DEGREE’S FINAL THESIS

Thesis Title: Analysis and optimisation of radio spectrum pollution on 1030/1090 MHz bands associated with mode S transponders.

Degree: Aerospace systems engineering

AUTHOR: Borin Kaduk Aguilar

DIRECTOR: Eduard Úbeda Farré

DATE: 7th February 2021

Títol: Anàlisi i optimització de la pol·lució radio espectral en les bandes de 1030/1090 MHz associada als transponedors mode S.

Autor: Borin Kaduk Aguilar

Director: Eduard Úbeda Farré

Data: 7 de Febrer del 2021

Resum

La vigilància actual de les aeronaus es duu a terme amb un parell d’elements clau: el transponedor i l’interrogador.

L’interrogador s’encarrega d’enviar senyals a l’aire per a detectar aeronaus i aquests, quan reben la senyal, transmeten una resposta que conté informació codificada en forma de polsos. Posteriorment la resposta serà processada pels mateixos interrogadors o antenes receptores, i amb el conjunt de respostes de diferents aeronaus i un teixit prou dens d’equips de recepció, podem arribar a vigilar tot el que succeeix a l’espai aeri.

Aquest sistema col·laboratiu ha funcionat remarcablement bé des de la seva creació. Amb el temps, la tecnologia evoluciona i el número de vols creix, però les bandes de freqüència utilitzades romanen les mateixes.

Com a conseqüència d’aquest creixement continu en un sistema basat en la utilització de dues bandes freqüencials fixes, trobem que en l’espai aeri apareixen cada vegada més i més missatges (interrogacions i respostes), arribant, en casos extrems, a la saturació del sistema de vigilància actual.

Cal esmentar que amb l’avenç tecnològic hem pogut aportar solucions per a mitigar els problemes que han anat sorgint fins avui dia en quant a la vigilància aèria, com podrien ser el “garbling” o el “FRUIT”, però es tot un repte d’enginyeria aportar solucions contínues a un sistema que no para de créixer.

Aquest treball final de grau es basa en l’estudi del sistema de vigilància actual, donant èmfasis als cada vegada més recurrents transponedors mode S. Començant amb un breu explicació de com hem arribat a aquest sistema de vigilància, analitzant el seu funcionament, monitoritzant la pol·lució radioelèctrica que genera, estudiant els seus principals inconvenients i aportant possibles solucions per a comprendre com es pot mitigar la sobrecàrrega actual en les bandes de 1030 i 1090 MHz.

Title: Analysis and optimisation of radio spectrum pollution on 1030/1090 MHz bands associated with mode S transponders.

Author: Borin Kaduk Aguilar

Director: Eduard Úbeda Farré

Date: 7th February 2021

Overview

At present, aircraft surveillance is made possible thanks to two key-elements: the transponder and the interrogator.

The interrogator is in charge of sending radioelectric signals into the air in order to detect aircrafts. When these receive the interrogator signals, they transmit a response that contains information codified with pulses. The response is then processed by the same interrogators or other receiver antennas. The joint processing of different aircrafts’ responses through a big enough network of receivers can actually detect and track everything that is happening on the air.

This collaborative system has been working remarkably well since its creation over the second half of the twentieth century. However, the rise in the daily number of flights together with the increased complexity of the adopted technology has raised the usage of the two allocated frequency bands (1030MHz-1090MHz) designed for air surveillance purposes.

As a consequence of this continuous growth on the usage of two fixed frequency bands, more and more messages (interrogations and replies) appear in the airspace, which may end up, in some particular cases, with the saturation of the actual surveillance system.

Technological advances have been able to provide solutions to minimize problems that had been emerging up to the date in terms of aircraft surveillance, as the well-known “garbling” or “FRUIT”. Nevertheless, it is a huge engineering challenge to constantly come up with solutions in a system that never stops growing.

This thesis is based on the study of current aircraft surveillance systems, focusing on the worldwide used Mode S transponders. A brief explanation and analysis of such system is first given, monitoring the radio-spectrum pollution it generates and studying its biggest drawbacks. Moreover, possible solutions are then introduced to minimize the current overload of messages on the bands of 1030 and 1090 MHz. Inscription

To Petr Jonáš, The one that gave me the huge opportunity to take a traineeship in Eurocontrol and engage myself into the world of CNS in aviation.

To Kiko Moriche, To show me who the real engineers are and allow me to see the heart of CNS systems.

To Eduard Úbeda, The radio-location professor who accepted to direct my thesis and made possible for me to choose an interesting topic instead of the proposed ones.

To my family, Who paid for my whole tuition and my accommodation near the University during these 4 years. GLOSSARY

ADS-B: Automatic Dependant Surveillance – Broadcast.

ATC: Air Traffic Control.

ATCRBS: Air Traffic Control Radar Beacon System.

BDS: Binary Data Selector / Comm-B Data Selector.

CET: Central European Time.

CRC: Cyclic Redundacy Check.

DAP: Downlink Aircraft Parameters.

DF: Downlink Format.

EHS: Enhanced Surveillance.

ELM: Extended Length Message.

FIR: Flight Information Region.

FRUIT: False Replies Unsynchronised to Interrogation Transmission / False Replies Unsinchronisde In Time.

GICB: Ground Initiated Comm-B.

GPS: Global Positioning System.

IC: Interrogator Code.

ICAO: International Civil Aviation Organisation

IFF: Identification Friend or Foe.

IFR: Instrumental Flight Rules.

NOTAM: Notification To Airmen.

MIP: Mode Interlace Pattern.

MLAT: Multilateration.

MTOW: Maximum Take-Off Weight.

OVC: Overlay Control Bit. PRF: Pulse Repetition Frequency.

PRI: Pulse Repetition Interval.

PSR: Primary Surveillance Radar.

RA: Resolution Advisory.

RCS: Radar Cross Section.

RF: Radio Frequency.

SLM: Standard Length Message.

SLS: Side Lobe Supression.

SPI-IR: Surveillance Performance and Interoperability-Implementing Rule.

SSR: Secondary Surveillance Radar.

TA: Traffic Advisory.

TCAS: Traffic alert and Collision Avoidance System.

UF: Uplink Format.

WAM: Wide Area Multilateration. INDEX

INTRODUCTION ...... 1

CHAPTER 1. Establishment of the cooperative surveillance system ...... 2

1.1. SSR System ...... 2

1.2. Mode A and Mode C ...... 3

1.3. Transition from mode A/C to Mode S ...... 7

Chapter 2. Mode S ...... 9

2.1. Mode S technologies ...... 9 2.1.1. TCAS ...... 9 2.1.2. Short messages ...... 13 2.1.3. ADS-B ...... 13 2.1.4. Long messages ...... 16

2.2. Mode S messages ...... 18

2.3. Mode S technical specifications ...... 20 2.3.1. Transponder Level ...... 20 2.3.2. Pulse characteristics ...... 21

2.4. Mode S techniques ...... 24 2.4.1. Mode Interlace Patterns ...... 24 2.4.2. Acquisition ...... 25 2.4.3. Lockout and clustering techniques ...... 28

Chapter 3. Analysis of RF pollution in central Europe ...... 30

3.1. Briefing ...... 30

3.2. Monitoring flight data Analysis ...... 32 3.2.1. Material and preparation ...... 32 3.2.2. Evaluation and processing of the data ...... 33 3.2.3. Second try: analysis on the flight back ...... 42

3.3. Overall European Surveillance System Analysis ...... 47 3.3.1. The EMIT tool ...... 47

3.4. Optimisation of the airspace ...... 50

3.5. Conclusions ...... 51

Bibliography ...... 53

Introduction 1

INTRODUCTION

Aviation is a transportation means that is continuously growing as years pass by and it’s here to stay. While aviation is a wide and complex subject involving an enormous variety of fields, this thesis will be focused on a quite specific matter.

There’s a field inside the air navigation services called CNS, meaning Communication, Navigation and Surveillance, which studies the telecommunications systems on board aircrafts. Regarding the Surveillance part of the CNS services, there is a whole field of study focused on aircraft detection and tracking, which will be discussed in this thesis. After getting along with the current surveillance technologies, we will be able to analyse what are the vulnerabilities of the system, paying special attention to the radio electric pollution on the air.

