domingo, 1 de janeiro de 2023

WAS IT A FLARE ACCIDENT OR LANDING ACCIDENT?

 


INVESTIGATION MUST REPORT IF THE ACCIDENT WAS A LANDING ACCIDENT OR A FLARE ACCIDENT


Mastering the Landing Flare/Round out

Pilot Perception

Analysis of 6,676 aircraft accident reports published by the National Transportation Safety Board

134 pilots with varying experience levels

Sources:

  •           THE INTERNATIONAL JOURNAL OF AVIATION PSYCHOLOGY, 12(2), 137–152
  •      Oklahoma State University
  •      Department of Psychology
  •      Laboratory of Comparative and  Behavioral Biology

           Danny Benbassat and Charles I. Abramson

  •  Razia Rashid - founder of Psychology To Safety
  •  ATSB RESEARCH AND ANALYSIS REPORT
  • Aviation Safety Research Grant – B2005/0119

Aerial perspective is a monocular cue which is used for depth perception [the atmosphere causes distant objects to look hazy or blurry], which is used to judge how far away objects are. Monocular cues are named because they can occur only using one eye (as opposed to binocular cues which only occur with the use of both eyes).

Critical perceived time to contact (TTC)



Time remaining until the aircraft’s wheels make contact with the runway if no further action is taken (Mulder et al 2000).

TTC must be estimated directly, without first estimating speed and distance, based on the following ratio (known as tau):

TTC ≈ θ/(dθ/dt)

Where θ is the visual angle between the aimpoint and any other point on the ground plane at time one (see Figure above); and dθ/dt is the rate of change of this angle over time (Hoyle F 1957; Kaiser & Mowafy 1993; Lee, DN 1976).

Tau is a monocular cue to time-to-contact. During a landing, tau can be defined as the ratio of the angular distance between any two points on the ground (which happen to lie along the aiming line) divided by how fast this angular distance is increasing. Several other versions of tau have been proposed (see Regan & Gray 2000).

In more recent aviation research, Mulder and colleagues (2000) found mixed support for the proposals that flare timing is based on perceived runway angle (ψ) and perceived TTC (based on tau).

Study

The effects of pilot’s critical flare operation on long and hard landing events based on real flight Quick Access Recorder (QAR) data.

Flare accident rates

Causes for improper flares

The flare is the transition from a controlled descent to actual contact with the landing surface (Federal Aviation Administration [FAA], 1999; Grosz et al., 1995) and is also known as the flare out, round out, or level off (Jeppesen, 1985).

The task of determining the aircraft altitude above ground is crucial to a successful flare (Green, Muir, James, Gradwell, & Green, 1996) and is accomplished by the use of vision more than any other sense (FAA, 1999; Jeppesen, 1985; Menon, 1996; Nagel, 1988; Thom, 1992).

Depth Perception

Depth perception deals with the ability to see the environment in three dimensions and estimate distances of objects from us and from each other.

Aerial Perspective, objects at larger distances from us are affected by natural scattering of light and form less of a contrast with their background; making it harder to gauge a distance between the two and us.



Monocular cues operate when a person is looking with only one eye

 Pilots rely on monocular depth perception cues rather than binocular depth perception cues (Benson, 1999; Bond, Bryan, Rigney, & Warren, 1962; Langewiesche, 1972; Nagel, 1988).

Monocular depth perception is learned or dependent on experience (Benson, 1999; Bramson, 1982; Langewiesche, 1972; Love, 1995; Marieb, 1995; Tredici, 1996).

-          It is used by artists to induce depth in their two dimensional paintings. Thus, they are also called as the pictorial cues.

The monocular cues that help us in judging the depth and distance in two-dimensional surfaces:

·         Linear perspective: Imagine you are standing between the rail tracks and looking in the distance. You would see that the rail track become smaller and smaller, until there is a point where they meet each other. Linear perspective reflects this phenomena. It says that the distant between two objects far away appear to be smaller than what the distance actually is.

·         Interposition or overlapping:  This monocular cue occurs when one object covers the other. The object that is completely visible seems to be nearer and the object that is partially visible seems to be farther away.

·         Clearness: The more clear the object the nearer it seems. For example, on a hazy day a distant mountain would appear far away than on a clear day, because haze blurs the fine details. Therefore, if we see details of an object we perceive it closer.

·         Relative height: We perceive large objects to be closer to us and smaller objects to be farther away.

·         Motion parallax/ Movement: This cue occurs when the objects are in motion. The distant object appears to move slowly than the objects that are close.



Binocular cues operate when both our eyes are working together

Binocular depth perception is innate or acquired very early in life (Fox, Aslin, Shea, & Dumais, 1980; Kalat, 1998; Reading, 1983; Reinecke & Simons, 1974).


