US aviation regulator warns of mid-air collision risk if Garmin TCAS boxes are not updated

Software fixes available, says FAA

Updated American aviation regulators have ordered private jet operators to install software updates for Garmin collision avoidance units after multiple reports of false alarms – raising the risk of a mid-air crash.

The affected Garmin products, its GTS 8000 series, generated seven false Traffic Collision Avoidance System (TCAS) warnings, said the US Federal Aviation Administration (FAA) in a formal Airworthiness Directive (AD) published [PDF] earlier this month.

GTS 8000 processing units, said the FAA, are known to be installed in a range of posh private jets including Cessna Citations, Learjet 45s and Embraer Phenoms – as well as the decidedly unsexy Shorts 360 passenger/cargo hauler.

TCAS Resolution Advisory (RA) systems work by detecting nearby TCAS-fitted aeroplanes. Alex Lomas, aviation security lead at British infosec consultancy Pen Test Partners (PTP) told The Register: "TCAS works with dedicated transponders that interrogate both the 'ownship' and 'intruder' to calculate a closing rate and generate alerts accordingly. In this case it seems that this calculation has failed safe in one regard, which is that alerts are generated when an intruder is too far away, but the knock on effect is that instructions to the pilot could then increase the risk of collision with a third aircraft."

The FAA said the GTS 8000s were calculating "incorrect range rates" and triggering resolution advisories (RAs, instructions to climb or dive) for intruder aircraft which were "greater than 10 nautical miles (NM) away." The technology is only supposed to do that when an intruder is 40 seconds away from a collision, as explained on the Skybrary website. Typically TCAS is fitted to jet airliners and commercial aircraft.

The agency explained that with unmodified Garmin GTS 8000s, a TCAS event "involving three or more airplanes can result in mid-air collision," saying that a three-way collision warning raised the risk "that the TCAS, in resolving the false RA with the initial airplane, will create an actual loss of separation with a third airplane."

"This condition, if not addressed, could result in an RA being generated when no risk of loss of separation or risk of collision exists between the airplanes involved, which can lead to a mid-air collision with a third airplane," it concluded.

This warning echoes earlier research from PTP, which found that three fake warnings could be precisely manipulated to cause an airliner to climb or descend on a predictable trajectory. It also has echoes of spoofing ACAS X, the next generation of TCAS technology.

Lomas said: "As with any software implementation of a complex algorithm there are occasionally mistakes made, which seems to be the case here. Current implementations of TCAS do not always handle multiple aircraft encounters particularly well and are limited to RAs to vertical changes in altitude only."

We have asked Garmin for comment and will update this article if the manufacturer responds. ®

Updated to add

Conor McDougall, Garmin's media relations specialist, got in touch to tell The Register: "Garmin is aware of this potential issue and has developed a software update to address it. We are working swiftly with our partners to ensure fielded aircraft are provided with this solution."

Similar topics

Broader topics

Other stories you might like

  • Experts: AI should be recognized as inventors in patent law
    Plus: Police release deepfake of murdered teen in cold case, and more

    In-brief Governments around the world should pass intellectual property laws that grant rights to AI systems, two academics at the University of New South Wales in Australia argued.

    Alexandra George, and Toby Walsh, professors of law and AI, respectively, believe failing to recognize machines as inventors could have long-lasting impacts on economies and societies. 

    "If courts and governments decide that AI-made inventions cannot be patented, the implications could be huge," they wrote in a comment article published in Nature. "Funders and businesses would be less incentivized to pursue useful research using AI inventors when a return on their investment could be limited. Society could miss out on the development of worthwhile and life-saving inventions."

    Continue reading
  • Declassified and released: More secret files on US govt's emergency doomsday powers
    Nuke incoming? Quick break out the plans for rationing, censorship, property seizures, and more

    More papers describing the orders and messages the US President can issue in the event of apocalyptic crises, such as a devastating nuclear attack, have been declassified and released for all to see.

    These government files are part of a larger collection of records that discuss the nature, reach, and use of secret Presidential Emergency Action Documents: these are executive orders, announcements, and statements to Congress that are all ready to sign and send out as soon as a doomsday scenario occurs. PEADs are supposed to give America's commander-in-chief immediate extraordinary powers to overcome extraordinary events.

    PEADs have never been declassified or revealed before. They remain hush-hush, and their exact details are not publicly known.

    Continue reading
  • Stolen university credentials up for sale by Russian crooks, FBI warns
    Forget dark-web souks, thousands of these are already being traded on public bazaars

    Russian crooks are selling network credentials and virtual private network access for a "multitude" of US universities and colleges on criminal marketplaces, according to the FBI.

    According to a warning issued on Thursday, these stolen credentials sell for thousands of dollars on both dark web and public internet forums, and could lead to subsequent cyberattacks against individual employees or the schools themselves.

    "The exposure of usernames and passwords can lead to brute force credential stuffing computer network attacks, whereby attackers attempt logins across various internet sites or exploit them for subsequent cyber attacks as criminal actors take advantage of users recycling the same credentials across multiple accounts, internet sites, and services," the Feds' alert [PDF] said.

    Continue reading

Biting the hand that feeds IT © 1998–2022