracking loop is controlled by the induced spoofing.

As shown in Figure 1a, synchronous induced spoofing mainly has two phases:

(1) T0 ‐T1: alignment phase and

(2) T2: drag‐off phase.

 In the alignment phase T0, the power of the spoofing is initially lower than that of the authentic signal when the spoofing is injected, but the code phase and carrier frequency are synchronised with those of the authentic signal.

Then, in T1, the power of the spoofing signal increases gradually until it exceeds the power of the authentic signal. With the power advantage, the tracking loop will be controlled by the spoofing signal. Subsequently, in T2, the spoofing increases its code rate, which causes the spoofing correlation peak to move away from the authentic correlation peak during the drag‐off phase. Thus, the tracking point shifts gradually until it is completely transferred to the spoofing correlation peak as T3.

Synchronous induced spoofing signals can effectively forge the authentic signals, but it is necessary to know the precise geographical location and velocity of the target receiver to accurately estimate the code phase and carrier Doppler frequency of the authentic signal. However, it is very difficult to implement in a real spoofing scenario. Therefore, at the beginning, the spoofing generated by the spoofer usually has a certain code phase and Doppler frequency difference with the authentic signal. In this case, the generated spoofing is an asynchronous induced spoofing.

As shown in Figure 1b, the strategy of asynchronous induced spoofing is similar to that of synchronous induced spoofing, and the whole induction process includes three phases: 

In T0', the spoofing initially has some code phase difference from the authentic signal. Then, the spoofing signal will continuously adjust its code phase so that its correlation peak gradually approaches that of the authentic signal until they are aligned. And the subsequent process is similar to synchronous induced spoofing. In this induction process, the spoofer does not know the accurate code phase and Doppler frequency of the authentic signals, which makes it impossible to know when it is synchronised with the authentic signal. Therefore, the spoofing correlation peak must always be higher than the authentic correlation peak to ensure that the spoofing signal can successfully lift off the tracking point after alignment.

In short, by adjusting the change rate of the code phase of spoofing based on a given strategy, the induced spoofing can gradually change the relative code phase difference between the authentic signal and spoofing.

Then, the induced spoofing can control the tracking loop of the victim, which will eventually lead to a wrong position and/or time information output. Therefore, the key step of induced spoofing is to gradually change the relative code phase difference between authentic signal and spoofing.

On the other hand, it is well known that the code phase received by the receiver is related to the transmission time of the satellite signal and the distance between the satellite and receiver based on the principle of satellite navigation. Thus, signals received by receivers in different locations have different code phases even for signals coming from the same satellite and the same transmission time.

Path planning

Suppose there are two receivers; one is called target receiver whose received satellite signals simulate the authentic signals received by the victim receiver. The other is called spoofing receiver whose received satellite signals simulate the spoofing generated by the spoofer.

When the target and spoofing receivers are located at the same three‐dimensional geographical positions at the same time, the distances from them to each satellite are equal, that is. Similarly, when the target and spoofing receivers are in different three‐dimensional geographic locations (in a small area), ∆=τⁱ will change and approximately satisfy 

where d_r is the distance between the target receiver and the spoofing receiver as

Example of asynchronous induced spoofing to illustrate the algorithm of path planning. The path planning consists of three phases:

(1) As shown in Figure 2a, the target and the spoofing receivers separately move along the solid line and the dotted line at different speeds from time t₀ and meet at M₁ at time t₁, which corresponds to the T₀^’  of Figure 1(b).

Then, Δτⁱ  will change from Δτⁱ  > 0 to Δτⁱ  ¼ = 0.

(2) As shown in Figure 2b, from time t₁ to time t₂, two receivers move at the same speed along the same path. This process corresponds to the T₀^’ of Figure 1b.

(3) After time t₂, as shown in Figure 2c, two receivers begin to move along different paths and the distance between them continuously increases. Thus, the Δτⁱ  changes from Δτⁱ  ¼ = 0 to Δτⁱ  >0. This process corresponds to the T₂’  of Figure 1b.

The power control of spoofing

The power of spoofing signals is another crucial factor affecting the success of the inducing process. It is worth noting that it is not that the higher the power of the spoofing signal, the better. For the victim, the intrusion of the spoofing will increase the noise floor and affect the carrier-to‐ noise ratio. Excessive power will cause the victim to issue an abnormal alarm. Nevertheless, if the power of spoofing is too low and not synchronized with the authentic signal in the carrier phase, the stability of the tracking loop will be affected. Consequently, the power of the spoofing should be higher than the authentic signal, but not too high.

FIGURE 2 An example of path planning for the target and spoofing receivers to produce an asynchronous induced spoofing (a) Path from time t₀ to time t₁ (b) Path from time t₀ to time t₂ (c) Path from start t₀ to the end of time.

FIGURE 6 Positioning solutions of authentic, spoofing and mixed signals. (a) Latitude (b) Longitude (c) Height

Non Intentional Spoofing: Repeaters

Intentional Spoofing, Landing Case (Simulated)

Spoofing detection techniques

 The spoofing detection engine has been designed according to the following requirements:

• Capability to Monitor Spoofing with:

– Power Offset: between -3 dB and +15 dB. Lower bound is related to receiver acquisition sensitivity, upper bound is a limit over which the spoofing signal can be considered as an interferer.

– Frequency Offset: related to the maximum relative velocity between the sensor and a plane during the approach phase.

– Delay Offset linked to common distance from the airport of the approach phase beginning.

• Spoofing Detection probability 95% and False Alarm lower than 10-4

• Time to Alarm lower than 5 seconds.