The cues that are provided by both the eyes working together:

·         Retinal or binocular disparity: Humans have two eyes which are horizontally separated by a distance of 6.5 centimeters. Because of this distance between two eyes the images formed on retina of a same object is slightly different. This difference in the images of two eyes is retinal disparity.

·         Convergence: when we see a closer object our eyes turn inward or converge, so that the image is formed on the fovea. Some muscles in our eyes send signal to the brain regarding the degree of convergence and our brain interprets it as a cue for depth perception. The more your eyes turn inward or converge the nearer the objects appear in the space.

·         Accommodation: The process by which ciliary muscles change the focal length of the eyes so that the image is clearly formed on the retina is called the accommodation of the eye. The accommodation varies for near and distant objects and also for objects moving away or towards the eye.

Failure to accurately determine aircraft altitude may result in flaring the aircraft too high (Gleim, 1998; King, 1999; Quinlan, 1999) or too low above the runway (Christy, 1991; Kershner, 1981; Love, 1995).

Improper flares also increase brake, nosewheel tire, and nosewheel shimmy dampener wear (on Cessnas; Christy, 1991; Jorgensen & Schley, 1990).

Improper flares may affect pilot self-esteem and selfefficacy.

The flare maneuver was defined as the ability to determine 10 to 20 ft from the ground and initiate the leveloff.

Three groups of pilots (novice, intermediate, and expert) were surveyed with purposive sampling.

Participants were 134 pilots (novice = 55, intermediate = 45, expert = 34) from three Part 141-approved flight schools in the state of Oklahoma.

Pilot perceptions were assessed with a 21-item questionnaire.

Pilots were asked to rate the flare maneuver and nine other randomly selected standard flight maneuvers for the level of difficulty on a scale ranging from 1 (extremely easy) to 7 (extremely difficult) under optimal conditions (i.e., no wind, 10 miles visibility).

After rating the 10 items, pilots turned the page and learned that the study was specific to the landing flare.

In Item 11

Pilots were provided with the number of total annual U.S. landing accidents and were asked to estimate the number of annual flare accident frequencies.

In Item 12

Pilots were asked to indicate how confident they were in their estimates of annual flare accident frequencies on a scale ranging from 1 (low confident) to 7 (high confidence).

The next items were not only specific to the landing flare but also to their ability to determine when to initiate the flare, that is, estimate 10 to 20 ft from the ground.

In Item 13

Pilots imagined that they were transitioning from descent attitude to flare attitude and indicated how confident they were that their aircraft was 10 to 20 ft from the ground on a scale ranging from 1 (low confidence) to 7 (high confidence).

In Item 14

Pilots recalled their first solo flare attempts and rated factors that assisted them in determining the aircraft altitude before initiating the flare (CFI instruction, instrument readings, practice, pilot manual, ground-school training, other) on a 7-point-scale ranging from 1 (not at all) to 7 (to great extent).

In Item 15

After a reminder that pilots flare the aircraft 10 to 20 ft from the ground, ascertained how pilots rated the task of judging altitude when initiating the flare on a scale ranging from 1 (very easy) to 7 (very difficult).

In Item 16

Pilots imagined that they were on approach for landing and were asked to choose how they determine when to initiate the flare. how did they know they were 10 to 20 ft from the ground (instrument readings, gut reaction, I don’t, sense of sight, sense of balance, other).

In Item 17

Pilots were asked to indicate if there was a need for improved flare-training methods, on a scale ranging from 1 (definitely yes) to 7 (definitely no).

In Item 18

To what factors (pattern practice, natural ability, sheer luck, aviation books, my instructor, other) did they attribute their current successful landing flares, on a scale ranging from 1 (not at all) to 7 (to great extent).

Items 19 and 20 (reiterated Items 16 and 18)

Required pilots to elaborate and explain their responses. Pilots were instructed to think carefully before they answered and be as specific as possible.

In Item 21

Pilots were asked to indicate what type of visual information assisted them in determining when to initiate the flare.

CONCLUSION

 Overall, 6,676 accident reports produced by the NTSB were analyzed for flare accident rates.



Flare accidents

Proper flares depend on monocular cues, and monocular cues depend on experience (Hawkins, 1993; Rinalducci, Patterson, Forren, & Andes, 1985).

On average, the flare only lasts approximately 6 sec and a pilot with a total time of 5,000 hr only has approximately 8 hr of flare time (King, 1998).


In more recent aviation research, Mulder and colleagues (2000) found mixed support for the proposals that flare timing is based on perceived runway angle (ψ) and perceived TTC (based on tau).

Critical perceived runway angle (ψ)

Pilots could initiate the landing flare when the visual angle (ψ) formed between the left and right edges of the runway at the aiming line reaches a critical value (Mulder et al, 2000).

In fact, pilots use different cues or combinations of monocular cues. For example, overall, the horizon and end of runway, shape of runway or runway markings, and familiar objects were the most frequent visual cues that pilots used to estimate their altitude during the flare.

