Aviation data networks: security issues and network architecture

The information technology (IT) revolution, combined with people's need to access information quickly, has resulted in the explosive growth of the Internet in the past decade. Ubiquitous access to the Internet has become an essential component of a mobile workforce, and multiple mechanisms are being devised to ensure seamless connectivity to corporate resources. An integrated security framework requires careful consideration of the security features of the network within an airplane. Potentially, the aircraft could consist of three kinds of networks, namely: passenger network, crew network, and control network. The security protocol implemented must ensure a proper separation of these networks and also watch for any security protocol violations. In this paper, the authors review existing aircraft data network standards, security provisioning, and security threats associated with the aircraft data networks. In addition, the authors also analyze the security threats associated with different network architectures.     

面向互联飞机的空天地网络一体化融合研

随着数字化技术的发展，民用飞机会在飞行各阶段产生大量数据，这些数据的利用及处理将提升飞机运营的经济性、安全性与舒适性。为了适应未来互联飞机对海量数据交换与传输的迫切需求，满足民用飞机对无线通信服务质量(QoS)的要求，有必要充分利用并合理分配多种现有和未来的空天地无线通信链路资源。分析了互联飞机的概念、生态系统及其对空天地网络的网络需求，研究了地面异构移动互联网采用的紧耦合和松耦合两种融合方法，采用了网络体系融合、IP网络和非IP网络融合及终端融合等多种融合手段，提出了适应于多种通信链路与网络体系特点的一体化空天地无线通信链路的融合架构，并对网络协议栈、网络安全以及集成验证提出了初步考虑。     

民机驾驶舱扬声器啸叫成因研究与抑制方法

民用飞机驾驶舱扬声器是一个电声换能器件,安装在飞机驾驶舱中,可将电信号转为声信号输出,并将声学功率辐射到驾驶舱。驾驶舱扬声器不仅能够为驾驶舱内的机组人员提供与客舱乘务人员以及塔台管制人员的通话语音,还能够提供飞行导航音、选呼音和告警音的发声。因此,驾驶舱扬声器是飞机上不可或缺的机载设备,为飞机的飞行安全提供了保障。驾驶舱扬声器产生的尖锐刺耳啸叫让人难以忍受,导致飞行机组无法听到其他声音,甚至无法使用语音通信系统,严重时会影响到飞行安全。指出驾驶舱扬声器"啸叫"的危害,分析啸叫的成因,并在此基础上探讨驾驶舱扬声器"啸叫"的抑制方法,为民机驾驶舱音频系统的防啸叫设计提供一定的参考依据。     

Data communications concept for a SATS scenario

The small aircraft transportation system (SATS) concept envisions doorstop to destination transportation in a safe and timely manner. Data communications are a key component in achieving the aviation-related operational performance improvements that are sought. However, data communication doesn't start when you get into the aircraft; it starts back at the location where the flight is planned. In fact, data communications support the pilot in all phases of the flight: flight planning, pre-flight, departure, en route, transition, approach, landing, and rollout as well as for a missed approach. The Internet is being used to perform flight planning activities, and the mobile communications available today support Internet access en route to the departure airfield. On-board the aircraft, data communications provide surveillance and air traffic control (ATC) support to the pilot. The location of other aircraft is available to the pilot and ATC system through automatic dependent surveillance-broadcast (ADS-B) and traffic information service-broadcast (TIS-B) applications that transmit the location of other aircraft in the vicinity. Other aircraft locations are used to forecast potential conflicts and, thus, enhance flight safety. As the aircraft nears a SATS-equipped airfield, the pilot uses data link messages to request a landing sequence. The airport management module (AMM) provides a landing sequence assignment to the aircraft. As the pilot maneuvers the aircraft for a landing, he/she is using data-linked surveillance data to determine the location of other aircraft and maintain a safe separation distance between aircraft even in a low visibility environment.     

