INDUCED SPOOFING FROM APPROACH TO LANDING - During Taxi and Takeoff as well

 

ABRIDGED RESEARCH ON FLIGHT INDUCED SPOOFING

IET Radar, Sonar & Navigation

University of Texas at Austin

Flight Induced spoofing

Accepted: 29 August 2021

Revised: 22 July 2021

Received: 3 June 2021

Sources:

Wang, W., Wang, J.: GNSS induced spoofing simulation based on path planning.

IET Radar Sonar Navig. 16(1), 103–112 (2022).

https://doi.org/10.1049/rsn2.12167

 

DW INTERNATIOONAL - A NAVTECH COMPANY

John Wilde

Radio Navigation System Engineer at Qascom, Italy

Samuele Fantinato

Signal Processing Engineer at Qascom, Italy

Stefano Montagner

Signal Processing Engineer at Qascom, Italy

Stefano Ciccotosto

Founder and Technical director of Qascom, Italy

Oscar Pozzobon

 

REFERENCES

1. Jafarnia‐Jahromi, A., et al.: GPS vulnerability to spoofing threats and a review of antispoofing techniques. Int. J. Navig. Obs. 2012, 127072 (2012). https://doi.org/10.1155/2012/127072

2. Carroll, J.V.: Vulnerability assessment of the transportation infrastructure relying on global positioning system. J. Navig. 56(2), 185–193 (2003)

3. Humphreys, T.E., et al.: The Texas spoofing test battery: Toward a standard for evaluating GPS signal authentication techniques. In: Proceedings of the ION GNSS+ meeting, pp. 3569–3583. Nashville. September 2012

4. Kerns, A.J., et al.: Unmanned aircraft capture and control via GPS spoofing. J. Field Robot. 31(4), 617–636 (2014)

5. Morales, F.R., et al.: A survey on coping with intentional interference in satellite navigation for manned and unmanned aircraft. IEEE Commun. Surv. Tut. 22(1), 249–291 (2020)

6. Ioannides, R.T., Pany, T., Gibbons, G.: Known vulnerabilities of global navigation satellite systems, status, and potential mitigation techniques. Proc. of IEEE. 104(6), 1174–1194 (2016)

7. Humphreys, T.E., et al.: Assessing the spoofing threat: Development of a portable GPS civilian spoofer. In: Proceedings of the ION GNSS meeting, pp. 16–19. Savannah. September 2008

8. Gao, Y., Lv, Z., Zhang, L.: Asynchronous lift‐off spoofing on satellite navigation receivers in the signal tracking stage. IEEE Sens. J. 20(15), 8604–8613 (2020)

Global Navigation Satellite Systems (GNSS) are highly susceptible to various interferences.

By 2030 it is expected that GNSS will be the main navigation system for most of the flight phases. GNSS is nowadays also as an essential component for other aviation systems, such as the Enhanced Ground Proximity Warning System (EGPWS) and Ground Based Augmentation System (GBAS).

It is expected that GNSS based air routes will be able to accommodate up to three times the current traffic volume.

Intentional Spoofing during Approach

An instrument approach may be divided into four approach segments: initial, intermediate, final, and missed approach.

Depending on speed of the aircraft, availability of weather information, and the complexity of the approach procedure or special terrain avoidance procedures for the airport of intended landing, the in-flight planning phase of an instrument approach can begin as far as 100-200 nautical miles (NM) – from the destination,

The ILS system

The major risk for aircraft navigation (most likely during bad visibility conditions) is at the beginning of the approach phase.

The spoofing detection algorithms configurations as:

• Spoofing Doppler could have an offset of several KHz from the authentic.

• Spoofing delay might have an offset up hundreds of chips from the authentic

• Spoofing power offset depends on the relative distance between the aircraft under attack and the sensor

Non Intentional Spoofing during Taxi-in or Take Off

Certain non-aeronautical systems transmit radio signals intended to supplement GNSS coverage in areas where GNSS signals cannot be readily received (e.g. inside buildings). These systems include GNSS repeaters and pseudolites. GNSS repeaters (also known as “reradiators”) are systems that amplify existing GNSS signals and re-radiate them in real-time.

The interference caused alerts of the Enhanced Ground Proximity Warning System providing the messages ”pull-up” and ”FMS/GPS Position disagree” during Taxi-in and departure of the airplanes.

In these interferences, induced spoofing is very difficult to be detected because it can gradually drag off the tracking points without unlocking the tracking loops of the attacked receiver and cause the victim to obtain a wrong position and/or time information.

