Aircraft Electrical Systems: A320/A321 Briefing

 

TECHNICAL & OPERATIONAL TRAINING REPORT: GNSS INTERFERENCE (JAMMING VS. SPOOFING)

1. Executive Summary

In modern A320 operations, the ability to distinguish between signal denial (jamming) and signal corruption (spoofing) has become a foundational competency for flight crews. While jamming represents a straightforward loss of navigation capability, spoofing introduces a more insidious threat: a "system lie." In a spoofing environment, the aircraft's automation may believe it is on the correct trajectory while silently steering the aircraft into danger.

This report analyzes the shift from traditional system failures to these contemporary "un-alerted" anomalies. The primary risk has evolved from "clean" navigation downgrades—where the system identifies a lack of signal and reverts to backup sensors—to "un-alerted" map shifts that can induce uncommanded turns and spurious terrain warnings. Understanding these distinctions is critical to maintaining flight safety, particularly when operating in volatile geographical regions where these threats are increasingly prevalent.

2. Operational Context

GNSS interference is no longer a theoretical risk but a daily operational reality in contemporary conflict zones and high-traffic corridors. According to current data, these disruptions are most frequent in areas such as the Eastern Mediterranean and the Black Sea Flight Information Regions (FIRs).

The most disruptive interference typically occurs during the Terminal Arrival and Intermediate Approach phases. During these high-workload periods, the impact of a "Signal Loss" (jamming) is relatively manageable, as the aircraft identifies the loss of GPS PRIMARY and transitions to radio-based navigation. Conversely, a "Signal Corruption" (spoofing) state can lead to a total mission profile degradation, as the Flight Management System (FMS) may adopt false coordinates as valid, misleading both the crew and downstream surveillance systems like ADS-B Out.

3. Technical Foundation & Causal Mechanisms

To effectively manage interference, pilots must understand the Flight Management Guidance Computer (FMGC) sensor hierarchy. The FMS computes position by prioritizing sensors in a strict order to ensure the most accurate data is utilized.

The A320 Sensor Hierarchy

1. GPIRS (Primary Reference): A blend of pure inertial data from ADIRUs and satellite data from Multi-Mode Receivers (MMRs).
2. DME/DME/Inertial (First Fallback): Automatic tuning of ground-based DME stations to compute a radio position bias.
3. VOR/DME/Inertial (Second Fallback): Utilized when insufficient DME pairs are available, using a single VOR bearing and DME distance.
4. Pure IRS (Final Automatic Fallback): Reliance solely on internal gyroscopic and accelerometer integration, subject to progressive inertial drift.

Jamming vs. Spoofing: Physical Mechanisms

Feature	GNSS Jamming	GNSS Spoofing
Mechanism	High-power RF noise overpowers L1 band signals.	Counterfeit RF signals mimic valid satellite structures.
FMS State	Signal Loss / Denial ("Unavailable").	Signal Corruption ("Contaminated").
MMR Response	MMR identifies loss of signal integrity.	MMR locks onto fake signals; integrity checks may fail.
System Logic	System steps down cleanly to backup sensors.	FMS adopts false coordinates as its baseline.

FMS Map Shift Risk

Jamming typically carries no map shift risk because the FMGC detects the absence of a signal rather than receiving erroneous data. It simply moves down the hierarchy to radio updating. Spoofing, however, carries a high risk of map shifts. Because the false signal appears valid, the FMS may induce uncommanded lateral turns in managed NAV mode and generate abnormal drift entries, effectively "moving" the map away from the aircraft's physical location.

4. Cockpit Recognition: Alerts and Indications

Rapid pattern recognition is the only defense against spoofing. If the automation behaves unexpectedly, the crew must immediately verify the aircraft's position against raw data.

GNSS Interference Alert Matrix

Alert / Indication	Location	System Trigger Logic	Operational Consequence
NAV FMS/GPS POS DISAGREE	Lower ECAM	FM1/2 and GPS 1/2 diverge by > 0.5'	Master Caution; mandates immediate cross-check.
CHECK A/C POSITION	MCDU / ND	Mismatch between FMS and raw sensors.	Amber scratchpad; invalidates managed guidance.
GPS PRIMARY LOST	ND / MCDU	Integrity threshold exceeded (> 0.28 NM).	Transition to radio/IRS updating.
ATC FAIL / UNABLE RNP	ECAM / Status	Datalink/PBN capability degradation.	Termination of CPDLC/ADS-C and PBN eligibility.