As stated, aviation grows yearly as it had already become affordable for everyone, connecting millions of people around the world. With respect to telecommunication systems, and narrowing it to the topic, the surveillance system, the rise on number of aircraft has in turn raised the messages sent to the air. The trouble on having more messages sent to the air is that on dense airspaces the receivers may not understand everything they are listening to, as if we walked into a crowded bar trying to understand every conversation. The European Commission came up with a solution on 2011 with the Commission Regulation No 1207/2011, or more known as SPI-IR (Surveillance Performance and Interoperability – Implementing Rule). Article 6 of this document offers the key points to diminish the growing problem of air radio electric pollution and we will use this article as a reference to see the performance of the current actual system.

For good or for bad, COVID-19 has put a pause on the aviation industry and as a result, air pollution has decreased. Not only on the ecological meaning of pollution, but also on the RF pollution. Nevertheless, as we are eventually getting out of this pandemic, we will have to prepare ourselves and be ready for the non- stop growing aviation industry we used to have.

With this thesis, we will firstly comprehend how we arrived to the current surveillance system. Then we will surf a bit on all the different technologies used to make the surveillance system work, and last but not least, we will check what is the performance of the air surveillance system within a not-so-much-now crowded airspace, giving a couple of ideas in order to optimise the air surveillance and providing some conclusions. 2 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

CHAPTER 1. Establishment of the cooperative surveillance system

During World War II, an enormous effort was made in military aviation that led to technological advances in aerodynamics, materials and structures, electrical systems and pressurised cabins. Regarding aircraft surveillance, after the war there was no need to create systems that detect enemy aircrafts anymore. Therefore, the technologies used on the war were adapted to civil aviation, which in turn improved significantly civil aviation safety (see Annex I).

From the cradle of Primary Surveillance Radars used on the war, which were non-cooperative as they listened to its own echoes, engineers managed to create a cooperative surveillance system with the use of a new element, the transponder. Ground radar stations were designed to interrogate the aircraft’s transponder and the transponders were designed to reply. Radars that use this kind of system are known as Secondary Surveillance Radars.

In cooperative surveillance (a surveillance system consisting of a radar and a transponder), the Mode is the language the transponder and the radar station use to communicate with each other.

1.1. SSR System

Secondary Surveillance Radar systems involve an interesting variety of technologies, such as ADS-B, TCAS, Mode S, IFF, MLAT, etc. (see [3]). These different technologies are not going to be explained in detail but a high-level explanation of civil Secondary Surveillance Radar technology will be given to provide better understanding of the thesis.

Focusing on the civil pair radar-transponder, the cooperative surveillance system works as following:

1. An interrogation is sent by the radar at 1030MHz. 2. The interrogation is received and decoded by the transponder. It will code an answer if the decoded interrogation Mode is the same of the aircraft transponder. 3. The transponder replies with a signal at 1090MHz. 4. The reply is received by the radar at 1090MHz, which will be processed and sent to a display screen.

On SSR ground stations, there is a transmitter at 1030MHz and a receiver at 1090MHz. On the transponder in the air, there is a receiver at 1030MHz and a transmitter at 1090MHz. Establishment of the current surveillance system 3

Fig. 1.1 Block diagram of a SSR system.

1.2. Mode A and Mode C

Because our interest is on civil aviation aircrafts, we are going to take another step further into the shape of the pulses to recognise Mode A or Mode C interrogations and replies.

Fig. 1.2 Shapes of Mode A and Mode C interrogations [13].

Both Mode A and Mode C interrogations use 0.8 μs wide pulses, separated 8 μs and 21 μs respectively. These pair of pulses are sent by the main directional antenna. A third pulse (P2) is sent by the omnidirectional antenna in order to discard replies from the side lobes. 4 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

The side lobes of the directional antenna could trigger non-desired replies from the transponders, which could result in a bad estimation of bearing, in the worst case, a single aircraft could be replying to the sidelobes of the antenna whilst it is turning around. This will create a “ring around” on the display from which we could not provide an exact position of the aircraft.

That’s why a sidelobe suppression (SLS) mechanism has been introduced: the P2 pulse. The fact that it is sent by the omnidirectional antenna, if P2 is more powerful (and thus is larger in amplitude) than P1 or P3 in the reception of the interrogation, the transponder will ignore the interrogation and not generate a reply, to ensure that it only replies when the main beam is pointing the target.

Mode A and Mode C replies use the same type of reply. Here’s why it is sometimes called Mode A/C reply because we cannot say at first glance whether the reply is a Mode A or a mode C. The main difference is the information they provide. Whereas the shape of the reply may be identical on the reply, a Mode A will be giving us an identifier code (squawk) and a Mode C will be giving us the barometric altitude of the plane. A squawk is an identification code requested by air traffic control in order to identify an aircraft.

Fig. 1.3 Shape of Mode A/C reply [13].

The shape of the reply can contain up to 12 pulses of data of 0.45 μs width, in between the two framing pulses F1 and F2 separated 20.3 μs, also there’s an optional last pulse called SPI (Special Purpose Identification) that can be activated by the pilot on the cockpit if requested by air traffic control. The activation of this pulse will result on a highlight of the track on the air traffic controller display. The X pulse is not really a pulse, since it is always left in blank and it separates A and C digits from B and D digits.

The coding of the replies consist of four octal digits (A,B,C,D). This means the replies of Mode A/C will always be a 4-digit code with numbers varying from the range of 0000 to 7777. The first digit is the A digit, followed by the B digit, and so on. Every octal digit is represented as three binary digits (22,21,20=4,2,1). Since we have 4 octal digits and each one is represented by 3 pulses, there are 12 pulses available on each reply. The positions of these 12 data pulses are Establishment of the current surveillance system 5

translated into zeros and ones depending on wether there is an absence of pulse or not, respectively.

Fig. 1.4 Examples of Mode A replies [13].

We can have as many as 4096 (84) different squawk codes or barometric altitudes at most. Therefore, the same exact reply can have two different meanings regarding Mode of operation. Let’s imagine we capture a transponder Mode A/C reply with the code “1244“. If this reply was being answered to a Mode A interrogation it will mean that the aircraft is squawking with identifier “1244“, whereas if it was to be answering a Mode C interrogation it will mean the aircraft is flying at 32700 ft. 6 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Fig. 1.5 Example of a Mode A/C reply.

On Fig. 1.5 we can see a real Mode A/C reply with the code ‘5526’ which is indicating either the aircraft is squawking that code as an identifier or that the aircraft is flying at 90.000ft. Since civilian aircraft usually fly up to 45000 ft, we can say this is a Mode A reply. The length of the message is displayed with an error of 1000 due to the maximum sampling frequency of the program, so the seconds on Fig. 1.5 are actually milliseconds. We will get into message characteristics later on this thesis.

In Mode A, the identifier code (squawk) is dialled manually by the pilot, requested by air traffic control. This is the most primitive civilian mode of operation since it provides us only an identifier to differentiate civil aircraft. Note that we can only make 2D plots on ATC radar screen because do not know at which altitude the aircrafts are flying. There are some squawk codes reserved for emergencies, such as 7500 (hijacked aircraft), 7600 (loss of communications) or 7700 (general emergency) (see [1]). Establishment of the current surveillance system 7

In Mode C barometric altitude is taken from the pressure altitude sensor on the aircraft, resulting in a dependency on an altitude encoder. The altitude encoder ensures that the pressure reference is always 29.92 inHg (1013 hPa) even if the pilot has put another reference on its altimeter Kollsman window. The Mode C reply is encoded in Gillham code, that it is a slight variation of the Gray code that enhances the reliability of the data, each bit off difference in this code results in 100 ft variation of altitude. The range of altitude replies varies from -1 250ft up to 126500ft, although more altitudes could be assigned. To activate Mode C replies it is only necessary to turn the transponder knob into “ALT” position. With this Mode of operation, ATC can make 3D plots of the aircrafts and get the altitude of the SSR surrounding aircrafts.