The importance of GNSS makes it an increasingly attractive target for hackers and criminals.

The openness of the civil GNSS signal structure and the weak transmitting and receiving power make GNSS vulnerable to variable natural and malicious interferences.

The spoofing, as a kind of malicious interference, can possibly make GNSS victims produce wrong positioning and/or time information.

The spoofing attack mainly includes meaconing and generative spoofing attack [5, 6]. For meaconing, spoofers first receive the authentic satellite signals and then amplify and retransmit the signals to the target receivers. However, for generative spoofing, spoofers usually use GNSS simulation software to generate forged signals, which have the same structure as authentic signals but have false navigation data information.

Generative spoofing can be classified as:

Simplistic spoofing - the spoofing and authentic signals received by victims have asynchronous parameters including code phase, carrier phase and other parameters. Simplistic spoofing usually adopts the ‘jamming‐spoofing’ mode, which first unlocks the target receiver by high power jamming and then enables the victim recapture and lock on spoofing signals.

Intermediate spoofing - is also called induced spoofing or lift‐off spoofing. The spoofer first controls the spoofing to synchronise with the authentic signals in the code phase and Doppler frequency so as to disguise as the authentic signals and then gradually controls the tracking loop of the target receiver. Induced spoofing does not destroy the tracking state of the target receiver and smoothly induces the victim to a false position/time, which is more threatening and difficult to be detected.

Sophisticated spoofing - based on induced spoofing, uses multiple transmit antennas and controls the directions of transmitting antennas so that the spoofing signals have the same arrival directions as the authentic ones [10]. It can defend against angle‐of‐arrival detection but needs a huge increase in cost and complexity.

Data generation algorithm based on path planning

Induced spoofing and anti‐spoofing

Signal model

Induced spoofing has the same structure as that of the authentic satellite signal but different parameters.

Take GPS L1 C/A as an example; they can be denoted as

When there is an induced spoofing, the victim will simultaneously receive the authentic signal and spoofing as follows:

For induced spoofing, the key feature is that it can gradually drag off the tracking points without unlocking the code loop and carrier loop of the victim. In order to achieve this goal, the spoofer has to first estimate the parameters of the authentic signals received by the target receiver and then adjust the parameters of the spoofing signals to synchronize the code and carrier phases with the authentic signal. After that, the spoofing can drag off the tracking loop of the victim by increasing the power.

However, it is difficult for the spoofer to produce the spoofing signals whose carrier phase is exactly the same as that of authentic signals.

When the spoofer shifts the code phase of the spoofing signals, there are two modes of carrier phase alignment between the spoofing and authentic signals. The first one is the non‐frequency lock mode, where the change rate of the carrier phase is proportional to that of the code phase as follows:

where fc is the carrier frequency in Hz, ϕ and τ represent the change rates of the code phase and carrier phase in seconds per second and cycles per second, respectively.

 

The second one is the frequency lock mode in which the spoofing and authentic signals have a certain initial carrier phase offset, and the fixed offset is maintained in the process of changing the code phase. Thus, the spoofing signal and the authentic signal have the same carrier Doppler frequency.

 

 

It should also be noted that, in the non‐frequency lock mode, the carrier phase difference between the spoofing and authentic signals cannot be kept fixed, which leads to the rapid amplitude variation of the blended signal. The frequency lock mode can avoid the above situation, that is amplitude fluctuation.

Thus, spoofing detection methods based on amplitude fluctuation cannot detect the spoofing.

 

However, the method, based on code rate and Doppler frequency consistency, can be used to detect the frequency lock mode. On the contrary, due to the continuous movement of the satellites, the Doppler frequency of the authentic signals constantly changes even if the victim is stationary. The movement of the victim will intensify this change. In other words, it is difficult for the spoofer to estimate the accurate Doppler frequency of the authentic signals. Therefore, the frequency lock mode is not easy to implement.

The induction process of induced spoofing can be demonstrated by the auto‐correlation function (ACF) model of the authentic and spoofing signals. Depending on the methods of code phase alignment, induced spoofings can be classified as synchronous and asynchronous. Figure 1 shows the induction processes of the two methods.

The green dot marks indicate the code phase discrimination result, that is, the tracking point of the receiver. As the correlation peak of the spoofing signal moves, the tracking point of the receiver will shift gradually and finally completely transfer to the spoofing signal. Then, the tracking loop is controlled by the induced spoofing.

As shown in Figure 1a, synchronous induced spoofing mainly has two phases:

(1) T0 ‐T1: alignment phase and

(2) T2: drag‐off phase.

