Spoofing simulation – Tutorial

[Hardy Heinlin]

Aerowinx PSX 10.186 has introduced the possibility to simulate GPS jamming and spoofing for airline training. Here's an overview and a little tutorial.


Instructor page



To enable a spoofing or jamming scenario, select the Enabled checkbox under "Position error" or "Time error". The scenario is disabled when both checkboxes are deselected.

According to the current simulation phase, the Status line may indicate "Aircraft is being spoofed", "Aircraft is being jammed", or "Out of zones, but position error is not reset". In the latter phase the location and altitude errors in the avionics will slowly drift back to normal values. Deselecting the "Position error" Enabled checkbox will clear these errors promptly. Moving the aircraft with the Instructor's repositioning tools will also reset the errors immediately.

To simulate just spoofing without jamming, set the jamming extension to zero.

To simulate just jamming without spoofing, set the spoofing minimum radius and the randomized addition to zero.

The randomized radius addition keeps oscillating between zero and the entered distance. One oscillation cycle may take – at random – 2 minutes up to 2 hours, no matter how great the radius is. The rate is reset to a new random value whenever the amplitude reaches its maximum or minimum.

Valid entries in the latitude/longitude edit fields are:
Airport ICAO code
Navaid identifier
Waypoint name
Latitude longitude



Scenario design methods

• Using the zone as an actual spoofing zone

Set a realistic zone size and location for jamming and spoofing according to official reporting charts; for example, place the zone center at Cairo VOR (CVO) and set the minimum zone radius to 150 nm. Set a random radius addition of 50 nm so that the effects will occur just sporadically when the aircraft is near the outmost 200 nm total radius; the effects will be more stable when the aircraft is closer to the minimum radius.


• Using the zone as a means to create multiple events along the route

You can create multiple randomized spoofing zone entry and exit events along the route using just this single zone. The idea here is to use the spoofing zone solely as an enroute effect generator and not as a representation of a real spoofing zone. For multiple enroute effects make the zone very large (ignore the unrealistic dimension) and set it far away abeam the route. This is just a scenario design method; all we want to see are certain effects along the route – we usually won't leave the route by more than a few hundred miles, if at all. So, enroute we will be experiencing several spoofing zone entries and exits, and we cannot know where all those simulated spoofers are located anyway.




Example 1:

Here we make the zone, especially the randomized zone addition, very large. And we place the zone center so far away that only the outmost oscillation amplitude will cross our route. Therefore, the oscillating radius will rarely enclose our aircraft enroute.





Example 2:

Here we make the zone a bit smaller and set the minimum radius closer to the route so that the oscillating radius will enclose our aircraft enroute very often.





The next picture shows the effective along-route events in both examples.




In all examples, jamming will occur before spoofing begins and after spoofing ends. This behaviour has been observed on many real-life flights. So when jamming occurs you can anticipate an upcoming spoofing situation, and anticipate jamming when spoofing ends.



Spoofed-to variables

During spoofing the onboard GPS units will provide erroneous data to the avionics. You can set a position error or a time error – or both. Select the respective Enabled checkbox.

The onboard GPS units include a damping function to avoid jumps when sudden great deviations occur. So when position spoofing starts, the assumed position in the onboard box will not jump but slowly drift to that spoofed-to location and altitude. It will slowly drift back to the correct data when the aircraft is outside the spoofing and jamming zones; note that the position error is promptly reset when deselecting the "Position error" Enabled checkbox or when repositioning the aircraft with the Instructor tools.

When position spoofing occurs while the FMC is using the GPS, LNAV may command an unusual bank angle to compensate for the alleged, increasing route offset; this unusual banking is a sign to the crew that the aircraft may be spoofed. If you want the spoofing scenario to be less obvious, consider placing the spoofed-to location somewhere within the flight route corridor so that just a small route offset and therefore almost no banking will occur.

When a low spoofed-to altitude is set while the aircraft is at a higher altitude, the EGPWS terrain display and look-ahead warning system will, after a while, start to trigger alerts. As the damped spoofed-to altitude drifts lower and lower, the terrain display will show more and more amber and red areas. The terrain location too will be incorrect. These EGPWS effects appear even when "GPS inhibit" is selected in the FMC; the EGPWS only switches to other data sources when the GPS is inoperative, which is the case during jamming or when the GPS power is offline.

Time errors will never drift but always jump directly to the spoofed-to time, and directly to normal when outside the zones.



Jamming

During jamming the onboard GPS units will be inoperative. Avionics that normally use GPS data will then use other data sources: The FMC position may use the IRS and radio positions, the FMC time may use the left or right pilot's clock, the same for the ACARS time unless ACARS uses its inbuilt DC powered clock. The EGPWS terrain system may use the left or right IRU position and barometric altitude. So when the scenario alternates between jamming and spoofing, the respective changes will be noticeable on the flight deck instruments.

For further details on real-life effects you may want to download this PDF from the FAA:

GNSS Interference Resource Guide

[United__744]

Thanks for this Hardy!!