However, University of Oklahoma pilots most frequently used the horizon or end of runway, whereas Oklahoma State University pilots used the shape of runway or runway markings.

Softer throttle reduction is helpful for a better flare performance. Not immediately IDLE. 

The force of the engines and of gravity are driving the airplane down and forward. When you rotate the nose up for the flare, some of the energy that was used to propel the airplane forward is now used to further arrest the force of gravity. You have less force available for forward motion, your speed necessarily decreases.

Flare energy

The rotation-to-flare requires energy to arrest downward momentum; the amount of energy required depends on the glide path angle, any differences in aircraft speed from target speed, and any acceleration/deceleration. It will be to your advantage to make the angle and speed differences the same for every landing.

The rotation-to-flare may or may not bleed airspeed, depending on aircraft flight idle and ground effect characteristics. Here are three examples:

 B747 — The combination of a very large wing span induced ground effect perfectly compensates for energy needed to arrest the descent. Once the descent has been arrested, the flight idle and ground effect result in no airspeed loss at all under most conditions. The airplane has to be flown onto the runway, it will not run out of speed and sit itself down.

GV — The GV also has a very large wing span and high flight idle engines. The descent can be arrested with very little loss of speed, but the airplane does lose speed gradually if held inches off the runway. But, once again, it should be flown onto the runway to avoid a long landing.

G450 — The G450 will lose about 5 knots in the rotation to flare, which is precisely the minimum speed increment to VREF. Once the rotation to flare is made, speed decay continues as flight idle and ground effect are not enough to maintain speed. Any exaggerated flare for the sake of touchdown will result in a significant loss of speed. Once again, the airplane should be flown onto the runway.




VERY SOFT LANDING

The FLARE curve it has two breaking points: The first, it is on (Xf, Hf) [Glide Slope breaking point] and the second one it is on Xtd flare breaking point [Flare breaking point it is at the touchdown point]. Ideally, from this point on the flare curve must be tangent to runway surface to make a soft landing.

Very soft landing, it is that the Pilot Flying does not let the green curve flare segment [beyond Xtd point] to descend below X axis.
That green curve segment after the touchdown point it can NOT descend below the X axis
It does tangent on the runway surface plane for smoothing landing.

When to flare

What "the book" says:

"Very few manufacturers specify a flare height. Gulfstream, for example, leaves you off at 50 feet and the next thing you know, you are in the touchdown zone. Some Bombardier manuals say, "at or below 50 feet." About the only manufacturer that does print a height is Boeing. In their Boeing 777 Flight Crew Training Manual, they say this: "Initiate the flare when the main gear is approximately 20 to 30 feet above the runway by increasing pitch attitude approximately 2° - 3°. This slows the rate of descent." That pretty much agrees with what we did in the Boeing 747." 

You should consult your manufacturer's books.

HINT

Pilot after crossing over threshold at the height 50 ft for landing MUST NOT LET his/her eye corners to capture any lateral vision, mainly Pilot Flying, because of lateral vision illusion which induces pilot to see a relative movement speeding up the plane. That false relative speed up produces a sensation of runway length it would be shortening very quickly. Runway excursion.






quinta-feira, 10 de novembro de 2022

THERE WAS A REPORT OF MALFUNCTION ON THE AUTOTHROTTLE A COUPLE OF DAYS BEFORE - Sriwijaya Flight SJ182 B737-500

 


There was a report of malfunction on the autothrottle a couple of days before to the technician in the maintenance log, said Nurcayho Utomo.

Autothrottle (A/T) Computer Modification

On 16 November 2000, the FAA issued Airworthiness Directive (AD) number FAA AD 2000-23-34 to replace the existing A/T computer with a new P/N. The FAA AD refers to the Boeing Service Bulletin number SB 737-22A1130 dated 24 September 1998.

The AD was applicable to all Boeing Model 737-300, -400, and -500 series airplanes was effective from 8 January 2001. The AD referred to Boeing Alert Service Bulletin number 737-22A1130 which required replacement of the previous A/T computer with improved A/T computer Boeing P/N 10-62017-30 or 10-62017-31.

The AD addressed the problem of split thrust lever movement caused by irregular A/T operation which results in asymmetric thrust conditions causing the airplane to bank excessively and going into a roll.

On 21 October 1998 Boeing issued a Service Letter (SL) number 737-SL-22-039 and on 30 April 2003 issued SL number 737-SL-22-039-A to advice the operator to incorporate the new A/T computer with P/N 10-62017-30 (Smiths P/N 735SUE9-12, 735SUE10-12 or 755SUE2-4) or 10-62017-31 (756SUE3-4).

The 10-62017-30/31 A/T computer has been modified to address in-service reports of asymmetric thrust events and A/T takeoff setting being oscillatory and overshooting the target N1.

The modification included the CTSM function and a revision to the takeoff N1 set logic. The CTSM function is enabled when the flaps are set at less than 15 degrees.