民用飞机驾驶舱门监视系统设计

作为民用飞机安防系统的重要组成部分,驾驶舱门监视系统可以为飞行机组提供驾驶舱门附近清晰、实时的监视画面,提高安全防范和应急处理能力,保障飞行运输安全。在分析驾驶舱门监视系统组成、架构的基础上,给出了系统监视区域的安装布置要求,环境条件,适航性等其它设计要求。     

大型飞机舱音记录器设计

大型飞机和其他多成员飞机需加装舱音记录器,所记录的各种语音信息可以和飞行数据记录器记录的数据信息一起为飞行事故调查提供全面科学的依据。针对中国目前舱音记录器技术落后的现状。设计研制了一套新型基于ARM9平台,采用嵌入式Linux操作系统的舱音记录器,可以装备大型飞机和其他多成员飞机使用,该记录器采用目前最为先进的主流开发平台,系统运行稳定、高效,选用性能优良的AMBE-1000声码芯片实现了语音信号高品质采集和回放。通过音频频谱分析显示,记录器的频率响应、失真度等指标优于国内外同类产品的技术指标,具有良好的实用性和推广应用价值。     

A320驾驶舱人为错误的管理

防止驾驶舱人为错误是保障飞行安全的有效措施。根据Helmreich操作类型分类法,统计分析了国航浙江公司A320飞机QAR三级超限事件连续三年的数据,并结合问题调查等数据,对该公司的人为错误进行研究,并给出了可操作性的人为错误管理策略,探索了利用QAR数据开展航空公司人为错误研究的方法,为国航浙江公司A320飞机的人为错误管理提出了建议。对提高飞行安全减小人为错误具有积极意义。     

民用飞机驾驶舱门抵御穿透要求适航符合性评估方法

民用飞机驾驶舱门系统安装在飞机舱内,用于阻隔驾驶舱和客舱,除供机组人员正常进出驾驶舱外,必须具备防弹及防侵入功能,防止非机组人员抢夺飞机控制权,为机组成员提供安全保护。从驾驶舱门系统抵御穿透适航条款解读入手,对适航审定要求进行研究解读,提出一种民用飞机驾驶舱门抵御穿透试验方法,给出子弹选择、危险弹道确认、枪击点筛选、试验件构型准备等试验实施细节和要求,并以某型民用飞机驾驶舱门系统研发以及抵御穿透适航审定为基础对其进行验证。结果表明：本文提出的驾驶舱门抵御穿透试验方法有效,满足条款符合性,能够为飞机驾驶舱门设计研发以及适航符合性分析验证和相关条款的适航审定工作提供参考。     

基于功能危险性评估的民用飞机驾驶舱门设计探讨

FAA分别于2002年和2008年颁布25-106及25-127修正案,增加驾驶舱门安保事项以提高驾驶舱的安全水平。修正案要求加固驾驶舱门,驾驶舱门必须设计成可以阻止未被授权人员进入驾驶舱并且阻碍危险物体射入以保证机组人员的安全。驾驶舱门必须能检测驾驶舱失压并可以释放门或者卸压板平衡压力差,还应有措施使飞机机组成员在该舱门卡住的情况下能直接从驾驶舱进入客舱。因此,在驾驶舱门上设有一个可以快速释放的紧急出口。根据飞机驾驶舱门结构及功能的主要特点,对驾驶舱门功能故障进行探讨,同时对功能故障引发的危险性等级进行划分,以确定安全指标,进而辅助驾驶舱门设计工作。     

基于深度学习的航空器异常飞行状态识别

飞行设备快速存取记录仪(Quick Access Recorder,以下简称QAR)保留了原始航班各类重要飞行参数在内的航行信息,使研究分析航空器实时状况和保障飞行质量成为可能。针对QAR数据高维大样本的特点,在如今大数据背景下,除了传统机理建模分析航空器飞行状态外,采用深度学习的方式建立基于数据驱动的航空器飞行状态识别模型,理论与实用意义兼具。通过对真实QAR飞行数据的研究,开发了基于深度稀疏受限玻尔兹曼机的异常飞行状态识别程序。首先利用小波降噪技术对原始飞行数据进行预处理清洗,在一系列典型飞行参数上提取经典时域特征以及小波奇异熵等信息熵特征构成特征集。在此基础上,分别利用经典的线性主元分析技术和深度稀疏玻尔兹曼机对特征集进行有效降维,最后采用四折交叉验证方式,通过高斯过程分类器实现对飞行状态的辨识。实验结果显示,基于深度受限玻尔兹曼机-高斯过程分类的飞行状态识别具有较高分类准确性。     

针对TCP/IP漏洞的航天测控通信网安全防护

航天测控通信网自建成以来,整体运行较为稳定,但在网络安全方面也暴露出了一些问题,为研究和解决目前航天测控通信网中存在的网络安全问题, 在分析TCP/IP (Transmission ControlProtocol/Internet Protocol,传输控制协议/互联网协议)分层协议基本原理的基础上,研究了IP网数据链路层、网络层和传输层的协议漏洞及常见攻击方法,详细介绍了当前航天测控通信网的网络安全部署情况,根据网络现状分别对航天测控通信网上数据链路层、网络层和传输层存在的安全问题进行了纵向分析,针对分析出的各类安全问题,进一步给出了有效的防御措施和防护方法。最后,探讨提出了一套航天测控通信网配置维护管理系统的设计方案,通过建立设备配置信息库、检查信息记录库及网络故障库等,实现了对航天测控通信网安全稳定运行的有效管理。     

