14
$\begingroup$

It is being reported that airlines in Finland have noticed interference with their GPS signals near Russia. This is causing them to be unable to land at at least one airport:

Lithuanian airline Transaviabaltika said it had been forced to cancel 18 flights between Helsinki and Savonlinna in eastern Finland after the lack of GPS made it impossible to land because Savonlinna airport does not have alternative navigation equipment. (Reuters)

I know very little about planes, but I do know a thing or to about making IT equipment for important functions that can impact public safety, and one of the core rules is never to trust unauthenticated external input for a critical function. I have always assumed that airplane IT is held to a higher standard, mostly because most IT equipment has awful security.

Is it credible that this airplane / airport combination actually relies on GPS for a safe landing? If so, how did this happen? We have always known GPS is hackable, they made a film about it in 1997.

$\endgroup$
14
  • 29
    $\begingroup$ Bond movies are not exactly known for technological accuracy. $\endgroup$
    – GdD
    Mar 10 at 13:27
  • 4
    $\begingroup$ @GdD Indeed, but they at least demonstrate that the possibility of disrupting this system was in the public sphere. If anything Bond made it look harder than it really is. $\endgroup$
    – User65535
    Mar 10 at 13:39
  • 9
    $\begingroup$ Remember that there is a big difference between safety criticality and mission criticality. Safety was not impacted by the GPS outage. $\endgroup$
    – Jim
    Mar 10 at 16:28
  • 10
    $\begingroup$ GPS is not really hackable. It can be jammed just like basically any other radio communication, but between the space- or ground-based augmentation, RAIM and cross-check with the inertial navigation there is effectively no way to make it indicate incorrect position without the system noticing. $\endgroup$
    – Jan Hudec
    Mar 10 at 21:10
  • 10
    $\begingroup$ @JanHudec Hmm.... that reminds me of this incident where Iran at least claimed to have spoofed GPS in order to trick a U.S. drone into landing at one of its airbases. This IEEE Spectrum article from 2016 also seems to suggest that GPS spoofing is a real threat. $\endgroup$
    – reirab
    Mar 10 at 22:05

4 Answers 4

24
$\begingroup$

GPS, or to be more accurate, GNSS is a commonly used navigational aid in aviation, especially in smaller passenger planes. Larger airliners are more likely to be also equipped with inertial navigation systems which do not rely on external sources for guidance but they need to be calibrated from time to time to maintain accuracy.

The reason for the use of GNSS systems is its good accuracy and extremely high temporal and spatial availability (system can be used pretty much any time, anywhere) in comparison to the land-based navigation systems.

Loss of GNSS or inertial navigation capability is not safety-critical in the sense that other more traditional navaids such as VOR and radar navigation usually remain available, and in the case that even those fail or are out of reach, there still is the archaic method of using the compass and map, a skill that is required from professional pilots even today.

While I'm not fully briefed in the case in question, it is obvious that the situation was problematic, because due to the problems with GPS signal, the aircraft was unable to execute RNAV procedures in the vicinity of the airfield.

As for the safety implications of this, while it may seem a huge risk, aviation procedures take into account the possible vulnerabilities of GNSS. The devices are redundant and monitor their own performance and the reliability of the signal. Should they detect any anomalies, pilots are made aware of this, and they can use other means of navigation. Pilots also monitor the information provided to them by instruments, and cross-check this with other source to verify reliability.

As the airfield in question (EFSA) apparently did not have air traffic control services provided, there was no other means available to continue safely. It is my understanding that the flight in question was not yet in approach phase. According to AIP Finland EFSA does also provide the more traditional ILS approach which does not rely on GNSS, but as there was no method to reach the initial approach fix with great enough accuracy, the flight had to turn back.

To reiterate the safety of landing using satellite navigation: even if the flight in question was already making an RNAV approach, this method is highly redundant, and unreliable/hacked signal would with almost full certainty lead to a missed approach, and return to point of departure or an alternate airfield.

$\endgroup$
5
  • 2
    $\begingroup$ Very strange. EFSA has the Linna VOR/DME (SVL) located nearby, yet the only approach chart I can find for the ILS approach to runway 12 doesn’t reference it. It says GNSS required. Why wouldn’t they include traditional VOR on the approach chart? $\endgroup$
    – TomMcW
    Mar 10 at 16:37
  • 2
    $\begingroup$ @Tom, are you sure it is a VOR-DME? From a couple of the AIP charts (1, 2) it appears to be a DME only. $\endgroup$
    – randomhead
    Mar 10 at 20:03
  • 2
    $\begingroup$ @TomMcW the EFSA AD section 2.19 RADIO NAVIGATION AND LANDING AIDS only lists LOC, GP and DME. So there is no VOR approved to be used for procedures at EFSA. $\endgroup$
    – Jpe61
    Mar 10 at 21:36
  • $\begingroup$ @randomhead Several pages I looked at listed it as a VOR/DME. If you look at the satellite photo it looks like a VOR. Everything lists it’s usage as “RNAV” though. That confuses me. $\endgroup$
    – TomMcW
    Mar 11 at 5:24
  • 2
    $\begingroup$ @Jpe61 I see that it’s not approved for the procedures, I’m just curious as to why. I think I’ll post it as a question. $\endgroup$
    – TomMcW
    Mar 11 at 5:25
16
$\begingroup$

Is GPS safety-critical?

Yes. See also Criticality of GNSS Applications on ESA's Navipedia.

Why is it used?