Visual Recognition Cues

Crew members should monitor for the following visual cues of a map shift:

• Displacement of the aircraft’s triangular ship symbol relative to the flight plan line or airport symbols.
• Illogical wind vectors or erratic groundspeed jumps on the Navigation Display (ND).
• The appearance of the "CHECK A/C POSITION" scratchpad message.
• Uncommanded banking: The aircraft begins a lateral turn while the Flight Mode Annunciator (FMA) remains in managed "NAV" mode.

5. Normal Operation & Integrity Monitoring

During routine operations, the pilot acts as a systems monitor to ensure the FMS position remains valid. This is achieved through a "Navigation Accuracy Check," which should be performed whenever an un-alerted map shift is suspected or before starting non-precision approaches without GPS PRIMARY.

Navigation Accuracy Check Procedure

Crews must compare the computed BRG/DIST on the MCDU PROG page against raw data needles on the ND using a nearby VOR/DME station tuned on the RAD NAV page.

• POSITIVE CHECK: Error is \le 3.0 NM (Enroute) or \le 1.0 NM (Terminal). FMS position is reliable.
• NEGATIVE CHECK: Error exceeds 3.0 NM (Enroute) or 1.0 NM (Terminal). FMS position is unreliable, and managed lateral modes must be disengaged.

The "Green Needles" philosophy remains the ultimate source of truth. When map integrity is in doubt, crews must revert to raw radio navaids to confirm their physical location.

6. Abnormal & Degraded Operation: Downstream Impacts

GNSS corruption does not remain isolated to the navigation system; it cascades into surveillance, terrain, and weather systems, creating a high-workload environment.

• EGPWS/TAWS: In jamming scenarios, predictive look-ahead functions fail (TERR FAIL), but basic GPWS remains. In spoofing, corrupted horizontal position and geometric altitude trigger spurious "PULL UP" or "TERRAIN AHEAD" alerts in clear air.
• Clock/CPDLC: Spoofing causes UTC time/date jumps of hours or years. This results in ATC COMM TERMINATED messages as datalink ground systems reject the erroneous timestamps.
• ADS-B Out: The transponder may transmit false coordinates, misleading ATC radar and nearby aircraft.
• Weather Radar: Ground de-cluttering algorithms, which rely on GPS-based terrain databases, misinterpret weather returns as ground clutter or vice versa.
• Synthetic Vision System (SVS): SVS becomes unavailable during jamming; during spoofing, it displays shifted terrain or reverts to blue-over-brown.

The Lingering Hazard: Ephemeris Contamination

A critical distinction is the "Satellite Ephemeris Contamination" associated with spoofing. Unlike jamming, where recovery is immediate upon exiting the area, spoofing transmitters broadcast fake orbital tables (ephemeris) with future timestamps. The MMR stores these in non-volatile memory. This can cause insidious position jumps hours after leaving the interference zone. Consequently, a maintenance "hard reset" (power cycle) is mandatory to purge the corrupted memory.

7. Crew Priorities and Actions (The Recovery Script)

When interference is suspected, crews must apply Airbus Golden Rule #1: Fly, Navigate, Communicate.

Step-by-Step Recovery SOP

1. Lateral Reversion: Pull the HDG knob immediately to disengage managed NAV mode and stop uncommanded turns.
2. MCDU Isolation: Navigate to the DATA > NAV/SENSORS page.
   • Deselect GPS 1 and 2.
   • Deselect IRS HYBRID mode to force the FMS to pure radio/IRS updating.
3. Clock Stabilization: Switch the Master Clock switch to INT (Internal) to protect datalink timestamps.
4. EGPWS Management: If spurious alerts occur while confirmed above MSA, evaluate and select TERR OVRD to ON.

Decision Making

Crews must reject RNP/RNAV approach clearances if GPS integrity is in doubt. The only safe course of action is to request Radar Vectors for a conventional ILS or VOR approach using raw data (green needles).