Usually, radar systems do not only work in a single mode of operation. If it were to work like so, only altitude or identification could be provided. Both parameters are useful for ATC so the most common modus operandi is to use Mode Interlace Patterns (MIP) to interrogate a set number of radar revolutions in Mode A, and another set of revolutions in Mode C. MIP technique will be explained more into detail in chapter 2.

1.3. Transition from mode A/C to Mode S

Nowadays Mode A and Mode C interrogations and replies are still the most used type of operation in Central Europe, but that is changing quickly.

This system has been proved to work well as it provides us the height of the aircraft and the identification which can be displayed on the air traffic controller radar screen. Nonetheless, as aviation continues to grow, the phenomena of FRUIT and garbling hinder the Mode A/C normal operation (see [14]).

Garbling is the reception of two replies at the same time, while asynchronous garbling may occur when the different replies are slightly shifted one to another, synchronous garbling happens when the two replies collide on time and there are some pulses that overlap. This occurs when the bearing and slant range of two aircraft are nearly the same. It is a problem since the radar/receiver may be decoding incorrectly the information, causing fake replies being processed. It could result into the appearance of non-existing airplanes on the radar screen or aircrafts not being detected properly.

FRUIT is another common phenomenon that deteriorates the surveillance task. When aircrafts are on the view of multiple SSR, because all the radars use of the same frequency band (1030 MHz), each SSR not only receives the replies from its own interrogations but also those replies that were addressed to other SSRs. When a reply like this is received, it is impossible to know the time of the actual initial interrogation because it was made by another SSR, leading to a wrong prediction of the aircraft position. Additionally, both garbling and FRUIT can occur at the same time, and in this case fake replies can be processed, or replies could be unintelligible, resulting in an erroneous reporting of the airspace situation on the ATC radar screens. 8 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Fig. 1.6 FRUIT on an ATC radar screen (left) and Garbling of two replies (right) [14].

FRUIT and garbling, as we may guess, increase substantially in crowded airspaces and action has been taken to minimise its effects. There is a wide variety of degarbling and FRUIT reduction techniques.

To reduce asynchronous garbling we can simply pay attention to the amplitude of the signals as replies that overlap in time but are sent from different distances may vary in amplitude, or make a degarbling wiring circuit that checks for the framing pulses for synchronous garbling. To reduce FRUIT we can make a defruiting wiring circuit that buffers the replies and checks if their PRI are different from the radar’s PRI. Although, the most efficient way to minimise garbling and FRUIT is to reduce the number of interrogations (and therefore replies) sent to the different aircraft.

Apart from garbling and FRUIT, a transponder cannot reply properly due to different causes. It may be replying to another interrogator or on the “dead-time”, where the transponder is not listening shortly after replying to another interrogation. Also too many interrogations can cause the transponder to stop replying or a transponder may be malfunctioning in some unexpected cases.

As a consequence of the continuous increase of aircraft travel and to overcome FRUIT and garbling problems in crowded airspaces a new Mode was introduced at the mid-70s by the Massachusetts Institute of Technology, the Aircraft Owners and Pilots Association and the Federal Aviation Administration. This new Mode was meant to deal with garbling, FRUIT, and the excessive number of interrogations in crowded airspaces, as well as to be able to avoid mid-air collisions. That’s how the Mode S was born.

Mode S, called S because the radar does Selective interrogations and the transponders only reply to the interrogations that are addressed to them, thereby reducing considerably the messages sent on the air by the transponder. Mode S 9

Chapter 2. Mode S

2.1. Mode S technologies

We already know that Mode S represents a selective mode to exchange surveillance information between the aircraft of interest and the ground station. But how is that possible? All the Mode S interrogations and replies have the aircraft 24-bit address inside the message.

The aircraft 24-bit address (AA) is a unique identifier for all the airframes carrying a mode S transponder (see [6]). As if it was a transponder ID. Since there are 24 bits in the ICAO 24 address field, 16777216 (224) different ICAO 24 addresses can be assigned. Two of them (000000h and FFFFFFh) are reserved.

Each ICAO contracting state has been allocated a block of codes that can assign to aircraft registered in such state. The number of codes available for each state depends on the relative size of the state and can be: 1024, 4096, 32768, 262144 or 1048576. The U.S.A. or Russia have 1048576 addresses available to allocate, whereas Estonia or Latvia have only 1024 addresses available.

Inside the data block there are two essential fields in all the formats. Those are the parity field, wherein the ICAO 24-bit address is coded inside, and the uplink/downlink format, that is used at the beginning of each message, just after the preamble, to know which information will the message contain (see Annex II).

As stated, civilian Mode A and Mode C are still the most used surveillance message received by ground stations. Nonetheless, Mode S technology outperforms the two other civilian Modes because it provides a set of new applications that make aircraft surveillance safer. The most important point of this technology is that it is fully compatible with the previous civilian Modes, making it versatile.

Mode S works with the use of formats in each transmission, depending on which information is being requested/sent. We denote uplink format (UF) as an interrogation requesting some specific surveillance information and downlink format (DF) as the reply containing the surveillance information. There are 25 different uplink/downlink formats, although in civil surveillance only 10 are used, those are formats 0,4,5,11,16,17,18,20,21,24. The 4 first formats are short messages, containing 56 bits, and the following ones are long messages, containing 112 bits. The formats are described on the Annex II.

2.1.1. TCAS

The TCAS technology is integrated into the Mode S standard with the formats 0 and 16. All the transmissions with these formats will be TCAS messages; this 10 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

kind of technology is a bit special because it is an air-to-air surveillance, meaning that radars on ground do not send interrogations with UF0 or UF16. It is the TCAS system on board the aircraft that interrogates vicinity aircrafts at 1030 MHz. But how does TCAS work?

TCAS is a cooperative system between aircraft carrying a Mode C or Mode S transponder (see [4]). The TCAS system on board is directly linked to the transponder and to the altimeter, when an aircraft is flying nearby, the TCAS directional antenna receives Mode S acquisition squitters1 and gets a precise estimation on the bearing and range of the nearby aircraft. If a nearby aircraft enters the protection volume, meaning it is getting close to the aircraft, a communication between the two TCAS systems on board the aircrafts will start to avoid a potential risk of collision. The protection volume depends on the TCAS configuration and parameters, but it is usually around 20 nautical miles long and 800 ft high. There are three types of protection volumes.

Fig. 2.1 TCAS protection volumes.

When an intruder is penetrating the caution area, at around 20 NM or 800 ft from the TCAS antenna (or 20-48 seconds before the closest point of approach), the TCAS systems sends an UF0 message to the intruder to get its altitude and rough position in the plane. The former replies with a DF0 that contains its altitude and ICAO 24 address2. Then, the conversation between the two aircrafts starts at a

1 See last paragraph of Chapter 2.1.2 2 ICAO 24 address or ICAO-24 bit address is the unique Mode S transponder identifier. Mode S 11

rate of more than 1 message every 5 seconds. The closer the intruder gets, the higher is this message rate exchange and the less time there is left to react.

Two types of messages are sent from the pilot perspective, traffic advisory (TA) and resolution advisory (RA). TA use format 0, they are short messages whereas RA use format 16 because they are long messages. Advisories can be displayed on the navigation display, the electronic horizontal situation indicator or on the vertical speed indicator. The traffic advisory is an alert message that comes along a vocal “traffic, traffic” alert and it is meant to alert the pilot to maintain visual separation and to prepare to make a manoeuvre if a RA occurs. The pilot can see a TA displayed as an amber or yellow circle. He can also know whether if it is ascending, flying on constant flight level or descending, as well as knowing the relative height difference between them.

Resolution advisories, on the other hand, take a step further and advice the pilot to perform a manoeuvre, even if it is contradicting ATC vectorisation. They are displayed in a similar way as the TA but as a red square. RA vocal alert can notify different words which the pilot will understand to take the corresponding action. In fact, the pilot is expected to follow the TCAS RA instead of the ATC. The action to perform is always taking into account what the intruder aircraft is doing, so the RA for both aircraft will be coordinated, impeding the creation of a new conflict, thus, alleviating the potential collision risk. Such action can be to ascend, descend, keep flight level or lower the velocity. After the alert disappears, the system sends a vocal signal saying “Clear of Conflict”.