Historically:

After Korean Air Lines Flight 007, a Boeing 747 carrying 269 people, was shot down in 1983 after straying into the USSR's prohibited airspace, in the vicinity of Sakhalin and Moneron Islands, President Ronald Reagan issued a directive making GPS freely available for civilian use, once it was sufficiently developed, as a common good. (Wikipedia)

In areas where there can't feasibly be radars and terrestrial radio navigation, purely on-board sensors (inertial navigation systems) lose accuracy over time.

It also makes it economical to design and implement an arrival procedure (a way to navigate to a runway) to a low-volume airport, increasing the accessibility.

It's also de facto used for position reporting where required.

Safe?

It's safe since as the article shows, they didn't go there. There are systems (including on-board systems) that monitor the accuracy and integrity of the GPS signal (RAIM).

However, there have been calls for a while now to bring back LORAN as backup to avoid such disruptions.


Further reading:

$\endgroup$
3
  • 1
    $\begingroup$ re KAL007. It is believed that the INS was initialized before takeoff improperly by the captain. The INS system is unbelievably accurate (especially considering the age of this technology) but it requires careful initialization of it starting location. This requires the pilot and copilot both enter the current location and crosscheck. It is believed the captain re-used invalid coordinates entered by the copilot. Over the ocean there is nothing but the INS. No radio nav, no radar, and at night - nothing but darkness - so they went waaaay off course without noticing. And got shot down. $\endgroup$
    – Rod Dewell
    Mar 11 at 15:10
  • $\begingroup$ Couldn't safety be improved by using multiple GNSS technologies at once, e.g. GPS + GLONASS? $\endgroup$
    – forest
    Mar 13 at 0:40
  • 1
    $\begingroup$ @forest: One of the systems argued for in the 80s was a civilian sat nav system for aviation, but the idea that GPS is totally free was hard to turn down, despite the known vulnerabilities, also at the time little was known about GLONASS and whether it could be trusted to be available 24/7 and free of charge. GPS+GLONASS was also at the time deemed not financially feasible. (Durand, 1990) $\endgroup$
    – user14897
    Mar 13 at 8:52
13
$\begingroup$

As a pilot I do not disagree with the informative comments above, and would like to add a few additional points to ease your fears.

  1. Pilots DO use GPS (satellite) for navigation - in concert with an assortment of other radio navigation signals such as VOR/DME stations and ADF (AM band) to constantly keep track of where they are. On board there are gyroscopes inside the IRS that work independently without any external influence. All aircraft can additionally be guided by air traffic control using radar. Every pilot is trained to use a compass and stopwatch if necessary. All available resources are used together and are actively crosschecked. The pilot (or autopilot) will quickly notice if something doesn't crosscheck.

  2. For landing, airports may offer additional lateral and vertical guidance. They range from simple light signals, to the ILS guidance, to fully-coupled automated control where the computer lands the plane. The precision is so high that the human pilot can only choose to abort the landing. Again, all indicators are constantly crosschecked and if anything gets weird the pilot (or autopilot) will simply execute a pre-planned abort procedure called a "go around" - and try again.

  3. With the above said, all of these navigation aids are prone to power failure, misalignment, intermittency, sabotage, and human error. Oceans and Mountains can also interfere. So there are occasions when a pilot may have limited or unreliable information. In these situations, the pilot will not be fooled and can elect what to do. (Pilot overconfidence may then become a factor.)

In conclusion, a missing, inaccurate, or sabotaged signal (GPS or anything else) is unlikely to lead to an accident or a lost pilot.

NOTE: I believe it was the movie Die Hard II where the bad guys recalibrated the ILS at the airport so the planes would hit the ground before reaching the runway. This only works in action movies. And you don't really need to worry about Gen5 cell phone signals interfering with the radar altimeters either. While research has shown that some interference is possible under invalid, but conceivable, circumstances, it is very unlikely the pilot wouldn't notice discrepancies long before hitting the ground.

On your question about cyber security I know that none of the above (except maybe the CAT3 auto landing) is really prone to a crypto attack. Pilots already factor out any signal that doesn't correlate with the others - no matter what the underlying reason is - and they are accustomed to doing so because it happens all the time. Even simultaneously attempting to jam, misalign, or impose some denial of service attack on every signal at the worst possible time will not likely cause a crash. And such is the case with the Finnish pilots. They noticed the discrepancies long before it was a problem.

$\endgroup$
2
  • 2
    $\begingroup$ I say this from an engineering point of view, not a flying one. As "Pilots already factor out any signal that doesn't correlate with the others" it would appear that interference with GPS would remove one important signal, significantly reducing redundancy and the margin for other failures. That could mean the need to do things differently, such as divert to where conditions or equipment are more suitable. Is that a valid conclusion for me to draw? $\endgroup$
    – Chris H
    Mar 11 at 10:41
  • 3
    $\begingroup$ Your conclusion is valid, and diversion is precisely what happens - routinely. (mostly cuz of weather) The loss or compromise of anything, navigation or other, reduces margins and confidence. And there are rules, policies, and laws that establish certain minimums to keep an overconfident pilot from setting up a dangerous scenario, especially for passenger operations. When minimums are not attainable, the pilot will divert to an alternate airport that should have been selected before takeoff, and should still have 30 minutes of fuel left when he arrives at the alternate. $\endgroup$
    – Rod Dewell
    Mar 11 at 14:57
1
$\begingroup$

It's not something that's absolutely needed to fly, but more advanced EGPWS units like the Honeywell Mark XXII EGPWS a terrain database and GPS as at least one of the inputs for locating the aircraft. Normal GPWS can tell when the aircraft is approaching the ground below, but EGPWS's terrain database can prevent suddenly flying into the side of a mountain.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.