GB2381879A

GB2381879A - Security system for piloted aircraft

Info

Publication number: GB2381879A
Application number: GB0126928A
Authority: GB
Inventors: Alan Williams-Key
Original assignee: Individual
Current assignee: Individual
Priority date: 2001-11-09
Filing date: 2001-11-09
Publication date: 2003-05-14
Also published as: GB0126928D0

Abstract

An aircraft security system for a piloted aircraft includes a computer which can control and manage the flight of the aircraft, and which embodies an authentication protocol imposing regular or intermittent interrogation on the pilot. Unsuccessful recognition triggers complete computer control of the aircraft until successful interrogation is established or reestablished. Under computer control all manual overrides are disabled, and a transponder may notify air traffic control of unsuccessful interrogations. The interrogation may be a PIN number, voice recognition, stress level detection, or a combination of the latter two techniques.

Description

AIRCRAFT SECURITY SYSTEM This invention concerns an aircraft security system.

In the wake of the horrific events of 1 ph September 2001 fresh attention is being given to the security of aircraft when in flight with a view to preventing hijacking of the kind witnessed on that occasion.

Whilst it may never be known precisely the chain of events which gave rise to such devastating results, it is possible to suggest certain scenarios, for example the flight crew might have been either killed or ejected from the cockpit. However, the undeniable reality was that control of the aircraft was torn from those on the flight deck charged with the responsibility for the conduct of the flight.

Modem airliners are provided with a number of computers the two principal areas of computer control being associated with flight control systems and flight management systems.

The flight control system is mainly concerned with the provision of autopilot and autothrottle functions and is generally used as a platform for the flight management system. The former provides basic stabilisation and control that will, for example, hold the airliner at a constant altitude and heading or a constant rate of descent to a new selected altitude or turn onto a new selected heading. The latter builds on this capability in order to execute a flight plan and the flight management computers are able to issue new headings, altitudes, and speeds to the flight control system to execute the plan. Some flight computers are capable of flying an aircraft from shortly after take-off to the end of the landing run on the destination runway without any pilot involvement. Indeed, some airlines routinely choose to have their aircraft flown in this way, while others

prefer to leave with the flight deck crew discretion in the operation of the control regimes whereby the computers can be overridden and manual control imposed. Even those aircraft that an airline intends to be flown essentially by computer for substantially the whole of the journey have the facility for pilot intervention should the need arise. Indeed on-board computer systems are designed to be re-programmed or adjusted on an ad hoc basis to meet the prevailing circumstances, for example to comply with air traffic control requirements.

In contrast to commercial and other aircraft designed to be flown by people, some military reconnaissance aircraft are capable of completely pilotless flight, the aircraft being directly controlled from a ground-based or from an airborne control facility, or pre-programmed to take and complete a specific journey.

One object of the present invention is to provide an aircraft security system so adapted as to prevent unauthorised intervention in the control of the aircraft.

A further object of the invention is to provide a means of conveying to a control centre any change in the security status of the aircraft.

According to a first aspect of the invention there is provided a piloted aircraft security system including at least one computer adapted to control and manage the flight of the aircraft, and an authentication protocol controlled by said at least one computer and adapted to interrogate the pilot on a regular or intermittent basis whereby access to the computer is denied upon unsuccessful interrogation of the pilot as to identity, and the said at least one computer being adapted upon such unsuccessful interrogation of the pilot to enable the computer to assume complete

control and management of the flight until successful interrogation is established or re-established.

According to a second aspect of the present invention there is provided a method of operating an aircraft security system according to the first aspect including the steps of establishing an authentication protocol, the said at least one computer being adapted to initiate the protocol for continuous operation during the flight of the aircraft and to instruct the protocol to interrogate the pilot at regular or intermittent intervals, unsuccessful interrogation causing access by the pilot to the aircraft manual controls to be denied until successful interrogation is established or re-established.

Advantageously upon the unsuccessful interrogation of the pilot all functions that would enable the pilot to reassume manual control are disabled. In particular, the unsuccessful interrogation of the pilot ensures continued power to the control circuitry of the aircraft including the or each computer, and ensures continued fuel supply and cabin pressurisation, indeed all the essential functions. All manual overrides would be instantaneously disabled upon such unsuccessful interrogation.