The function will disengage the A/T when the net thrust difference between the two engines exceeds a limit, more than 2.5 degrees of spoiler deployment is used to control the roll attitude of the aircraft, and the aircraft is not on takeoff or go-around.

The A/T new P/N refers to the A/T computer manufacturer (Smiths) SB number 735SUE-22-1266 and 735SUE-22-1267 which is to be enhanced with the following:

• Thrust Split Monitor

• Improved T/O N1 Set-point Algorithm

• Output ARINC bus label 270, bit 27, changed to show internal disengagement.

• Power lever angle (PLA) sensor validity added to disconnect logic.

• Revised forward stop Built-In Test Equipment (BITE) test to improve reliability

• Added the following in-flight BITE messages:



• Improved torque switch bypass logic for thrust levers moving up from aft stop.

• Corrected several BITE nomenclature discrepancies.

The CTSM code was reviewed by Boeing and GE Aviation with no anomalies identified. The A/T computer manufacturer reviewed their historical documents which demonstrated satisfactory completion of required bench testing at the time of certification. The CTSM passed the operational test that was performed during a flight test. This flight test was historical data obtained during the certification program.

The FAA AD 2000-23-34 was performed when the aircraft was being operated in United States and prior to delivered to Sriwijaya Air on 2012 with the updated modification of the A/T computer with P/N 735SUE10-12 or 755SUE2-4.



The Test of Previously Installed Autothrottle Servo

The A/T servo P/N 111RAA3, was manufactured by Smiths Aerospace (now General Electric/GE). The A/T servo of P/N 111RAA3 with S/N 3480 was previously installed on the PK-CLC aircraft and was removed from the aircraft on 22 December 2020 for A/T problem troubleshooting. The maintenance records showed that the unit was installed on PK-CLC aircraft since 1994.

The A/T servo S/N 3480 was sent to Ontic facility in Chatsworth, California, United States of America on 22 January 2021 for testing. During the conduct of the test, it was revealed that the Ontic test bench was unserviceable and the test was rescheduled.

The A/T servo then was sent to Ontic Cheltenham UK and was received on 12 August 2021. The unit was immediately transferred to a secure store for a scheduled test on 9 December 2021.

On 9 December 2021, the test commenced and was witnessed by KNKT, NTSB, Boeing and AAIB UK.

Pilot Duties and Responsibilities

Sriwijaya Air Company Operation Manual (COM) subchapter 1.4.1 described the responsibility and authority of Pilot in Command as follow:

The pilot in command of an aircraft is directly responsible for, and is the final authority as to, the operation and security of the aircraft.

In an in-flight emergency requiring immediate action, the pilot in command may deviate from any rule of part 91 to the extent required to meet that emergency.

The pilot in command must comply with this Company Operations Manual, Company directives, Standard Operating Procedures, and CASR.

The following guidance on crew duties was provided to Sriwijaya’s pilot which was listed in the Sriwijaya Air version of the Boeing 737-300/-500 Flight Crew Operations

Manual (FCOM), “Normal Procedure” page NP 11.2 thru 11.4, dated March 18, 2016.

Crew Duties

The general PF phase of flight responsibilities are:

• taxiing

• flight path and airspeed control

• airplane configuration

• navigation

The general PM phase of flight responsibilities are:

• checklist reading

• communications

• tasks asked for by the PF

• monitoring taxiing, flight path, airspeed, airplane configuration, and navigation

PF and PM duties may change during a flight. For example, the captain could be the PF during taxi but be the PM during takeoff through landing.

The mode control panel is the PF’s responsibility. When flying manually, the PF directs the PM to make the changes on the mode control panel.

The captain is the final authority for all tasks directed and done.

The crew must always monitor:

• airplane course

• vertical path

• speed

When selecting a value on the MCP, verify that the respective value changes on the flight instruments, as applicable.

The crew must verify manually selected or automatic AFDS changes. Use the FMA to verify mode changes for the:

• autopilot

• flight director

• A/T

During LNAV and VNAV operations, verify all changes to the airplane’s:

• course

• vertical path

• thrust

• speed

Announcing changes on the FMA and thrust mode display when they occur is a good CRM practice.

The COM subchapter 8.1.10.6 also required PIC to report and record of mechanical irregularities as follows:

Whenever a pilot finds a defective equipment, the PIC will:

1. Check the Aircraft Maintenance Log to see if the item has been previously reported and properly deferred. If the item has not been previously written up, the PIC will record the pertinent information on the Aircraft Maintenance Log.

2. Check the approved Minimum Equipment List to determine if the defective equipment may be deferred and the conditions that must be met.

3. If the defective equipment is not deferrable, the PIC will not allow the aircraft to take off until mechanical irregularity is corrected or acceptable Dispatch Authorization has been issued.