8. Threat and Error Management (TEM)

The psychological challenge of "automation bias" often leads crews to trust the ND map even when visual cues suggest otherwise.

Primary Simulator Traps

• Automation Tunneling: Pilots may focus on MCDU troubleshooting while the aircraft banks off-track, allowing deviations to exceed safe limits before selecting HDG.
• Knee-Jerk EGPWS Escape: Executing a high-energy pull-up maneuver in response to a false alert in a crowded terminal area despite being well above MSA.
• False Recovery Trap: Re-engaging GPS because the display "looks normal," ignoring the lingering risk of ephemeris contamination.

Crews must also avoid Confirmation Bias, such as attempting manual MCDU position updates. These updates introduce a 4–5 NM error penalty due to pilot estimation and system latency and should never be used as a primary recovery method.

9. Scenario Analysis: Terminal Arrival Map Shift

Situation: An A320 is descending into IMC near a conflict zone, passing FL130. The aircraft is in managed NAV mode.

Cues: The crew suddenly notices an uncommanded 30-degree bank to the right. Simultaneously, the Master Caution sounds with "NAV FMS/GPS POS DISAGREE," and the clock jumps forward by 45 minutes. A Navigation Accuracy Check reveals a 3.5 NM easterly shift.

Crew Interpretation: The PF recognizes the path divergence and immediately pulls HDG to neutralize the turn. The PM identifies the "system lie"—the FMS thinks the aircraft is off-track because of the spoofed signal.

Operational Considerations: As the aircraft levels at 5,000 ft, a spurious "TERRAIN AHEAD" alert sounds. The crew performs a 5-second sanity check, confirms they are 1,500 ft above MSA via barometric altimetry, and selects TERR OVRD to ON. They inform ATC they are "Unable RNP" and request vectors for the ILS.

10. TRI/TRE Instructor Notes & Competency Assessment

Effective training requires identifying the exact moment a crew loses situational awareness. Instructors must evaluate performance against objective timing standards.

Acceptable Performance Standards

• Lateral Mode Reversion (NAV to HDG): Executed within 5 seconds of uncommanded track deviation.
• GPS Deselection: Correctly isolated on the MCDU within 2 minutes.

Instructor Freeze Points

• Onset Assessment: Freeze the sim 15 seconds after the shift. Did the PF pull HDG within 5 seconds?
• EGPWS Logic: Freeze during the spurious alert. Did the crew verify Baro Altitude vs. MSA before acting?
• Approach Strategy: Did the crew decline an RNP clearance in favor of an ILS?

Knowledge Check

1. Q: Why does spoofing cause a turn while jamming does not? A: Jamming is a signal loss that triggers a clean step-down to radio/IRS; spoofing is signal corruption that the FMS accepts as valid, following the false coordinates.
2. Q: What specific parameter divergence triggers the ECAM NAV FMS/GPS POS DISAGREE? A: A divergence of > 0.5' latitude or longitude between the FM position and the GPS position.
3. Q: Under what criteria is selecting TERR OVRD appropriate? A: When false terrain alerts occur due to GNSS corruption while the crew confirms via barometric altimetry and MSA charts that the flight path is clear.
4. Q: Why can a GPS receiver output false data hours after exiting a spoofing zone? A: Due to ephemeris contamination; the MMR stores corrupted orbital tables in non-volatile memory which must be cleared via a hard reset.
5. Q: What is the mandatory post-flight requirement following a spoofing event? A: A Tech Log entry for a maintenance hard reset/power cycle per TSM TASK 34-36-00-810-956-A.

11. Key Takeaways: Operational Memory Anchors

1. Jamming = Signal Loss: A clean system failure; step down to radio.
2. Spoofing = Signal Lie: An un-alerted hazard; pull HDG immediately.
3. Deselect GPS & IRS Hybrid: Isolate the FMS from the "lie" and force radio updating.
4. Clock to INT: Protect your datalink and ATC communications from UTC jumps.
5. Hard Reset Required: Recovery is not complete until maintenance clears the MMR memory.

As instructors, our responsibility is to ensure that crews possess the discipline to reject automated "lies." In an era of GNSS interference, the ultimate safety redundancy is a pilot who maintains constant positional vigilance and knows when to revert to raw data navigation.