 In the alignment phase T0, the power of the spoofing is initially lower than that of the authentic signal when the spoofing is injected, but the code phase and carrier frequency are synchronised with those of the authentic signal.

Then, in T1, the power of the spoofing signal increases gradually until it exceeds the power of the authentic signal. With the power advantage, the tracking loop will be controlled by the spoofing signal. Subsequently, in T2, the spoofing increases its code rate, which causes the spoofing correlation peak to move away from the authentic correlation peak during the drag‐off phase. Thus, the tracking point shifts gradually until it is completely transferred to the spoofing correlation peak as T3.

Synchronous induced spoofing signals can effectively forge the authentic signals, but it is necessary to know the precise geographical location and velocity of the target receiver to accurately estimate the code phase and carrier Doppler frequency of the authentic signal. However, it is very difficult to implement in a real spoofing scenario. Therefore, at the beginning, the spoofing generated by the spoofer usually has a certain code phase and Doppler frequency difference with the authentic signal. In this case, the generated spoofing is an asynchronous induced spoofing.

As shown in Figure 1b, the strategy of asynchronous induced spoofing is similar to that of synchronous induced spoofing, and the whole induction process includes three phases: 

In T0', the spoofing initially has some code phase difference from the authentic signal. Then, the spoofing signal will continuously adjust its code phase so that its correlation peak gradually approaches that of the authentic signal until they are aligned. And the subsequent process is similar to synchronous induced spoofing. In this induction process, the spoofer does not know the accurate code phase and Doppler frequency of the authentic signals, which makes it impossible to know when it is synchronised with the authentic signal. Therefore, the spoofing correlation peak must always be higher than the authentic correlation peak to ensure that the spoofing signal can successfully lift off the tracking point after alignment.

In short, by adjusting the change rate of the code phase of spoofing based on a given strategy, the induced spoofing can gradually change the relative code phase difference between the authentic signal and spoofing.

Then, the induced spoofing can control the tracking loop of the victim, which will eventually lead to a wrong position and/or time information output. Therefore, the key step of induced spoofing is to gradually change the relative code phase difference between authentic signal and spoofing.

On the other hand, it is well known that the code phase received by the receiver is related to the transmission time of the satellite signal and the distance between the satellite and receiver based on the principle of satellite navigation. Thus, signals received by receivers in different locations have different code phases even for signals coming from the same satellite and the same transmission time.

Path planning

Suppose there are two receivers; one is called target receiver whose received satellite signals simulate the authentic signals received by the victim receiver. The other is called spoofing receiver whose received satellite signals simulate the spoofing generated by the spoofer.

When the target and spoofing receivers are located at the same three‐dimensional geographical positions at the same time, the distances from them to each satellite are equal, that is. Similarly, when the target and spoofing receivers are in different three‐dimensional geographic locations (in a small area), ∆=τⁱ will change and approximately satisfy 

where d_r is the distance between the target receiver and the spoofing receiver as

Example of asynchronous induced spoofing to illustrate the algorithm of path planning. The path planning consists of three phases:

(1) As shown in Figure 2a, the target and the spoofing receivers separately move along the solid line and the dotted line at different speeds from time t₀ and meet at M₁ at time t₁, which corresponds to the T₀^’  of Figure 1(b).

Then, Δτⁱ  will change from Δτⁱ  > 0 to Δτⁱ  ¼ = 0.

(2) As shown in Figure 2b, from time t₁ to time t₂, two receivers move at the same speed along the same path. This process corresponds to the T₀^’ of Figure 1b.

(3) After time t₂, as shown in Figure 2c, two receivers begin to move along different paths and the distance between them continuously increases. Thus, the Δτⁱ  changes from Δτⁱ  ¼ = 0 to Δτⁱ  >0. This process corresponds to the T₂’  of Figure 1b.

The power control of spoofing

The power of spoofing signals is another crucial factor affecting the success of the inducing process. It is worth noting that it is not that the higher the power of the spoofing signal, the better. For the victim, the intrusion of the spoofing will increase the noise floor and affect the carrier-to‐ noise ratio. Excessive power will cause the victim to issue an abnormal alarm. Nevertheless, if the power of spoofing is too low and not synchronized with the authentic signal in the carrier phase, the stability of the tracking loop will be affected. Consequently, the power of the spoofing should be higher than the authentic signal, but not too high.

FIGURE 2 An example of path planning for the target and spoofing receivers to produce an asynchronous induced spoofing (a) Path from time t₀ to time t₁ (b) Path from time t₀ to time t₂ (c) Path from start t₀ to the end of time.