Policy on the Use of Automation

The COM subchapter 8.3.18 described the policy on the use of automation as follow:

Automatic flight systems are designed to enhance flight safety and efficiency and must be used to their fullest extent.

Company’s policy that the highest level of automation appropriate to the task should be used.

The Flight Crew must not allow automation to detract from the overall management of the flight.

The Sriwijaya Air version of the Boeing 737 CL Flight Crew Training Manual (FCTM), page 1.38 described that during all phases of flight, the use of A/T is recommended when the A/P is engaged.

Normal Procedure on Climb and Pass 10,000 feet

The following guidance on climb and cruise was provided to Sriwijaya’s pilot which is listed in the Sriwijaya Air version of the Boeing 737-300/-500 FCOM, page NP 21.39 dated June 15, 2020:

Upset Recovery Procedure

The Sriwijaya Air version of the Boeing 737 CL FCTM, page 7.33, described upset recovery as follows:

For detailed information regarding the nature of upsets, aerodynamic principles, recommended training and other related information, refer to the Airplane Upset Prevention & Recovery Training Aid (AUPRTA) available through your operator and on the ICAO website.

Historically, an upset has been defined as unintentionally exceeding any one or more of the following conditions:

• pitch attitude greater than 25° nose up

• pitch attitude greater than 10° nose down

• bank angle greater than 45°

• less than the above parameters but flying at an airspeed inappropriate for the conditions.

The latest revision of AUPRTA concludes that an upset condition exists any time that an airplane is deviating from the intended airplane state. The AUPRTA has been updated to emphasize the importance of recognition and avoidance of situations that can lead to airplane upsets and to improve a pilot’s ability to recover control of an airplane that deviates from the intended airplane state. An airplane upset can involve pitch or roll angle deviations as well as inappropriate airspeeds for the conditions.

With the focus on upset recognition and avoidance, pilots should understand how to operate the airplane throughout the entire operational flight envelope. Pilots should have practical knowledge of and demonstrate proficiency in airplane performance and handling characteristics.

Upset prevention and recovery training should emphasize the entire operational flight envelope to develop pilot awareness and handling skills in both manual and automated flight.

 Nose Low, High Bank Angles

The nose low, high angle of bank upset requires prompt action by the pilot as altitude is rapidly being exchanged for airspeed. Even if the airplane is at a high enough altitude that ground impact is not an immediate concern, airspeed can rapidly increase beyond airplane design limits. Simultaneous application of roll and adjustment of thrust may be necessary. It may be necessary to apply nose[1]down elevator to limit the amount of lift, which will be acting toward the ground if the bank angle exceeds 90°. This also reduces wing angle of attack to improve roll capability. Full aileron and spoiler input should be used if necessary to smoothly establish a recovery roll rate toward the nearest horizon. It is important to not increase g force or use nose-up elevator or stabilizer until approaching wings level. The pilot should also extend the speed brakes as needed.

High Bank Angles

If the airplane is not in “zero-angle-of-bank” flight, lift created by the wings is not being fully applied against gravity, and more than 1 g is required for level flight.

At bank angles greater than 67°, level flight cannot be maintained within AFM load factor limits. In high bank angle increasing airspeed situations, the primary objective is to maneuver the lift of the airplane to directly oppose the force of gravity by rolling in the shortest direction to wings level. Applying nose-up elevator at bank angles above 60° causes no appreciable change in pitch attitude and may exceed normal structure load limits as well as the wing angle of attack for stall. The closer the lift vector is to vertical (wings level), the more effective the applied g is in recovering the airplane.

A smooth application of up to full lateral control should provide enough roll control power to establish a very positive recovery roll rate. If full roll control application is not satisfactory, it may even be necessary to apply some rudder in the direction of the desired roll.

Only a small amount of rudder is needed. Too much rudder applied too quickly or held too long may result in loss of lateral and directional control or structural failure.

The Sriwijaya Air version of the Boeing 737 Quick Reference Handbook (QRH), page

MAN.1.7, described the upset recovery procedure as follows:

Historically, an upset has been defined as unintentionally exceeding any one or more of the following conditions:

• pitch attitude greater than 25° nose up

• pitch attitude greater than 10° nose down

• bank angle greater than 45°

• less than the above parameters but flying at an airspeed inappropriate for the conditions.

An upset condition is now considered any time an airplane is diverting from the intended airplane state. An airplane upset can involve pitch or roll angle deviations as well as inappropriate airspeeds for the conditions.

The following actions represent a logical progression for recovering the airplane.

The sequence of actions is for guidance only and represents a series of options to be considered and used dependent on the situation. Not all actions may be needed once recovery is under way. If needed, use minimal pitch trim during initial recovery. Consider careful use of rudder to aid roll control only if roll control is ineffective and the airplane is not stalled.