TCAS itself has four different versions, the TCAS II is the one used worldwide and is also the one that I have just explained. All of the parameters and requirements I have mentioned are stipulated in the RTCA/DO-185Bv (Minimum operational performance standards for TCAS-II). TCAS-II is the most used version worldwide because, up to the date, is the only one that can produce reliable TA and RA. RAs in TCAS-II are providing only vertical guidance. TCAS-I only provides TA, so not action from the pilot is required. TCAS-III and TCAS-IV have tried to implement the horizontal guidance as well but that could result in the creation of other conflicts in crowded airspaces, so at the end both versions have been abandoned. All aircraft operators in Europe are constrained to carry a TCAS-II version 7.1 on board. 12 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Fig. 2.2 Architecture and interaction of two TCAS systems.

As we see in Fig. 2.2, TCAS is listening for acquisition squitters (DF11) from the intruder’s transponder. Then a UF0 message requesting altitude is sent, which the intruder’s transponder will reply with a DF0 message (containing the altitude and the ICAO 24 address). While the intruder is on the caution area, the transponder and TCAS of both aircraft start sending and receiving UF0/DF0 message flows. The moment the intruder arrives to the warning area, more information is needed in order to take action and perform the desired manoeuvre in order to avoid the conflict. Then, the message flows change to long TCAS messages (UF16/DF16) that will result into the appearance of a colour code on the vertical speed indicator, until the conflict is resolved.

In Fig. 2.2 we must notice that there is designed ATCRBS transponder, meaning TCAS can work with classical Mode C transponders. We can see as well DF11 and DF17 being received to the TCAS, which are going to be explained in this chapter. Furthermore, other formats (4,5,20 and 21) can be seen from the ground station to the transponders, so we can get a first approximation about what enormous versatility the overall Mode S technology has. Mode S 13

2.1.2. Short messages

Mode S short messages are those comprising 56 bits in total. Formats 0,4,5 and 11 use 56-bit messages.

Mode S messages with DF4 are similar to DF0 messages, since both of them provide aircraft altitude in the 13 bit altitude code (AC) field. We could therefore acknowledge them as the ‘new’ Mode C messages. Inside DF4 messages there is also status field (SF), downlink request (DR) and utility message (UM)3. The UF4 interrogation is the one that requests the altitude of the aircraft.

Mode S messages with DF5 share the same fields that the ones in DF4 with the exception of the AC field. Instead, it returns an ID field because DF5 provides identification. We can relate it to the former Mode A since they serve the same purpose. The UF5 interrogation is the one that requests the identification code.

Mode S messages with DF11 are used to acquire the aircraft by the SSR. Firstly, the SSR on ground sends a UF11 interrogation, then, the aircraft equipped with a Mode S transponder replies with DF11. The SSR receives the DF11 reply and acknowledges the aircraft. This format is the cornerstone to the Mode S technology. Thanks to UF/DF 11 SSR systems can acquire new aircrafts to do selective interrogations later, the most important information they get from DF11 is the ICAO 24 address. The DF 11 messages have also a capability field (CA) consisting of 3 bits and the ICAO 24 address.

An important note is that DF11 messages are not always replying to an interrogation. Because these messages are not actual ‘replies’ because they were not triggered by an interrogation, they are called squitters.

Squitters are simply messages sent periodically without being requested by any SSR station previously. Since DF11 is used to acquire aircrafts, even if the aircraft is not interrogated, it will send a DF11 squitter every second. This squitter is useful for TCAS. That’s why on Fig. 2.2 we can see TCAS listening to DF11.

2.1.3. ADS-B

The two following formats, DF17 and DF18, are also squitters. A different kind of squitters. These can provide aircraft downlink parameters such as aircraft type and ID, altitude, position and velocity (see [5]).

Because they are squitters, there is not an existing UF17 or UF18 to trigger the proper DF replies. In fact, this technology squitters or broadcasts its messages. That is where the name of ADS-B comes from. Automatic Dependant Surveillance – Broadcast. The ADS-B technology does not require an action from

3 Too see all the fields in detail see Annex I 14 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

de pilot, in contrast with the Mode A/C transponder where the pilot dialled the squawk code.

ADS-B relies on GNSS systems to provide position and it is connected to the BDS registers4 to extract data from the aircraft sensors. There are two types of ADS-B technology. ADS-B In and ADS-B Out. The main difference between both of them is that an ADS-B In can receive and send messages at 1090MHz whereas the ADS-B Out can only send messages at 1090MHz, as it is the case in the majority of current Mode S transponders. The possibility of having the ADS- B In system on board makes the surveillance much safer. TIS-B and FIS-B messages can be received and processed by the ADS-B In to increase situational awareness on mid-flight. TIS-B or Traffic Information Service – Broadcast allows the pilot to see nearby traffic. FIS-B or Flight Information System – Broadcast allows the pilot to assess the weather and airspace restrictions besides being able to receive NOTAMs. Both TIS-B and FIS-B messages are generated by ground stations.

ADS-B messages contain a 3-bit capability code (CA), the ICAO 24 address (AA), the 56-bit message containing surveillance data (ME) and 24 more bits for parity check (PI). The surveillance data being broadcasted will depend on the five first bits of the ME word, which are the type code (TC).

Fig. 2.3 Surveillance information depending on the TC. [10]

4 BDS registers are data packets of 56-bits containing information of the aircraft (callsign, altitude, bank angle, etc.). Mode S 15

The type code is also related to the reliability of the data. The NUCp (Navigation Uncertainty Category – Position) is related directly to the TC. The lower is the type Code the more confident we can be about the data is sending. That is why there are 4 TC for surface position, 10 for airborne position with barometric altitude and 3 for airborne position with GNSS altitude. If we get a TC 17 or 18, we should not trust completely the accuracy or the data it is sending, a TC 9 or 10 is going to be much more reliable.

The main difference between DF17 and DF18 is that DF18 is reserved for devices that do not carry a transponder. They are typically ground movement vehicles on the airport. On DF17 compact position reporting (CPR) is used to get a precise position using less bits of data, although a previous/initial position to get a reference is needed.

Nowadays many web services allow you to see Mode S transponder equipped aircrafts on real time thanks to the ADS-B technology. A 1090MHz receiver and internet connection is enough to make plots of the current airspace. This is also thanks to the high rate of position, altitude and velocity reporting. Four ADS-B messages are sent every second: two position messages with altitude and two velocity messages. In the case register 0A is not empty, it will also send event- driven squitters at a maximum rate of 2 squitters per second. These last messages provide information different from position and velocity (it could be emergency messages, landing capabilities, etc.).

The rate of ADS-B and acquisition squitters shall be the following: 16 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Fig. 2.4 Rates of squitters from a Mode S transponder on air and ground [8].

While explaining the different technologies used in Mode S, we can foresee the interoperability of the system. There are many interconnected devices serving different purposes. The transponder uses the TCAS and altimeter encoder for DF0/16, it also uses a GPS antenna to get position and send it via ADS-B messages on DF17 and it is also connected to the pressure sensors to send the barometric altitude via DF4.

2.1.4. Long messages

All the long messages (UF/DF 16,20,21,24 and DF17,18) have 112 bits of information. We have seen the purpose for messages with format 16, 17 and 18. Mode S 17

About formats DF20 and DF21, they are pretty similar to the formats 4 and 5 respectively. They provide as well encoded altitude or identification but the difference is a 56-bit word added to the message. This word is extracted from the BDS registers.

The Comm-B Data Selector registers or BDS registers are some memory-cells storing avionics data collected from the sensors, like a data buffer. Transponders store up to 256 different 56-bit registers. When a SSR requests a BDS register, a Comm-A message is sent. Comm-A is an interrogation containing a 56-bit MA field, requesting a specific register. Later, the transponder will reply with a Comm- B message. The Comm-B message is a reply containing a 56-bit MB field wherein the desired register is loaded.