FIGURE 6 Positioning solutions of authentic, spoofing and mixed signals. (a) Latitude (b) Longitude (c) Height

Non Intentional Spoofing: Repeaters

Intentional Spoofing, Landing Case (Simulated)

Spoofing detection techniques

 The spoofing detection engine has been designed according to the following requirements:

• Capability to Monitor Spoofing with:

– Power Offset: between -3 dB and +15 dB. Lower bound is related to receiver acquisition sensitivity, upper bound is a limit over which the spoofing signal can be considered as an interferer.

– Frequency Offset: related to the maximum relative velocity between the sensor and a plane during the approach phase.

– Delay Offset linked to common distance from the airport of the approach phase beginning.

• Spoofing Detection probability 95% and False Alarm lower than 10-4

• Time to Alarm lower than 5 seconds.

How To Spoofing an Aircraft in Flight – A Proposal Presented to Boeing and Developed by Raytheon

The Department of Homeland Security (DHS) has awarded Raytheon Company a contract to produce the Advanced Route Evaluation System (ARES) that performs risk analysis on aviation routes to help planners determine the best routes for aircraft to use during an emergency. The ARES contract was awarded under the Rapid Technology Application program (RTAP) and is valued at $1.9 million.	O Departamento de Segurança Interna (DHS) premiou a Companhia Raytheon com um contrato para produzir o Sistema Avançado de Avaliação de Rota (ARES) que efetua a análise de risco em rotas da aviação para ajudar os planejadores a determinar as melhores rotas para a aeronave usar durante uma emergência. O contrato de ARES foi concedido no âmbito do Programa de Aplicação de Tecnologia Rápida (RTAP) e está avaliado em US $1,9 milhões.
ARES is an integrated solution for aviation route risk analysis that assesses factors such as aircraft type, fuel loads, and flight route, as well as modeling the relative vulnerability to terrorist activity for any planned flight.	ARES é uma solução integrada para análise de risco em rota da aviação que avalia fatores tais como o tipo de aeronave, cargas de combustível e rota de vôo, bem como a modelagem de vulnerabilidade relativa à atividade terrorista para qualquer voo planejado.
"ARES will help DHS and other government users better align and deploy critical resources and manpower to protect our national assets," said Dan Boelsche, DHS program manager in 2006. "The system determines high-risk air transportation routes based on threat information received from government sources and help us ensure that the country is prepared should we encounter another national emergency."	"ARES ajuda o DHS e outros usuários do governo alinharem e implantarem melhores recursos críticos e mão de obra para proteger o nosso património nacional," disse Dan Boelsche, gerente de programa do DHS in 2006. "O sistema determina rotas de transporte de aéreo de alto risco baseado  nas informações de ameaça recebidas de fontes do governo e nos ajuda a garantir que o país está preparado se nos deparamos com uma outra emergência nacional."
Raytheon Company is an industry leader in defense and government electronics, space, information technology, technical services, and business and special mission aircraft. With headquarters in Waltham, Mass. Raytheon employs 80,000 people worldwide.	A Companhia Raytheon é uma indústria líder em [dispositivos] eletrônicos de defesa e governo, e aeronave de missão especial, espaço, tecnologia da informação, serviços técnicos e negócios. Com sede em Waltham, Massachusetts.

The methods and systems for automatically controlling a path of travel of a vehicle of the present invention provide techniques that prevent unauthorized persons from accessing the controls of a vehicle. The methods and systems therefore increase the likelihood that a vehicle may be safely operated because unauthorized persons are not capable of gaining any type of control over the controls of the vehicle. To provide the increased safety, the techniques of the present invention permit irrevocable and uninterrupted automated control of the vehicle, such that once the automated control system is engaged, it cannot be disengaged by anyone onboard the vehicle. Thus, the personnel onboard the vehicle cannot be forced into carrying out the demands of any unauthorized person.	Os métodos e sistemas para controlar automaticamente uma rota de viagem de um veículo com a presente invenção fornecem técnicas que impedem que pessoas não autorizadas acessem os controles de um veículo. Os métodos e sistemas, portanto, aumentam a probabilidade de que um veículo possa ser seguramente operado por causa de  pessoas não autorizadas  não serem capazes de ganhar qualquer tipo de controle sobre os controles do veículo. Para fornecer a segurança ampliada, as técnicas da presente invenção permitem irrevogável e ininterrupto controle automatizado do veículo, tal que, uma vez que o sistema de controle automatizado esteja engajado, ele [novo sistema] não pode ser desativado por qualquer pessoa a bordo do veículo. Assim, o pessoal a bordo do veículo não pode ser forçado a efetuar as exigências de qualquer  pessoa não autorizada.
The method and systems of the present invention, therefore, provide techniques for increasing the safety of vehicles over the conventional safety techniques that are revocable and/or alterable, such as based upon the demands of a hijacker or the like.	O método e sistemas da presente invenção, portanto, fornecem técnicas para aumentar a segurança de veículos sobre as técnicas de segurança convencionais que são revogáveis e/ou alteráveis, tais como baseado nas exigências de um seqüestrador ou coisa parecida.
The methods and systems of the present invention apply to any type of vehicle, such as an air vehicle, boat, ship, train, bus or the like. The embodiments described below, however, are directed toward specific embodiments of systems and methods for automatically controlling aircraft flight operations. However, the methods and systems of the present invention apply equally to any other type of vehicle.	Os métodos e sistemas da presente invenção aplicam-se a qualquer tipo de veículo, tais como um veículo aéreo, barco, navio, trem, ônibus ou similares. As incorporações descritas abaixo, todavia, são direcionadas para incorporações específicas dos sistemas e métodos para controlar automaticamente as operações de voo de aeronave. No entanto, os métodos e sistemas da presente invenção aplicam-se igualmente a qualquer outro tipo de veículo.