These actions assume that the airplane is not stalled. A stall condition can exist at any attitude and can be recognized by one or more of the following:

• Stick shaker

• Buffet that can be heavy at times

• Lack of pitch authority

• Lack of roll control

• Inability to stop a descent.

If the airplane is stalled, first recover from the stall by applying and maintaining nose down elevator until stall recovery is complete and stick shaker stops.


 









quinta-feira, 8 de setembro de 2022

INDUCED SPOOFING FROM APPROACH TO LANDING - During Taxi and Takeoff as well

 


ABRIDGED RESEARCH ON FLIGHT INDUCED SPOOFING


IET Radar, Sonar & Navigation

University of Texas at Austin

Flight Induced spoofing

Accepted: 29 August 2021

Revised: 22 July 2021

Received: 3 June 2021


Sources:

Wang, W., Wang, J.: GNSS induced spoofing simulation based on path planning.

IET Radar Sonar Navig. 16(1), 103–112 (2022).

https://doi.org/10.1049/rsn2.12167

 

DW INTERNATIOONAL - A NAVTECH COMPANY

John Wilde

Radio Navigation System Engineer at Qascom, Italy

Samuele Fantinato

Signal Processing Engineer at Qascom, Italy

Stefano Montagner

Signal Processing Engineer at Qascom, Italy

Stefano Ciccotosto

Founder and Technical director of Qascom, Italy

Oscar Pozzobon

 

REFERENCES

1. JafarniaJahromi, A., et al.: GPS vulnerability to spoofing threats and a review of antispoofing techniques. Int. J. Navig. Obs. 2012, 127072 (2012). https://doi.org/10.1155/2012/127072

2. Carroll, J.V.: Vulnerability assessment of the transportation infrastructure relying on global positioning system. J. Navig. 56(2), 185–193 (2003)

3. Humphreys, T.E., et al.: The Texas spoofing test battery: Toward a standard for evaluating GPS signal authentication techniques. In: Proceedings of the ION GNSS+ meeting, pp. 3569–3583. Nashville. September 2012

4. Kerns, A.J., et al.: Unmanned aircraft capture and control via GPS spoofing. J. Field Robot. 31(4), 617–636 (2014)

5. Morales, F.R., et al.: A survey on coping with intentional interference in satellite navigation for manned and unmanned aircraft. IEEE Commun. Surv. Tut. 22(1), 249–291 (2020)

6. Ioannides, R.T., Pany, T., Gibbons, G.: Known vulnerabilities of global navigation satellite systems, status, and potential mitigation techniques. Proc. of IEEE. 104(6), 1174–1194 (2016)

7. Humphreys, T.E., et al.: Assessing the spoofing threat: Development of a portable GPS civilian spoofer. In: Proceedings of the ION GNSS meeting, pp. 16–19. Savannah. September 2008

8. Gao, Y., Lv, Z., Zhang, L.: Asynchronous liftoff spoofing on satellite navigation receivers in the signal tracking stage. IEEE Sens. J. 20(15), 8604–8613 (2020)


Global Navigation Satellite Systems (GNSS) are highly susceptible to various interferences.

By 2030 it is expected that GNSS will be the main navigation system for most of the flight phases. GNSS is nowadays also as an essential component for other aviation systems, such as the Enhanced Ground Proximity Warning System (EGPWS) and Ground Based Augmentation System (GBAS).

It is expected that GNSS based air routes will be able to accommodate up to three times the current traffic volume.




Intentional Spoofing during Approach

An instrument approach may be divided into four approach segments: initial, intermediate, final, and missed approach.

Depending on speed of the aircraft, availability of weather information, and the complexity of the approach procedure or special terrain avoidance procedures for the airport of intended landing, the in-flight planning phase of an instrument approach can begin as far as 100-200 nautical miles (NM) – from the destination,

The ILS system

The major risk for aircraft navigation (most likely during bad visibility conditions) is at the beginning of the approach phase.

The spoofing detection algorithms configurations as:

• Spoofing Doppler could have an offset of several KHz from the authentic.

• Spoofing delay might have an offset up hundreds of chips from the authentic

• Spoofing power offset depends on the relative distance between the aircraft under attack and the sensor

Non Intentional Spoofing during Taxi-in or Take Off

Certain non-aeronautical systems transmit radio signals intended to supplement GNSS coverage in areas where GNSS signals cannot be readily received (e.g. inside buildings). These systems include GNSS repeaters and pseudolites. GNSS repeaters (also known as “reradiators”) are systems that amplify existing GNSS signals and re-radiate them in real-time.


The interference caused alerts of the Enhanced Ground Proximity Warning System providing the messages ”pull-up” and ”FMS/GPS Position disagree” during Taxi-in and departure of the airplanes.


In these interferences, induced spoofing is very difficult to be detected because it can gradually drag off the tracking points without unlocking the tracking loops of the attacked receiver and cause the victim to obtain a wrong position and/or time information.

The importance of GNSS makes it an increasingly attractive target for hackers and criminals.