基于CPN的飞机驾驶操纵过程建模及工效分析

驾驶舱人机界面的设计直接关系到飞行员在飞行任务中的操纵表现和飞行安全.分析了飞机驾驶操纵过程中的人机交互特性,基于着色Petri网构建了飞机操纵过程模型并给出了模型的公理化定义.提出了任务可达性,飞行员认知负荷和基于熵值的操纵程序复杂性评估方法,能够实现在驾驶舱设计初期对飞行员认知负荷与操纵过程的分析.结合某型飞机的起飞中断过程给出了操纵过程建模与工效分析实例,表明模型与方法的有效性.     

An attack-immune trusted architecture for supervisory aircraft hardware

With the wide application of electronic hardware in aircraft such as air-to-ground communication, satellite communication, positioning system and so on, aircraft hardware is facing great secure pressure. Focusing on the secure problem of aircraft hardware, this paper proposes a supervisory control architecture based on secure System-on-a-Chip (SoC) system. The proposed architecture is attack-immune and trustworthy, which can support trusted escrow application and Dynamic Integrity Measurement (DIM) without interference. This architecture is characterized by a Trusted Monitoring System (TMS) hardware isolated from the Main Processor System (MPS), a secure access channel from TMS to the running memory of the MPS, and the channel is unidirectional. Based on this architecture, the DIM program running on TMS is used to measure and call the Lightweight Measurement Agent (LMA) program running on MPS. By this method, the Operating System (OS) kernel, key software and data of the MPS can be dynamically measured without disturbance, which makes it difficult for adversaries to attack through software. Besides, this architecture has been fully verified on FPGA prototype system. Compared with the existing systems, our architecture achieves higher security and is more efficient on DIM, which can fully supervise the running of application and aircraft hardware OS.     

Software intensive systems safety analysis

Two important elements in the avionics suite of modern aircraft are: the flight control system (FCS) and the flight management system (FMS). The FCS provides the capability to stabilize and control the aircraft, while the FMS is responsible for flight planning and navigation. A clear trend in the aerospace industry is to place greater reliance on software systems, and many FCS and FMS subsystems are implemented primarily in software. For example, within the FCS is the flight guidance system (FGS) that generates roll and pitch guidance commands. Similarly, within the FMS is the vertical navigation (VNAV) function that acts like a third crew member in the cockpit, ordering mode change requests and resetting target altitude values to enable the aircraft to track the vertical flight plan. We have developed formal, executable models of the requirements for the mode logic of a FGS and for portions of the VNAV functionality. We have also conducted a comprehensive software safety analysis on the FGS mode logic model, and are completing the analysis of the VNAV model. This analysis uses as its starting point several "traditional" safety analysis techniques such as a functional hazard assessment (FHA), a fault tree analysis (FTA), and a failure mode effects analysis (FMEA). However, we are also using formal methods techniques known as model checking and theorem proving to verify the presence of safety properties in the model. This paper summarizes the (now completed) safety analysis that was performed on the FGS model, and highlights the similarities and differences with the (still on-going) safety analysis of the FMS model. In particular, we summarize progress made to date in the use of formal methods to verify the presence of the required safety properties in the models themselves.     

An experimental analysis of situation awareness for cockpit display interface evaluation based on flight simulation

Aircraft cockpit display interface (CDI) is one of the most important human-machine interfaces for information perceiving. During the process of aircraft design, situation awareness (SA) is frequently considered to improve the design, as the CDI must provide enough SA for the pilot to maintain the flight safety. In order to study the SA in the pilot-aircraft system, a cockpit flight simulation environment is built up, which includes a virtual instrument panel, a flight visual display and the corresponding control system. Based on the simulation environment, a human-in-the-loop experiment is designed to measure the SA by the situation awareness global assessment technique (SAGAT). Through the experiment, the SA degrees and heart rate (HR) data of the subjects are obtained, and the SA levels under different CDI designs are analyzed. The results show that analyzing the SA can serve as an objective way to evaluate the design of CDI, which could be proved from the consistent HR data. With this method, evaluations of the CDI design are performed in the experimental flight simulation environment, and optimizations could be guided through the analysis.     