BDS registers are also known as GICB or Ground Initiated Comm-B registers (see [1]). The reason behind it is that when an isolated Comm-B message is received, there is no way to know which register is carrying out of the 256 possible BDS registers. Only the SSR on ground requesting for the specific register will know that the reply is containing it. In other words, the BDS registers in Comm-B messages are just raw avionics data; they are not self-explanatory.

Comm-A and Comm-B are a type of communication capability of the transponder. Both of them have in common the 56-bit extra MA/MD field. 56-bit is the standard length message (SLM) that you can add, as a BDS-register. All long messages with the exception of format 24 use a field of 56-bit with a SLM in it.

All the BDS registers that are not updated in a specific rate are cleared from the transponder. BDS registers are identified by a two hexadecimal code and we can find them separated by a comma i.e. BDS 1,0 or with a h (hexadecimal) at the end i.e. BDS 10h.

2.1.4.1 Mode S ELS

Mode S ELS or elementary surveillance is a protocol inside the Mode S technology that aims to provide a basic surveillance functionality.

To have elementary surveillance functionality means that the Mode S transponder is capable of providing ICAO 24 address, SSR Mode3/A identification, altitude reporting in 25ft increments and the flight status (airborne or ground). Furthermore, 4 DBS registers shall be transmitted when requested. These are DBS 10h; providing datalink5 capability report, DBS 17h; providing common usage GICB same capability report, DBS 20h; providing aircraft identity and DBS 30h; providing TCAS RA.

Nowadays all state aircraft operating with Instrumental Flight Rules (IFR) or General Air Traffic in Europe are required to carry and operate a transponder with Mode S ELS capability (from 7th December 2017).

5 Datalink is a protocol of text message transmission between the aircraft and ground systems. 18 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

2.1.4.2 Mode S EHS

Mode S EHS or Enhanced Surveillance is another protocol inside the Mode S technology that apart from complying with the functionalities of Mode S ELS, it is also capable to extract the downlink aircraft parameters (DAPs). While doing so, it reduces considerably the air traffic controller workload by getting airborne information such as: selected altitude, roll angle, ground speed, magnetic heading, indicated airspeed, vertical rate…

The 3 most extracted BDS registers in EHS are DBS 40h; providing selected vertical intention, BDS 50h; providing track and turn, and BDS 60h; providing heading and speed. The SSR knows if it can extract DAP with the BDS 17h.

Getting back to the formats used on Mode S, the last remaining format to see is the UF/DF 24. This is a special format for extended long messages (ELM). ELM are 112-bit messages that contain an 80-bit message field, while on the other long messages this field is filled with a 56-bit word. Moreover, the ELM being uplink or downlink, is usually concatenated. Up to 16 different ELM segments can be put together to send a long surveillance message to the transponder/SSR. We understand as a segment the basic 56-bit message field used in the Comm- A and Comm-B or the 80-bit message field in the ELM messages.

Uplink ELM messages are often referred as Comm-C messages and Downlink ELM messages are often referred as Comm-D messages.

The ELM messages use only 2 bits for the format number (24 = 24+23) as the UF/DF 24 is the only format comprising the two first bits of the payload equals to ‘1’. Then there are 6 bits for communication control, it changes depending whether it is UF24 or DF24. After that the 80-bit Comm-C or Comm-D message follows and finally there is the 24-bit parity check.

2.2. Mode S messages

All Mode S messages have some aspects in common. All of them, without exception, contain a preamble and the data block. The preamble is used to recognise a Mode S message and the data block contains useful data, such as the format, control fields and parity. Mode S 19

Fig. 2.5 Mode S interrogation message [1].

We can see on the form of the interrogations there are 3 pulses (P1, P2 and P3) sent from the main beam and a fourth (P5) pulse sent from the omnidirectional antenna for SLS, covering the sync phase reversal. The sync phase reversal is the first change of phase of the carrier in the data pulse P6. It is also counted as a time reference for subsequent transponder operations related to the interrogation.

The two first pulses on the interrogation are the preamble (see Fig 2.5), it is easy to recognise a mode S interrogation at first glance by looking at the two first preamble pulses and then a long P6 pulse. The Mode S interrogations will not trigger a reply on classic Mode 3/A or Mode C transponders because the P2 will be interpreted as the SLS is strong enough not to be sent by the omnidirectional antenna. 20 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Fig. 2.6 Mode S reply message [1].

About Mode S replies, they will always start with 4 pulses in the preamble, two pairs separated 3.5 μs from each other and then the data block consisting of 56 or 112 bits of 1 μs.

Preambles have not much to discuss about, they are there just to recognise that after that pattern a Mode S message is coming, the important part of the message is on the data block. You can check into more detail the data block on Annex II.

2.3. Mode S technical specifications

2.3.1. Transponder Level

The level of a Mode S transponder determines its capabilities (see [1]). There are 5 different levels of Mode S transponders.

Level 1 Mode S transponders have basic surveillance capabilities, meaning that they support UF0, UF4, UF5 and UF11 reporting. They neither have provision for datalink capabilities nor ELMs.

Level 2 Mode S transponders have the same capabilities than level 1 Mode S transponders and also those prescribed for SLM, datalink capability reporting, aircraft identification reporting and data parity with overlay control.

Level 3 Mode S transponders have the same capabilities of level 2 Mode S transponders and also those prescribed for ground-to-air (UELM).

Level 4 Mode S transponders have the same capabilities of level 3 Mode S transponders and also those prescribed for air-to-ground (DELM). Mode S 21

Level 5 Mode S transponders have the same capabilities of level 4 Mode S transponders and also those prescribed for enhanced Comm-B and ELM communications.

From 8 January 2015, aircraft operating IFR in Europe are required to carry and operate a level 2 Mode S with elementary surveillance (ELS) capability. From 6 June 2016, if the aircraft MTOW exceeds 5700 Kg, it is also required to have enhanced surveillance (EHS) and ADS-B extended squitter capabilities.

2.3.2. Pulse characteristics

2.3.2.1 UPLINK

On the Mode S interrogations, the carrier frequency must be 1030±0.01MHz, except during the phase reversal. In the phase reversal, some MHz may be shifted for a tiny period of time because of the abrupt change in phase.

The interrogations are polarised vertically and pulse modulated. As we have seen all the interrogations and replies consist of pulses. The data pulse of the interrogations (P6), being short or long, is always differential phase-modulated. It consists of reversing the carrier 180º at a rate of 4 Mb/s.

The minimum duration of the modulation or the velocity of the phase reversal is not specified, however, it must comply with the following spectrum requirements:

22 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Fig. 2.7 Mode S uplink spectrum margin [1].

In Mode S interrogations, a chip is the 0.25 μs carrier interval between possible data phase reversals. A binary ONE is represented by a 180° phase reversal and a binary ZERO is represented by the absence of it.

The sync phase reversal is the timing reference on P6. It is important to have the sync phase reversal to recognise a Mode S interrogation. If there is no sync phase reversal, the interrogation is not valid. The data field on interrogations starts after a 0.5 μs ward time from sync phase reversal and ends 0.5 μs time before the trailing edge of P6.

The radar characteristics vary depending on the installation of every SSR. Transmitted power, PRF, Mode Interlace Patterns, Sensitivity, etc. Each Mode S ground station can have a different set of parameters.

On Mode S interrogations, a maximum of 6 interrogations per beam must take place. As an average, 3 interrogations per beam are made to acquire the aircraft and only 1.3 when the aircraft is acquired, meaning 1.3 selective interrogations per beam. Also, depending on the configuration of the radar, this number of interrogations per beam will vary. The beam of the SSR is usually 3º wide in azimuth and wider than 60º in elevation.

It is important to point out that the interrogations are not always made by SSR stations. TCAS systems on board the aircraft have also the possibility to generate UF0 and UF16, which contain the same parameters previously commented. As we can see, Mode S technology is really versatile.

2.3.2.2. DOWNLINK

On the downlink side, Mode S replies must have the carrier frequency centred at 1090MHz with 1MHz of margin.

Like on the uplink interrogations, the replies are also polarised vertically. Nonetheless, the modulation used is different. All Mode S replies are pulse- position modulated at a rate of 1 Mb/s.