The openness of the civil GNSS signal structure and the weak transmitting and receiving power make GNSS vulnerable to variable natural and malicious interferences.

The spoofing, as a kind of malicious interference, can possibly make GNSS victims produce wrong positioning and/or time information.

The spoofing attack mainly includes meaconing and generative spoofing attack [5, 6]. For meaconing, spoofers first receive the authentic satellite signals and then amplify and retransmit the signals to the target receivers. However, for generative spoofing, spoofers usually use GNSS simulation software to generate forged signals, which have the same structure as authentic signals but have false navigation data information.

Generative spoofing can be classified as:

Simplistic spoofing - the spoofing and authentic signals received by victims have asynchronous parameters including code phase, carrier phase and other parameters. Simplistic spoofing usually adopts the ‘jammingspoofing’ mode, which first unlocks the target receiver by high power jamming and then enables the victim recapture and lock on spoofing signals.

Intermediate spoofing - is also called induced spoofing or liftoff spoofing. The spoofer first controls the spoofing to synchronise with the authentic signals in the code phase and Doppler frequency so as to disguise as the authentic signals and then gradually controls the tracking loop of the target receiver. Induced spoofing does not destroy the tracking state of the target receiver and smoothly induces the victim to a false position/time, which is more threatening and difficult to be detected.

Sophisticated spoofing - based on induced spoofing, uses multiple transmit antennas and controls the directions of transmitting antennas so that the spoofing signals have the same arrival directions as the authentic ones [10]. It can defend against angleofarrival detection but needs a huge increase in cost and complexity.

Data generation algorithm based on path planning

Induced spoofing and antispoofing




Signal model

Induced spoofing has the same structure as that of the authentic satellite signal but different parameters.

Take GPS L1 C/A as an example; they can be denoted as


When there is an induced spoofing, the victim will simultaneously receive the authentic signal and spoofing as follows:

For induced spoofing, the key feature is that it can gradually drag off the tracking points without unlocking the code loop and carrier loop of the victim. In order to achieve this goal, the spoofer has to first estimate the parameters of the authentic signals received by the target receiver and then adjust the parameters of the spoofing signals to synchronize the code and carrier phases with the authentic signal. After that, the spoofing can drag off the tracking loop of the victim by increasing the power.

However, it is difficult for the spoofer to produce the spoofing signals whose carrier phase is exactly the same as that of authentic signals.

When the spoofer shifts the code phase of the spoofing signals, there are two modes of carrier phase alignment between the spoofing and authentic signals. The first one is the nonfrequency lock mode, where the change rate of the carrier phase is proportional to that of the code phase as follows:


where fc is the carrier frequency in Hz, ϕ and τ represent the change rates of the code phase and carrier phase in seconds per second and cycles per second, respectively.

 

The second one is the frequency lock mode in which the spoofing and authentic signals have a certain initial carrier phase offset, and the fixed offset is maintained in the process of changing the code phase. Thus, the spoofing signal and the authentic signal have the same carrier Doppler frequency.

 

 

It should also be noted that, in the nonfrequency lock mode, the carrier phase difference between the spoofing and authentic signals cannot be kept fixed, which leads to the rapid amplitude variation of the blended signal. The frequency lock mode can avoid the above situation, that is amplitude fluctuation.

Thus, spoofing detection methods based on amplitude fluctuation cannot detect the spoofing.

 

However, the method, based on code rate and Doppler frequency consistency, can be used to detect the frequency lock mode. On the contrary, due to the continuous movement of the satellites, the Doppler frequency of the authentic signals constantly changes even if the victim is stationary. The movement of the victim will intensify this change. In other words, it is difficult for the spoofer to estimate the accurate Doppler frequency of the authentic signals. Therefore, the frequency lock mode is not easy to implement.

The induction process of induced spoofing can be demonstrated by the autocorrelation function (ACF) model of the authentic and spoofing signals. Depending on the methods of code phase alignment, induced spoofings can be classified as synchronous and asynchronous. Figure 1 shows the induction processes of the two methods.

The green dot marks indicate the code phase discrimination result, that is, the tracking point of the receiver. As the correlation peak of the spoofing signal moves, the tracking point of the receiver will shift gradually and finally completely transfer to the spoofing signal. Then, the tracking loop is controlled by the induced spoofing.

As shown in Figure 1a, synchronous induced spoofing mainly has two phases:

(1) T0 T1: alignment phase and

(2) T2: dragoff phase.

 In the alignment phase T0, the power of the spoofing is initially lower than that of the authentic signal when the spoofing is injected, but the code phase and carrier frequency are synchronised with those of the authentic signal.

Then, in T1, the power of the spoofing signal increases gradually until it exceeds the power of the authentic signal. With the power advantage, the tracking loop will be controlled by the spoofing signal. Subsequently, in T2, the spoofing increases its code rate, which causes the spoofing correlation peak to move away from the authentic correlation peak during the dragoff phase. Thus, the tracking point shifts gradually until it is completely transferred to the spoofing correlation peak as T3.