Figure 1

Figure 2

One embodiment of a system 10 for automatically controlling a path of travel of a vehicle includes at least one engagement element 12 and at least one processing element 14, as shown in the embodiments of FIGS. 1 and 2. An engagement element 12 may be any type of element that initiates the engagement of the automatic control system of a particular vehicle, such as the automatic flight control system of an aircraft. For example, an engagement element 12 may transmit a signal to the processing element 14 directing engagement of the automatic control system. As such, the engagement element may be, but is not limited to, a button, switch, lever, or the like, or any other device capable of transmitting a command to the processing element 14, such as a keyboard, a voice signal receiver, a touch-screen, or a selection device such as a mouse in conjunction with a display.	Uma incorporação de um sistema 10 para controlar automaticamente uma rota de viagem de um veículo inclui pelo menos um elemento de engajamento 12 e pelo menos um elemento  de processamento 14, como mostrado nas incorporações nas Fig. 1 e 2. Um elemento de engajamento 12 pode ser qualquer tipo de elemento que inicie o engajamento do sistema de controle automático de um determinado veículo, tal como o sistema de controle automático de vôo da aeronave. Por exemplo, um elemento de engajamento 12 pode transmitir um sinal para o elemento de processamento 14 comandando o engajamento do sistema de controle automático. Como tal, o elemento de engajamento pode ser, mas não está limitado a, um botão, interruptor, alavanca [os manetes], ou similar, ou qualquer outro dispositivo capaz de transmitir um comando para o elemento de processamento 14, tal como um teclado, um receptor de sinais de voz, uma tela tátil ou um dispositivo de seleção tal como um mouse em conjunto com um monitor de computador.
For instance, the automatic control system 10 may be activated automatically, as represented by box 16 of FIGS. 1 and 2. In one embodiment, the engagement element 12 may be a sensor or the like that automatically transmits an engagement signal to the processing element 14 upon sensing a particular event. Such sensors may be located anywhere in the vehicle where a type of threat to the security of the vehicle or its passengers or other contents may be sensed.	Por exemplo, o sistema de controle automático 10 pode ser ativado automaticamente, como representado pela caixa 16 das figuras 1 e 2. Em uma incorporação, o elemento de engajamento 12 pode ser um sensor ou algo parecido que automaticamente transmita um sinal de engajamento para o elemento de processamento 14 após detecção de um evento específico. Tais sensores podem ser instalados em qualquer local no veículo onde um tipo de ameaça à segurança do veículo ou seus passageiros ou outros conteúdos possa ser percebido.
For instance, in an aircraft, an engagement sensor may be located proximate to the door of the cockpit, and the sensor may be programmed to transmit an engagement signal to the processing element when the door is forcibly opened or when there is an attempt to forcibly open the door, such as repeated poundings on the door. The sensor(s) may have a minimum force threshold, such that force applied to the door must exceed the threshold before the automatic control system can be automatically activated. Therefore, at least most inadvertent applications of force on the door by people or objects will not cause the system to automatically engage. In addition to or instead of the automatic engagaement element(s) 16, the system 10 may include manual engagement element(s) 18, such as buttons, switches or the like, that authorized personnel, such as the pilots of an aircraft may actuate if a threat is detected. Thus, one or more manual and/or automatic engagement elements may be located onboard the vehicle, such as within and/or proximate the cockpit of an aircraft, as represented by boxes 16 and 18 of FIGS. 1 and 2.	Por exemplo, em uma aeronave, um sensor de engajamento pode ser instalado próximo à porta do cockpit, e o sensor pode ser programado para transmitir um sinal de engajamento para o elemento de processamento quando a porta for aberta à força ou quando houver uma tentativa de forçadamente abrir a porta, tal como golpes repetidos na porta. O(s) sensor(es) pode ter um limite mínimo de força, tal que a força aplicada na porta deva exceder o limite antes que o sistema de controle automático possa ser ativado automaticamente. Por essa razão, pelo menos a maioria de aplicações inadvertidas de força na porta por pessoas ou objetos não causará o sistema automaticamente se engajar. Em adição a, ou em vez do(s) elemento(s) de engajamento automático  16, o sistema 10 pode incluir o(s) elemento(s) de engajamento manual 18, tais como botões, interruptores ou similares, que o pessoal autorizado, tais como os pilotos de uma aeronave possa acionar se  uma ameaça for detetada. Assim, um ou mais elementos de engajamento manual e/ou automático podem ser instalados a bordo do veículo, tal como dentro e/ou próximo do cockpit de um avião, como representado pelas caixas 16 e 18 nas figuras 1 e 2.