Pulse Position Modulation (PPM) consist in sending pulses of the carrier with a time shift depending on the value of the bit. Meaning a ONE has the carrier on the first half time slot of the bit and a ZERO has the carrier on the last half time slot of the bit.

The spectrum of a Mode S reply shall never exceed the following figure: Mode S 23

Fig. 2.8 Mode S downlink spectrum margin [1]

The data block of the replies shall start 8 μs after the first transmitted pulse. Then, a 500-ns pulse shall be transmitted either on the first half or the second half of each 1 μs interval. If a pulse transmitted on the second half is followed by another pulse transmitted on the first half, a one μs pulse shall be transmitted. This modulation can be seen on Fig. 2.6.

Although transponders and SSR are made by different manufacturers and can have different characteristics, there is the document ED-73E about minimum operational performance specification for SSR and Mode S transponders, in which the minimum performance characteristics are described.

Bear in mind that SSR stations are conformed by a rotatory high-directional arrayed-antenna and an omnidirectional antenna for SLS, whereas the transponders antennas are situated one on the top and one on the bottom of the plane and are quasi-omnidirectional. 24 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

2.4. Mode S techniques

2.4.1. Mode Interlace Patterns

To better understand how can the different civil Modes of operations cope well together it is important to know what the Mode Interlace Patterns (MIP) are.

As we know, nowadays the civilian Mode A and Mode C are still in use, but in crowded airspace it generates a lot of fruit and garbling leading to a congestion of the two surveillance bands (1090/1030MHz) and decreasing the overall system performance, as well as the safety. Mode S was created to overcome these problems and keep the surveillance system safe and robust, but no big change can be done in the matter of days or weeks. It takes time to progressively change from one technology to another and we must have full compatibility on the meantime.

That is exactly the point where we are right now. The technology that allows to interoperate between the different civil Modes is the MIP. The MIP is focused on ground stations, actuating on the uplink interrogations, and consists on dividing the time into distinct all-call periods and roll-call periods (see [6]).

Fig. 2.9 MIP technique [6]

During the all-call periods the SSR station interrogates Mode A/C and Mode S transponders. Whereas on the roll call periods the SSR station interrogates selectively the Mode S transponders. All-call repetition frequency for Mode S is normally between 40 and 150 Hz (max).

Regarding Mode S only, the all-call periods are used for acquisition purposes. When an aircraft enters the SSR range, the SSR is making all-call interrogations continuously, interlaced with roll-call interrogations. When the aircraft equipped with mode S transponder receives an all-call interrogation (UF11) it replies with the acquisition message (DF11) and then the radar knows its ICAO 24-bit address. Then, on the roll-call period the radar will selectively interrogate the previously acquired aircraft. Other aircrafts will ignore the reply because they have another ICAO address, reducing the emission of replies in the airspace.

The typical ratio in a MIP is 1/3 of the time for Mode A/C and Mode S all-call activity and 2/3 of the time for Mode S roll-call activity. Mode S 25

2.4.2. Acquisition

The acquisition is the process to acknowledge new aircraft in the SSR coverage, it is performed with the Mode S format 11. Inside the directional beam, 3 different Mode S all-call interrogations are performed. This is because the transponder occupancy is theoretically 10%, meaning that 10% of the time the transponder will not process the interrogation because it is busy replying to other stations. This will give us a probability of reply of 90% but if we add other factors such as the transponder not processing correctly the interrogation, the probability of receiving a reply decreases. Two other more all-call interrogations are performed to ensure the transponder is not busy and also to check that the announced address is the same, making the acquisition process more robust.

Each Mode S radar has a unique identifier, which can be a SI code or an II code. Mode S radars operating on SI code can acquire Mode S transponders that are SI code capable, but cannot acquire Mode S transponders which are II code capable. A Mode S transponder that is II capable can only decode the IC field on UF11. As it is not regarding the CL field, it only gets the 4 lasts bits of the Surveillance Identifier. This means an II=7 will match with the SI codes 23,39 and 55. It is recommended for Mode S interrogators to support II/SI code operation, doing so will enable radars to interoperate with older and newer transponders. Thus, a transponder that is II capable may receive an all-call interrogation (UF11) with the SI code 23, decode it as an II code 7 and generate a reply with the II code 7 overlaid on the parity field. The radar with the SI code 23 will not disregard this II code 7, since it is a matching code.

Those radars that are not supporting the II/SI operation won’t acquire the II capable aircraft. Currently the vast majority of flights over Europe carry Mode S transponders that are SI capable. Even if a radar is II/SI capable, it cannot lock out a transponder that is II capable, to enable acquisition by other radars.

Once the radar has acquired the aircraft, it will be “locked out”. To be locked out implies that the transponder will not reply to the SSR station’s all-call interrogations with the IC code that initiated the UF11 interrogation.

Once an aircraft is acquired and locked out, the SSR on ground instructs to the addressed transponder not to reply to other ground stations’ all-call interrogations with the same IC. Furthermore, the lockout lasts 18 seconds once the aircraft is locked out, but this timer does a reset with every selective interrogation, assuring the lockout of the target during its path across the SSR coverage.

The lock-out control fields are on the SD field of the selective interrogation formats, which at the same time depend on the DI field (see Annex II). So the normal procedure is to first acquire the aircraft with the Mode S all-call interrogation (UF11) and then lock it out with the selective interrogations (UF4,5,20,21). 26 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Fig. 2.10 lockout technique [6]

2.4.2.1. STOCASTIC ACQUISITION

When two aircraft are closely spaced in slant range, it is probable that the replies to all-call interrogations may be close enough in time to generate garbling and in some cases the SSR station, even after the degarbling process, cannot acquire the different aircrafts. To avoid this, all-call interrogations are sent with a probability of reply on the PR field (UF11). If there are two or three aircraft with nearly the same slant range, if they all reply to the all-call interrogations the chance of having garbling are higher, whereas if some of them do not reply, less messages will be overlapped and the degarbling process may separate the distinct DF11 replies.

Once the aircrafts are acquired, they ignore the all-call interrogations (they are locked out), so it will be easier for other aircraft closely separated in slant range to be acquired by the SSR station. The problem of this technique is that it is probabilistic, meaning that it could lead to undesired scenarios like the aircraft close in slant range never replying to the all-call interrogations. However, this last scenario is almost impossible to take place in reality.

2.4.2.2. ATCRBS transponders

Mode A and Mode C transponders are also taking place in the surveillance system, but they do not have a ICAO 24-bit address, so they can not be acquired. However, Mode S SSR stations can be used for both Mode A/C and Mode S Mode S 27

interrogations; what’s more, they can get the replies from Mode A/C transponders as well as from Mode S transponders with a single interrogation. This type of interrogations is called the intermode interrogation.

There are two types of intermode interrogations, those that trigger the Mode S all-call, also called Mode A/C/S all-call interrogation, and those that do not trigger the Mode S all-call (only replied by Mode A/C), also called Mode A/C-only all-call.

Fig. 2.11 Intermode interrogation pulse sequence [1]

We have seen before how are the shapes of the Mode S and Mode A or Mode C interrogations. To generate a Mode S interrogation two pulses are needed. The same happens for the Mode A/C interrogations, if we do a combination of both, we get the intermode interrogation with the use of only 3 pulses. There are also one or two pulses sent by the omnidirectional antenna to suppress replies from aircraft on the sidelobes.

The two first pulses (P1,P3) generate a Mode A or Mode C interrogation, depending on the separation of them, as a classical ATCRBS SSR does. The second pulse (P3) is also used as the ‘first’ pulse of the typical Mode S interrogation. The third pulse (P4) can be 0.8 or 1.6 μs long and depending on the longitude of this P4, the Mode S transponder will reply or not. Notice that Mode A/C transponders will always reply to the intermode interrogations.

When a Mode S transponder receives an intermode interrogation, it processes it like a normal Mode S interrogation. It looks for the sync phase reversal, which occurs between 1.45 and 1.55 μs after the leading edge of P4. As the 28 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

P4 in the Mode A/C/S all-call is 1.6 μs wide, the sync phase reversal falls in the expected range of time. A sync phase reversal can never appear on a 0.8 μs pulse, that is why the Mode A/C-only intermode interrogation will never trigger a Mode S reply.