Synchronous induced spoofing signals can effectively forge the authentic signals, but it is necessary to know the precise geographical location and velocity of the target receiver to accurately estimate the code phase and carrier Doppler frequency of the authentic signal. However, it is very difficult to implement in a real spoofing scenario. Therefore, at the beginning, the spoofing generated by the spoofer usually has a certain code phase and Doppler frequency difference with the authentic signal. In this case, the generated spoofing is an asynchronous induced spoofing.

As shown in Figure 1b, the strategy of asynchronous induced spoofing is similar to that of synchronous induced spoofing, and the whole induction process includes three phases: 

In T0', the spoofing initially has some code phase difference from the authentic signal. Then, the spoofing signal will continuously adjust its code phase so that its correlation peak gradually approaches that of the authentic signal until they are aligned. And the subsequent process is similar to synchronous induced spoofing. In this induction process, the spoofer does not know the accurate code phase and Doppler frequency of the authentic signals, which makes it impossible to know when it is synchronised with the authentic signal. Therefore, the spoofing correlation peak must always be higher than the authentic correlation peak to ensure that the spoofing signal can successfully lift off the tracking point after alignment.

In short, by adjusting the change rate of the code phase of spoofing based on a given strategy, the induced spoofing can gradually change the relative code phase difference between the authentic signal and spoofing.

Then, the induced spoofing can control the tracking loop of the victim, which will eventually lead to a wrong position and/or time information output. Therefore, the key step of induced spoofing is to gradually change the relative code phase difference between authentic signal and spoofing.

On the other hand, it is well known that the code phase received by the receiver is related to the transmission time of the satellite signal and the distance between the satellite and receiver based on the principle of satellite navigation. Thus, signals received by receivers in different locations have different code phases even for signals coming from the same satellite and the same transmission time.

Path planning

Suppose there are two receivers; one is called target receiver whose received satellite signals simulate the authentic signals received by the victim receiver. The other is called spoofing receiver whose received satellite signals simulate the spoofing generated by the spoofer.

When the target and spoofing receivers are located at the same threedimensional geographical positions at the same time, the distances from them to each satellite are equal, that is. Similarly, when the target and spoofing receivers are in different threedimensional geographic locations (in a small area), ∆=τi will change and approximately satisfy 

where dr is the distance between the target receiver and the spoofing receiver as

Example of asynchronous induced spoofing to illustrate the algorithm of path planning. The path planning consists of three phases:

(1) As shown in Figure 2a, the target and the spoofing receivers separately move along the solid line and the dotted line at different speeds from time t0 and meet at M1 at time t1, which corresponds to the T0  of Figure 1(b).

Then, Δτi  will change from Δτi  > 0 to Δτi  ¼ = 0.

(2) As shown in Figure 2b, from time t1 to time t2, two receivers move at the same speed along the same path. This process corresponds to the T0 of Figure 1b.

(3) After time t2, as shown in Figure 2c, two receivers begin to move along different paths and the distance between them continuously increases. Thus, the Δτi  changes from Δτi  ¼ = 0 to Δτi  >0. This process corresponds to the T2  of Figure 1b.

The power control of spoofing

The power of spoofing signals is another crucial factor affecting the success of the inducing process. It is worth noting that it is not that the higher the power of the spoofing signal, the better. For the victim, the intrusion of the spoofing will increase the noise floor and affect the carrier-to noise ratio. Excessive power will cause the victim to issue an abnormal alarm. Nevertheless, if the power of spoofing is too low and not synchronized with the authentic signal in the carrier phase, the stability of the tracking loop will be affected. Consequently, the power of the spoofing should be higher than the authentic signal, but not too high.






FIGURE 2 An example of path planning for the target and spoofing receivers to produce an asynchronous induced spoofing (a) Path from time t0 to time t1 (b) Path from time t0 to time t2 (c) Path from start t0 to the end of time.





FIGURE 6 Positioning solutions of authentic, spoofing and mixed signals. (a) Latitude (b) Longitude (c) Height


Non Intentional Spoofing: Repeaters

Intentional Spoofing, Landing Case (Simulated)


Spoofing detection techniques

 The spoofing detection engine has been designed according to the following requirements:

• Capability to Monitor Spoofing with:

– Power Offset: between -3 dB and +15 dB. Lower bound is related to receiver acquisition sensitivity, upper bound is a limit over which the spoofing signal can be considered as an interferer.

– Frequency Offset: related to the maximum relative velocity between the sensor and a plane during the approach phase.

– Delay Offset linked to common distance from the airport of the approach phase beginning.

• Spoofing Detection probability 95% and False Alarm lower than 10-4

• Time to Alarm lower than 5 seconds.