Furthermore, one or more locations outside the vehicle, i.e., one or more remote locations, but in communication with the vehicle, may include an engagement element, such that if a signal or other communication is received at the remote location that indicates the security of the vehicle may be in jeopardy, the engagement element may be activated from the remote location, as represented by box 20 of FIGS. 1 and 2 so as to assume control of the vehicle.	Além disso, um ou mais locais fora do veículo, ou seja, um ou mais locais remotos, mas em comunicação com o veículo, podem incluir um elemento de engajamento, tal que se um sinal ou outras formas de comunicação for recebida no local remoto que indique que a segurança do veículo pode estar em perigo, o elemento de engajamento pode ser ativado do local remoto, como representado pela caixa 20 nas figuras 1 e 2, a fim de assumir o controle do veículo.
For instance, an aircraft may be in communication with one or more remote locations, which may include but is not limited to an airline office, an airport, and one or more governmental agencies, such as a Federal Bureau of Investigation (FBI) office, a Central Intelligence Agency (CIA) office, a Federal Aviation Administration (FAA) office, the office of Homeland Security, a military center, or an anti-terrorist agency office.	Por exemplo, uma aeronave pode estar em comunicação com um ou mais locais remotos, os quais podem incluir, mas não está limitado a um escritório da companhia aérea, um aeroporto e uma ou mais agências governamentais, tais como um escritório do Federal Bureau of Investigation (FBI), um escritório da Agência Central de inteligência (CIA), um escritório de administração de Aviação Federal (FAA), o escritório de Segurança Interna, um centro militar, ou um escritório da agência de combate ao terrorismo.
Personnel and/or equipment at the remote location may monitor the aircraft and may be capable of detecting certain events, such as indications from the flight crew or systems onboard the aircraft and/or movements of the aircraft that suggest the security of the aircraft is in jeopardy.	Pessoal e/ou equipamento no local remoto pode monitorar a aeronave e pode ser capaz de detectar determinados eventos, tais como indicações de movimentos da tripulação e/ou da aeronave ou sistemas a bordo da aeronave que sugerem que a segurança da aeronave está em perigo.
Thus, one or more automatic and/or manual engagement elements may be located at the remote location, such that once it is determined that the security of the air vehicle is in jeopardy, the automatic flight control system 10 of the air vehicle may be automatically or manually engaged from the remote location by transmitting an activation signal to the processing element 14.	Assim, um ou mais elementos de engajamento automático e/ou manual podem ser instalados na localização remota, tal que uma vez isso seja determinado, que a segurança do veículo aéreo esteja em perigo, o sistema de controle automático de vôo 10 do  veículo aéreo pode ser automaticamente ou manualmente engajados a partir do local remoto, pela transmissão de  um sinal de ativação para o elemento de processamento 14.
Communication between the vehicle and the remote location may be carried out in any manner known to those skilled in the art.	Comunicação entre o veículo e o local remoto pode ser efectuada de qualquer maneira, conhecida pelos especialistas na arte.
For instance, the communication may be, but is not limited to being, conducted via a radio or satellite network.	Por exemplo, a comunicação pode ser, mas não está limitada a ser, realizada através de um rádio ou rede de satélite.
In addition, the communication link between the vehicle and the remote location may be dedicated for transmitting signals related to the automatic travel control system 10 only. As such, in one embodiment, these communications may be carried out by a transmitter and receiver, including an antenna, which is separate from all of the other communications transmitted and received by the vehicle. In other embodiments, the communications between the vehicle and the remote location may be carried out by the communication link(s) that are shared with other communications transmitted and received by the vehicle.	Além disso, o link de comunicação entre o veículo e a localização remota pode ser dedicado para sinais de transmissão relacionados ao sistema de controle automático 10 de viagem apenas. Como tal, em uma incorporação, estas comunicações podem ser efetuadas por um transmissor e receptor, incluindo uma antena, a qual está separada de todas as outras comunicações transmitidas e recebidas pelo veículo. Em outras incorporações, as comunicações entre o veículo e o local remoto podem ser efetuadas pelo(s) auto-link(s) de comunicação que são compartilhados com outras comunicações transmitidas e recebidas pelo veículo.
In this embodiment, the signals related to the automatic travel control system may have a higher priority than the other signals carried by the communication link(s). Prioritization of communication signals, particularly in the case of air vehicle communication signals, is discussed in detail in U.S. Pat. application No. 09/994,259, filed on Nov. 26, 2001, and entitled "Methods and Systems for Air Vehicle Telemetry," which is incorporated herein by reference in its entirety.	Nesta incorporação, os sinais relacionados ao sistema de controle automático de viagem podem ter uma prioridade maior do que os outros sinais transportados pelo(s) link(s) de comunicação. Priorização de sinais de comunicação, particularmente no caso de sinais de comunicação de veículo aéreo, está discutida em detalhes na Lei de Patentes dos Estados Unidos n º 09/994.259, arquivada em 26 de novembro de 2001 e entitulada "Métodos e Sistemas para Telemetria de Veículo Aéreo," que está incorporada aqui neste documento por referência, na sua totalidade.