As a comment, from 01 January 2020 Mode A/C/S all-call interrogations shall not be used because of the adverse effects it may cause on congested airspaces.

2.4.3. Lockout and clustering techniques

Once an aircraft has been acquired by a SSR station with a specific IC6, the SSR stations lockout the aircraft to avoid RF pollution while replying to the all-call interrogations. Having said so, in order to allow a SSR stations to operate in co- ordination with its neighbouring stations, there is a lockout technique that allows the SSR stations to force a transponder reply to all-calls, regardless of the current lockout status to that interrogating IC. This technique is called Lockout Override.

As explained before in stochastic acquisition, the lockout override is strongly recommended to be applied also with a probability of reply smaller than 1 to avoid garbling problems. In the coverage borders of a SSR station other SSR stations would have to acquire the aircraft so that it can be constantly tracked. If it were to happen that the vicinity stations have the same IC but without forming part of the same cluster, stochastic lockout override acquisition might be used so that the aircraft replies to the next ground station. Any SSR station with an assigned IC can override the lockout of an aircraft. The message sent to ignore this lockout is a UF11 with the PR field value higher than seven.

Certain interrogators, such as Mobile Mode S interrogators performing military activities, or other stations without an assigned interrogator code (active MLAT or WAM systems) cannot perform lockout on the aircrafts but they need to know which aircraft is on the air and estimate its position. Quite often the II code 0 is assigned to this kind of interrogators, so aircraft replying to II code 0 are nearly always replying to mobile radars.

Interrogators with II code 0 can’t lockout aircrafts with the exception of some mobile radars which can lockout the aircrafts for a short period of time to allow a better acquisition process avoiding garbling.

Intermittent lockout is another type of technique that may be used between adjacent SSR stations with the same IC but not operating as a cluster. On overlapping areas between SSR stations with same IC, all the stations will wait for a defined period of time once they receive all-call replies before resetting the lockout of an aircraft. So instead of the target being constantly locked out, it will be not locked out during a certain period (typically 10 seconds) and then locked out during 18 seconds. This allows the neighbouring sensors with same IC to

6 An interrogator Code (IC) is an identification code assigned to SSR stations. It can either be defined with an II code or with a SI code. Mode S 29

acquire the aircraft, since one of them is allowing the other sensors to acquire it in the 10 seconds that it is not locking it out, if it has not already been acquired by stochastic lockout override acquisition.

However, things would be more efficient on high density-areas if the SSR stations are forming a cluster.

A cluster of sensors is a group of interrogators with overlapping coverage that have been networked together and are all using the same IC. The most convenient thing of a clustered network of SSR stations is that the information such as the position of the aircraft, its identity, altitude or any BDS register can be sent through the ground network without the need to request it again to the aircraft every time it is entering a new radar coverage. There is no need to start another acquisition process between the clustered radars, the cluster can be seen as a giant radar. To coordinate the lockout, acquisition and datalink information between the radars forming the cluster a carefully management process has to take place in order to ensure an efficient-working cluster.

In most of Europe, with the exception of some clusters in Germany and the Netherlands, radars are working as standalone stations. Although it is not the most efficient way of working, due to political reasons the European states prefer not to rely on other countries’ radars. Moreover, the complexity on a clustered system is much more challenging, and in the case of a radar failure inside a cluster a huge set of inherent problems will come afterwards. The common scenario nowadays is to have fully independent SSR stations that share the IC (also called multisite operation).

The multisite lockout protocol prevents transponder acquisition from being denied one ground station by lockout commands from an adjacent ground station that has overlapping coverage. The multisite lockout command shall be transmitted in the SD field. A lockout command for an II code shall be transmitted in an SD with DI = 1 or DI = 7.

Remember that the lockout avoids the aircraft to reply to a radar’s all-call interrogations containing certain IC. This means a single aircraft can be locked out by multiple radars.

To help with the transition period of leaving a SSR coverage zone and entering a new SSR coverage zone, there is a 5-NM buffer distance where lockout is not applied, which would be the zone green zone in Fig. 2.10. This is because the SSR stations have a coverage based on 5 NM x 5 NM cells. In this period of transition, the lockout is restricted so that the adjacent radars with the same IC are able to acquire the aircraft. This may generate a high rate of all-call replies from the aircraft, but If the aircraft was entering the new coverage area being locked out by the previous radar, it would generate FRUIT replies for at least 18 seconds and plotting an erroneous position on the ATC display, which is even worse. 30 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Chapter 3. Analysis of RF pollution in central Europe

3.1. Briefing

The practical part of the thesis consists of an analysis of the RF pollution over the region of Central Europe. Firstly, a local analysis is carried out on a single flight, as a random example, and later a broad analysis is undertaken to asses what is happening on the whole European airspace. A later discussion on the actions to enhance the surveillance system is carried out, if anything can be done to lower the usage of 1030 and 1090 MHz bands.

At this point, we have learnt already that the current air surveillance system uses only two frequency channels. On those two frequencies, all the surveillance technologies work together hand by hand to achieve a safe and well-functioning surveillance system. These two frequencies are a limited resource and as air traffic grows, the messages and pollution on the two channels grow similarly. The introduction of Mode S resulted on a reduction of pollution, as interrogations that are not addressed to the aircraft do not generate a reply. However, the current surveillance system is not perfect, and we have to work to keep these two limited resources alleviated. The less polluted the two frequencies are, the more features we can add to the system, improving its safety.

This study is made with a private tool provided by the Surveillance Unit of Eurocontrol called EMIT (European Monitoring of Interrogated Transponders) and a flight carrying a receiver on board an aircraft to get a realistic dataset.

The EMIT tool is a network of passive sensors spread over Europe that capture radio electric messages on the surveillance bands (1090/1030MHz). As the sensors are located in strategic locations on the ground, they provide a good coverage of 1090 MHz airborne replies sent by aircraft, but they need to be in line of sight from the radars to get all the 1030MHz messages, since they come from the highly directional beam transmitted by ground stations.

The receivers used to perform the reception of the surveillance messages are provided by the polish enterprise Avionix. On this thesis the receiver called Avionix openAir duo is used (see Fig 3.1). Analysis of RF pollution in central Europe 31

Fig. 3.1 Hardware of the receiver

The openAir duo receivers are dual band receivers which can be connected via VPN, making them accessible from any place in the world where there is internet connection.

The receivers can store up to 3 continuous days of raw data and can handle more than 2000 Mode S messages per second. To get detailed specifications of the receivers, see Annex IV.

The gathered data is stored into special format files that have to be later processed to get human-readable data in csv format. The internal process inside the receiver that captures surveillance information and transforms it to files is sensitive data owned by Eurocontrol, so the human-readable data will be directly shown and also processed to make graphics and extract conclusions.

The analysis of RF pollution on 1030/1090MHz bands regarding Mode S transponders will consist on two practical studies:

- A monitoring flight data analysis: A pragmatic example to assess what is happening on the air in terms of surveillance. - A wide scope analysis: With the use of EMIT tool, I will search for alterations in the surveillance system across Europe.

The reference documentation for this practical study are the SPI-IR (Surveillance Performance and Interoperability-Implementing Rule) requirements of the Single European Sky and the Commission Regulation (EC) Nº 1207/2011, paying special attention to Article 6 of such regulation (see [2] or Annex V).

In short, this article stipulates that interrogation rates of the SSR should not exceed the minimum reply rate capability for Mode S and Mode A/C transponders. What does exceed the minimum reply rate capability mean? To explain myself better, this means the transponders are designed to reply with at least a certain number of interrogations per second and the SPI-IR regulation 32 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

ensures that the radars interrogate with a rate below this number. The numbers that interrogated transponders should not exceed are:

- 50 Mode S replies per second - 16 long Mode S replies per second (DF16, 20, 21) - 500 Mode A/C replies per second

3.2. Monitoring flight data Analysis

The recording was done on the regular flight FR2917 the 16th of December 2020 (Brussels Zaventem Airport – Barcelona El Prat Airport) gathering 2 hours of continuous surveillance data (19:45 - 21:45 CET). The gathered data is used to analyse the different shortages or problems which could be embedded on a particular flight over Europe.