民用飞机照明系统安全性分析

民用飞机照明系统是飞机系统中一个重要的分支系统,不仅对飞机的安全、飞机性能的充分发挥、机组人员的工作效能起着重要的作用,而且对于旅客来说是评价飞机先进性和舒适性的一个不容忽视的重要组成部分。 民用飞机照明系统通常由驾驶舱照明、客舱照明、货舱与服务区照明、外部照明及应急照明五个功能独立的部分组成。 在照明系统研制过程中,为验证系统对 CCAR25. 1309 条款的符合性,通常遵循 SAE ARP 4761 提出的安全性评估工作方法。 基于安全性评估工作方法, 以照明系统为对象,在设计阶段,通过初步安全性分析确定了系统安全性设计目标、提出了系统架构,在验证阶段,通过运用多种工具对提出的安全性目标进行验证。 此外,探讨了整个系统研制过程中的安全性分析工作的具体方法,为民用飞机安全性分析提供借鉴。     

General aviation aircraft avionics: integration & system tests

The avionics of current-day aircraft is termed as modular integrated full glass cockpit. Unlike lots of dials and gauges, the pilot will interact with Multi-Function Displays (MYD). This means that the systems are coupled with multi-function displays, communication and navigation radios with control units, multi-mode interactive instruments for control and navigation, recording and fault management systems, airframes and health monitoring diagnostic capabilities. Pilot Vehicle Interface (PVI) is an important measure of good avionics and cockpit layout, which implies the optimization of man-machine interface, enhancement of the economy, and safety of flight operations. This presents the avionics architecture of a 14-seat Light Transport Aircraft (LTA) for general aviation, which has multi-role commuter capabilities. LTA is a twin turbo-prop, multi-role aircraft, with air taxi and commuter services as its primary roles. The avionics is built on the digital communication mode for both command and control with current requirements of TCAS, digital Autopilot, and AMLCD multi-purpose glass displays. The LTA Avionics suite is grouped into six major groups based on functionality: Display System, Communication System, Navigation System, Recording System, Radar System, and Engine instruments and other cockpit displays. This paper also covers details about the extensive tests carried out to prove the avionics design in terms of functionality, inter-operability, interference, and compatibility. Various practical integration and flight-test issues, methodologies, and details of the scenarios is presented herein.     

民用飞机甚高频通信系统适航审定技术分析

民用飞机进行可靠的空地、空空通信,对飞行安全尤为重要。甚高频(very high frequency,简称VHF)通信系统是目前应用最为广泛的航空通信方式,VHF通信系统通过与机上音频系统交联实现飞机与外部的语音通信,通过与机上数据链系统交联实现飞机与地面的数据链通信。甚高频通信系统与民用飞机的安全运行密切相关,也是适航规章和运行规章要求的内容。结合甚高频通信系统功能要求和设计架构,针对适用于甚高频通信系统的中国民用航空规章第25部：运输类飞机适航标准(CCAR-25-R4-2011)条款,分析并给出甚高频通信系统可接受的符合性方法,同时根据型号工作经验给出甚高频通信系统在适航审查中的审定要素。针对甚高频通信系统所涉及的各项条款,为局方提供了适航审查工作需要关注的审定要素和评审要求。研究有助于民机甚高频通信系统的安全设计与适航验证。     

QAR数据处理在气动力矩参数辨识中的应用

长期飞行引起的结构疲劳损伤和复杂环境下的腐蚀损伤等因素导致飞机的气动模型会随时间略有变动,而飞机气动模型的辨识对于分析飞机当前的运行状况具有重要意义.为了完成飞机气动模型的再次辨识,通过分析、处理飞机自带的快速存取记录器(QAR)数据,根据动力学原理建立气动力矩数学模型,最后运用极大似然法辨识出各气动导数.经验证,辨识结果满足仿真要求,可应用于模拟飞行、机务维修信息指导和事故预警与重现等.     

基于滑窗检测的机载设备故障诊断仿真系统

根据机载设备故障诊断的需求,结合飞机性能监控系统的结构框架和机载设备的特点,提出基于快速存取记录器（QAR）记录的飞行数据和滑窗检测原理的机载设备故障诊断算法,并实现相应的机栽设备故障诊断仿真系统。在简述QAR数据译码与数据选择方法的基础上,论述了滑窗检测的原理并对其性能进行分析：设计实现了基于QAR的机载设备故障诊断仿真系统并给出仿真结果。结果表明,该系统可以有效诊断存在的故障,并能大大降低虚警概率,对保障飞行安全具有重要意义。