Further, in the circumstances of the unsuccessful interrogation of the pilot, the transponder code which notifies air traffic control as to the status of the aircraft, viz. hijack or mayday conditions is automatically changed, thereby to provide an automatic alert as to the prevailing status of the aircraft.

The pilot authentication protocol may be achieved in a number of ways and the present invention is not limited to any particular mode. For example, a simple authentication would be the use of PIN or a password entered onto the flight management computer keypad. In the alternative

a voice recognition system could be adopted that would have to rely on the continuing presence of the pilot and his coercion to satisfy the authentication interrogation.

A further possibility for an authentication protocol would be the use of voice recognition in conjunction with stress level detection, the voice being analysed for signs of stress. In this way a state of duress of the pilot could be detected and the authentication protocol would respond accordingly with a built-in fail-to-safety command, i. e. the computer would assume the worst if the voice recognition were not 100%. Stress level detection may be effected in ways other than analysis of the voice.

There are circumstances when a pilot may legitimately experience high stress levels which would not indicate duress, for example during serious malfunctions of the aircraft. Although such circumstances are rare, they do occur and the pilot is made aware of any danger conditions by virtue of the illumination of orange and red warning lights. Such conditions should be known to the computers and a feature of the authentication protocol as described above could accommodate recognition thereof and any enhanced stress levels resulting therefrom would be ignored. Accordingly, a pilot encountering an in-flight emergency would not be prevented from dealing with that emergency.

The authentication protocol and its controlling computer may be adapted to allow interrogation on a limited number of occasions following one unsuccessful interrogation.

The frequency of the authentication protocol interrogation would be dictated by the flight computer and would be governed by the flight phase. For example, during take-off and landing the flight deck crew tend to be fully occupied and accordingly the frequency may be at fixed

intervals, whereas during the rest of the flight the interrogation conducted by the authentication protocol might occur whenever an attempt is made to change the flight plan or a computer setting.

It will be appreciated that an aircraft has more than one computer and that the authentication protocol may be constituted by a program loaded on a dedicated computer interactive with one or more computers associated with the control of the aircraft. It is to be understood that the invention encompasses systems which include an authentication protocol which is so designed that unsuccessful interrogation of the pilot in practice triggers an immediate denial of access by the pilot to the aircraft controls either directly or via the other computer (s).

It is to be understood that the use of the expression'pilot'herein also embraces other flight deck officers who may have access to any relevant authentication codes.

Claims

CLAIMS 1. A piloted aircraft security system including at least one computer adapted to control and manage the flight of the aircraft, and an authentication protocol controlled by said at least one computer and adapted to interrogate the pilot on a regular or intermittent basis whereby access to the said at least one computer is denied upon unsuccessful interrogation of the pilot as to identity, and the authentication protocol being adapted upon such unsuccessful interrogation of the pilot to enable the said at least one computer to assume complete control and management of the flight until successful interrogation is established or re-established.
2. A system according to Claim 1 in which upon the unsuccessful interrogation of the pilot all functions that would enable the pilot to reassume manual control are disabled.
3. A system according to Claim 1 or 2 in which the unsuccessful interrogation of the pilot ensures continuation of all essential functions of the aircraft.
4. A system according to any one of the preceding claims in which all manual overrides are instantaneously disabled upon such unsuccessful interrogation.
5. A system according to any one of the preceding claims in which in the circumstances of the unsuccessful interrogation of the pilot, the transponder code which notifies air traffic control as to the status of the aircraft is automatically changed thereby to provide an automatic alert as to the prevailing status of the aircraft.

<Desc/Clms Page number 7>
6. A system according to any one of the preceding claims in which the authentication protocol employs a password or PIN recognition security access.
7. A system according to any one of the preceding Claims 1 to 6 in which the authentication protocol employs voice recognition.
8. A system according to Claim 7 in which the authentication protocol employs stress level detection.
9. A system according to Claims 7 and 8 in which the authentication protocol employs stress level detection in conjunction with voice recognition.
10. An aircraft security system substantially as hereinbefore described.
11. A method of operating an aircraft security system according to any one of the preceding claims including the steps of establishing an authentication protocol, the said at least one computer being adapted to initiate the protocol for continuous operation during the flight of the aircraft and to instruct the protocol to interrogate the pilot at regular or intermittent intervals, unsuccessful interrogation causing access of the pilot to the aircraft manual controls to be denied until successful interrogation is established or re-established.
12. A method of operating an aircraft security system substantially as hereinbefore described.