Once the processing element 14 receives a signal that the automatic control system of the vehicle has been engaged by an associated engagement element 12, the processing element 14 then initiates control of the path of travel of the vehicle.	Uma vez que o elemento de processamento 14 recebe um sinal de que o sistema de controle automático do veículo foi engajado por um elemento de engajamento 12 associado, o elemento de processamento 14, então inicia o controle da rota de viagem do veículo.
In particular, the processing element disables any onboard capability to supersede or disengage the automatic control system. As such, in some embodiments of the automatic control system of the present invention employed onboard an aircraft, the processing element initiates control of the aircraft by activating the autopilot system 22 in conjunction with disabling any onboard capability to supersede or disengage the autopilot system, i.e., an uninterruptible autopilot mode, as shown in the embodiment of FIG. 2.	Em particular, o elemento de processamento desativa qualquer capacidade a bordo para suplantar ou desengajar o sistema de controle automático. Como tal, em algumas incorporações do sistema de controle automático da presente invenção empregado a bordo de uma aeronave, o elemento de processamento inicia o controle da aeronave, pela ativação do sistema do piloto automático 22 em conjunto com a desativação de qualquer dispositivo com capacidade a bordo de substituir ou desativar o sistema de piloto automático, ou seja, um modo de piloto automático não interruptível, como mostrado na incorporação na Fig. 2.
Thus, in this embodiment, when the uninterruptible autopilot mode is engaged the autopilot switching element 50 opens, such that it moves from position 54 to position 52. In this embodiment, the processing element 14 may be part of the autopilot system 22 or the processing element 14 may be separate from the autopilot system 22.	Assim, nesta incorporação, quando o modo não interruptível do piloto automático estiver engajado, o elemento de ligação 50 do piloto automático abre, tal que ele se mova da posição 54 para a posição 52. Nesta incorporação, o elemento de processamento 14 pode ser parte do sistema de piloto automático 22 ou o elemento de processamento 14 pode ser separado do sistema de piloto automático 22.
In other embodiments, an automatic control system may be a system that is independent of the autopilot system, or the automatic control system may share only some flight control components with the autopilot system, as shown in the embodiment of FIG. 1.	Em outras incorporações, um sistema de controlo automático pode ser um sistema que seja independente do sistema de piloto automático, ou o sistema de controle automático pode compartilhar apenas alguns componentes de controle de vôo com o sistema do piloto automático, como mostrado na incorporação na Fig. 1.
For instance, if the automatic control system and the autopilot system are separate systems, the automatic control system and the autopilot system may share the automatic throttle system and the automatic landing system or any other component or subsystem of the air vehicle that is common to both systems.	Por exemplo, se o sistema de controle automático e o sistema do piloto automático são sistemas separados, o sistema de controle automático e o sistema de piloto automático podem compartilhar o sistema de aceleração automática [AUTOTHROTTLE or AUTOTHRUST] e o sistema de pouso automático ou qualquer outro componente ou subsistema do veículo aéreo que seja comum a ambos os sistemas.
Regardless of whether the automatic control system utilizes the autopilot system, the automatic control system controls the subsequent path of travel of the vehicle based upon a route that is either predetermined or calculated by the automatic control system, or that is provided to the automatic control system from an off board location as described below.	Independentemente de, se o sistema de controle automático utiliza o sistema do piloto automático, o sistema de controle automático controla a rota subseqüente da viagem do veículo com base em uma rota que está, ou predeterminada ou calculada pelo sistema de controle automático, ou que é fornecida para o sistema de controle automático de uma localização a longa distância conforme descrito abaixo.
