Do airlines use GPS for critical purposes? If so, why?

Question

It is being reported that airlines in Finland have noticed interference with their GPS signals near Russia. This is causing them to be unable to land at at least one airport:

Lithuanian airline Transaviabaltika said it had been forced to cancel 18 flights between Helsinki and Savonlinna in eastern Finland after the lack of GPS made it impossible to land because Savonlinna airport does not have alternative navigation equipment. (Reuters)

I know very little about planes, but I do know a thing or to about making IT equipment for important functions that can impact public safety, and one of the core rules is never to trust unauthenticated external input for a critical function. I have always assumed that airplane IT is held to a higher standard, mostly because most IT equipment has awful security.

Is it credible that this airplane / airport combination actually relies on GPS for a safe landing? If so, how did this happen? We have always known GPS is hackable, they made a film about it in 1997.

Answer 1

GPS, or to be more accurate, GNSS is a commonly used navigational aid in aviation, especially in smaller passenger planes. Larger airliners are more likely to be also equipped with inertial navigation systems which do not rely on external sources for guidance but they need to be calibrated from time to time to maintain accuracy.

The reason for the use of GNSS systems is its good accuracy and extremely high temporal and spatial availability (system can be used pretty much any time, anywhere) in comparison to the land-based navigation systems.

Loss of GNSS or inertial navigation capability is not safety-critical in the sense that other more traditional navaids such as VOR and radar navigation usually remain available, and in the case that even those fail or are out of reach, there still is the archaic method of using the compass and map, a skill that is required from professional pilots even today.

While I'm not fully briefed in the case in question, it is obvious that the situation was problematic, because due to the problems with GPS signal, the aircraft was unable to execute RNAV procedures in the vicinity of the airfield.

As for the safety implications of this, while it may seem a huge risk, aviation procedures take into account the possible vulnerabilities of GNSS. The devices are redundant and monitor their own performance and the reliability of the signal. Should they detect any anomalies, pilots are made aware of this, and they can use other means of navigation. Pilots also monitor the information provided to them by instruments, and cross-check this with other source to verify reliability.

As the airfield in question (EFSA) apparently did not have air traffic control services provided, there was no other means available to continue safely. It is my understanding that the flight in question was not yet in approach phase. According to AIP Finland EFSA does also provide the more traditional ILS approach which does not rely on GNSS, but as there was no method to reach the initial approach fix with great enough accuracy, the flight had to turn back.

To reiterate the safety of landing using satellite navigation: even if the flight in question was already making an RNAV approach, this method is highly redundant, and unreliable/hacked signal would with almost full certainty lead to a missed approach, and return to point of departure or an alternate airfield.

Answer 2

Is GPS safety-critical?

Yes. See also Criticality of GNSS Applications on ESA's Navipedia.

Why is it used?

Historically:

After Korean Air Lines Flight 007, a Boeing 747 carrying 269 people, was shot down in 1983 after straying into the USSR's prohibited airspace, in the vicinity of Sakhalin and Moneron Islands, President Ronald Reagan issued a directive making GPS freely available for civilian use, once it was sufficiently developed, as a common good. (Wikipedia)

In areas where there can't feasibly be radars and terrestrial radio navigation, purely on-board sensors (inertial navigation systems) lose accuracy over time.

It also makes it economical to design and implement an arrival procedure (a way to navigate to a runway) to a low-volume airport, increasing the accessibility.

It's also de facto used for position reporting where required.

Safe?

It's safe since as the article shows, they didn't go there. There are systems (including on-board systems) that monitor the accuracy and integrity of the GPS signal (RAIM).

However, there have been calls for a while now to bring back LORAN as backup to avoid such disruptions.

---

Further reading:

• Required Navigation Performance (RNP), skybrary.aero
• eLoran: Part of the solution to GNSS vulnerability, gpsworld.com

Answer 3

As a pilot I do not disagree with the informative comments above, and would like to add a few additional points to ease your fears.

1. Pilots DO use GPS (satellite) for navigation - in concert with an assortment of other radio navigation signals such as VOR/DME stations and ADF (AM band) to constantly keep track of where they are. On board there are gyroscopes inside the Heading Indicator or the INS that work independently without any external influence. All aircraft can additionally be guided by air traffic control using radar. Every pilot is trained to use a compass and stopwatch if necessary. All available resources are used together and are actively crosschecked. The pilot (or autopilot) will quickly notice if something doesn't crosscheck.

2. For landing, airports may offer additional lateral and vertical guidance. They range from simple light signals, to the ILS guidance, to fully-coupled automated control where the computer lands the plane. The precision is so high that the human pilot can only choose to abort the landing. Again, all indicators are constantly crosschecked and if anything gets weird the pilot (or autopilot) will simply execute a pre-planned abort procedure called a "go around" - and try again.

3. With the above said, all of these navigation aids are prone to power failure, misalignment, intermittency, sabotage, and human error. Oceans and Mountains can also interfere. So there are occasions when a pilot may have limited or unreliable information. In these situations, the pilot will not be fooled and can elect what to do. (Pilot overconfidence may then become a factor.)

In conclusion, a missing, inaccurate, or sabotaged signal (GPS or anything else) is unlikely to lead to an accident or a lost pilot.

NOTE: I believe it was the movie Die Hard II where the bad guys recalibrated the ILS at the airport so the planes would hit the ground before reaching the runway. This only works in action movies. And you don't really need to worry about Gen5 cell phone signals interfering with the radar altimeters either. While research has shown that some interference is possible under invalid, but conceivable, circumstances, it is very unlikely the pilot wouldn't notice discrepancies long before hitting the ground.

On your question about cyber security I know that none of the above (except maybe the CAT3 auto landing) is really prone to a crypto attack. Pilots already factor out any signal that doesn't correlate with the others - no matter what the underlying reason is - and they are accustomed to doing so because it happens all the time. Even simultaneously attempting to jam, misalign, or impose some denial of service attack on every signal at the worst possible time will not likely cause a crash. And such is the case with the Finnish pilots. They noticed the discrepancies long before it was a problem.

Answer 4

It's not something that's absolutely needed to fly, but more advanced EGPWS units like the Honeywell Mark XXII EGPWS a terrain database and GPS as at least one of the inputs for locating the aircraft. Normal GPWS can tell when the aircraft is approaching the ground below, but EGPWS's terrain database can prevent suddenly flying into the side of a mountain.