To disable any onboard capability to supersede or disengage the automatic control system, the processing element 14 disables the onboard controls 24, which may include any type of interface, such as but not limited to an electronic or computer interface, with the controls of the vehicle.	Para desabilitar qualquer capacidade a bordo que substitua ou desative o sistema de controle automático, o elemento de processamento 14 desativa os controles 24 a bordo, os quais podem incluir qualquer tipo de interface, tais como, mas não se limitando a uma interface eletrônica ou computador, com os controles do veículo.
For example, when the automatic control system 10 is engaged, the onboard controls 24, including interfaces to the controls, may be bypassed. FIGS. 1 and 2 illustrate one embodiment of how the controls may by bypassed, although the controls may be bypassed in other manners. In the embodiment of FIGS. 1 and 2, a first switching element 26 may move from a first position 28 that connects the onboard controls 24 to the processing element 14 and, in turn, to the corresponding internal controls 30 of the vehicle, such as the flight control computer or the like, to a second position 32 that opens the connection between the onboard controls 24 and the corresponding internal controls 30, such that the onboard controls 24 are disabled.	Por exemplo, quando o sistema de controle automático 10 está engajado, os controles 24 a bordo, incluindo interfaces para os controles, podem ser ignorados. As Fig. 1 e 2 ilustram uma incorporação de como os controles podem ser desviados, embora os controles possam ser desviados por outras maneiras. Na incorporação na Fig. 1 e 2, um primeiro elemento de comutação 26 pode mover-se de uma primeira posição 28 que se conecta aos controles 24 a bordo ao elemento de processamento 14 e, por sua vez, para os controles 30 internos correspondentes do veículo, tais como o computador de controle de vôo [FMS] ou o similar, para uma segunda posição 32 que abre a conexão entre os controles 24 a bordo e os controles 30 correspondentes internos, tal que os controles 24 a bordo  fiquem desativados.
The first position 28 is typically the default position when the automatic control system 10 is not engaged.	A primeira posição 28 é normalmente a posição padrão, quando o sistema 10 de controle automático  não está engajado.
In addition, the power control element(s) 34, such as circuit breakers or any other type of power limiting elements known to those skilled in the art, that are accessible onboard the vehicle are also bypassed when the automatic control system 10 is engaged, such that the automatic control system cannot be disengaged from onboard the vehicle by resetting the associated circuit breakers.	Além disso, os elementos 34 de controle de eletricidade, tais como disjuntores [CBs] ou qualquer outro tipo de elementos limitantes de eletricidade conhecidos pelos especialistas na arte [eletrônica], que estejam acessíveis a bordo do veículo também são ‘bypassados’ quando o sistema 10 de controle automático  é engajado, tal que o sistema de controle automático não possa ser desengajados de dentro do veículo pela religação dos disjuntores elétricos associados.
FIGS. 1 and 2 also illustrate one embodiment of how the onboard accessible power control element(s) 34 may be bypassed, although the power control element(s) may be bypassed in other manners.	Fig. 1 e 2 ilustram também uma incorporação de como o elemento (s) de controle 34 de energia elétrica acessível a bordo  pode ser ‘bypassado’, embora o elemento (s) de controle de eletricidade possa ser ignorado de outras maneiras.
The automatic control system may also be connected to a battery backup power supply, such that power to the automatic control system may not be interrupted, even if the electric power to the system is interrupted.	O sistema de controle automático pode também ser conectado a uma bateria de suprimento de eletricidade auxiliar (RAT, por exemplo), tal que a energia para o sistema de controle automático não possa ser interrompida, mesmo se a energia elétrica para o sistema for interrompida. [perda dos geradores principais]