3.2.1. Material and preparation

The material used to perform the analysis is the following:

- Avionix openAir duo receiver - Personal laptop - GPS antenna - Ethernet Cat5e cable - DC output cable 5 mm x 2.5 mm - SMA female – Type N male connector - 300-1100MHz telescopic antenna (ANT700) - 20000 mAh battery with DC output (12 V-3 A) - (optional) 10 dB RF attenuator with 50Ω input impedance. Analysis of RF pollution in central Europe 33

Fig. 3.2 Material used to carry out the analysis.

On the flight, briefly before the take-off, a software tool (NetCat) was used to check the correct reception of surveillance messages as well as the signal level, just in case the attenuator had to be inserted. Once everything was checked, the receiver would continuously collect data during the whole flight.

3.2.2. Evaluation and processing of the data

On 17th December 2020 the flight had already been carried out and several problems occurred in the data gathering, such as power disconnection from the battery, the GPS signal acquisition at the beginning on the flight was not sufficient, and GPS signal was needed to start recording and, moreover the power was too strong, the antenna was disconnected for some seconds to connect the attenuator.

Since an aircraft can be understood as a big metallic box, from inside the aircraft all the 1030MHz interrogations from the radars/TCAS were not received correctly, but all the replies and TCAS interrogations sent by the own aircraft were received properly. Specific comments will also be devoted to the classical Mode A or Mode C surveillance systems, although it is not the main focus of this thesis. 34 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Once the data was passed into a computer, attention was given to the number of Mode S replies to check if the aircraft exceeded at any point of the flight the thresholds established on the second point of the article 6 of the SPI-IR regulation.

Regarding Mode S messages along the flight, the gathered data was divided into minutes and for each minute, every second was looped. Then, the second that had most Mode S replies inside every minute was saved to plot it into a KML file as a placemark (a point).

Every single downlink format was classified so that inside each minute we would have a point for each format. This represents a drawback, as the highest reply from a specific downlink format may happen in a different second of the same minute, compared to the other downlink formats. In order to carry out a concise analysis and focus on Article 6 of the SPI-IR regulation, the downlink formats were grouped into 5 different KML files: “TCAS” groups DF0 and 16, “ADS-B” is the same as DF17, “Total” groups all the DF except for the squitters, as stipulated on the regulation, “Air-Ground” takes all the DF except TCAS and finally “Long DF” takes the long Mode S replies. The points or placemarks are colour coded, so that the closer the reply rates are to the threshold defined in the regulation, the redder they become, or they become purple if the thresholds exceeded by far. The KML files I used to perform this study are “Total” and “Long DF” (see Annex III for further details on this study).

Fig. 3.3 16th December flight data regarding total Mode S replies. Analysis of RF pollution in central Europe 35

Fig. 3.4 16th December highest rate of the flight.

Even though gathering continuous data of all the flight was not possible, at first glance it seems that there is not a single moment were the transponder is exceeding the threshold limits. The maximum reply rate is found near Bourges, France, (we get 42 replies in a second on two different minutes, 19:41 and 19:35). Although close to the threshold, it is still respecting the limits.

Digging a bit deeper into the formats that contribute to these rates, it is apparent that the DF11 is the format that contributed the most in this 42-message-per- second rate, where 25 out of these 42 messages are all-call replies, roughly the 60% of the messages in that second. Let’s see these messages: 36 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Fig. 3.5 All-call replies in the highest rate of the flight.

Is it possible to have these many all-call replies in one second? A close observation of the data confirms that out of the 25 all-call replies, there are only 5 different messages that are repeated in the same second. Then, what is happening? Why are there so many repeated messages? All-call replies are short messages containing the format of the message, the raw hexadecimal ICAO address and the parity check, which includes the radar interrogator code to which the all-call reply is addressed. So, in reality, the only data changing in all these 5 repeated messages is the parity or to which radar is the reply sent to, you can see this by looking at Fig. 3.5, only the two last hexadecimal digits are changing, this is explained in detail on the Parity section on the Annex II.

It is indeed possible to have these many all-call replies. For instance, imagine if 5-6 different radars working on multisite operation (see Chapter 2.4.3.) are pointing the same aircraft for acquisition and it is not acquired, with a Pd of 0.5 and 3 average interrogations, it will reply with at least 10-15 DF11 messages in a short interval of time (hundreds of milliseconds). Then the first radar of the multisite that sends the selective interrogation with lockout parameters will make the transponder to ignore the all-call interrogations, and the amount of DF11 replies to those radars will drop to zero.

To understand better what is the problem in here, we can focus on the radars to which these messages are addressed. Unfortunately, there is no public information about where the Mode S radars are located. So, even If the interrogator codes are decoded, we cannot know if these repeated rates are from different SSR stations conforming a multisite or a single SSR station. Having said so, in either case it could be a malfunctioning transponder not locking out the radar interrogations, or a more realistic guess, a lockout restricted zone. As regards the lockout restricted areas between adjacent radars, it is highly possible that in this particular zone of the flight there is no lockout, as we have seen as well the same high rate 6 minutes before. So, these rates may be linked Analysis of RF pollution in central Europe 37

to a “no lockout zone7”. Just to reassure this hypothesis, a quick Cyclic Redundancy Check was made (see Annex III) to see that the interrogator codes of the repeated messages are not zero. On II code zero the lockout cannot be applied, in the exception of some really specific cases.

Fig. 3.6 Interrogator codes of the all-call replies

There was only a single message that was replied with II code 00. This fact reassures the guess of a no-lockout zone. We can expect to have some repeated all-call replies due to a restricted lockout zone, although having on the same zone three or four different lockout zones from different multisite station groups is a bit of a coincidence. Therefore, probably we are seeing a combination of both: in this specific minute the aircraft was flying over a lockout restricted area and some radars were also applying stochastic acquisition.

There was a high reply rate in this second, with some repeated messages that are intrinsic on Mode S acquisition methods. However, the rate was still below the threshold so it is good that we kept an eye on it to see what happened. The flight complies with the regulation even for this second, although having 25 messages of the same format in the same second gives food for thought; something can be done to optimise this high quantity of messages.

Let’s check now what happens regarding the ELM messages (DF 16/20/21).

7 A “no lockout zone” or lockout restricted area is the area where the radar acquires the aircraft but the aircraft does not lock out the radar. This is the green area of Fig. 2.10 38 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Fig. 3.7 Long Mode S replies on the flight of 16th December.

Despite being near the SPI-IR threshold regarding all the messages, we haven’t paid much attention to the long messages. They seemed to be inoffensive on the contribution of the RF pollution, but regarding occupancy of the air surveillance frequency bands, a long Mode S reply takes as much time as two short Mode S replies. That is the reason why the SPI-IR has also stipulated a second threshold for Mode S long replies with a maximum value of 16 long replies per second. As we can see, on this dataset there are many moments through the flight where the aircraft does not comply with the regulation, reaching a maximum of 25 long messages per second, as seen on Fig. 3.6. Why are there so many Mode S long replies?

Mode S long messages are the same than Mode S short message, but with a 56- bit BDS register in it, containing some requested information by the radar. This means that the SSR stations are requesting some information to the aircraft. Then, a question arises: Why are the SSR stations requesting so many BDS registers? There are 256 registers so it may seem normal to request 20 of them in a second, although it may not be necessary. Let’s investigate further to see what is happening. Analysis of RF pollution in central Europe 39

Fig. 3.8 Second with highest Mode S long replies of the flight.

Looking at Fig. 3.8 we can see that the whole long replies are replies to ground station. In this second there hasn’t been any DF16, so there are no TCAS resolution advisories. There are 10 DF20 and 15 DF21 messages, meaning that solely DF21 replies almost reach the limit of the SPI-IR regulation. We can also see that there is an excessive repetition of messages. With the help of “pyModeS8”, we can analyse what is the information of these messages.

On this specific second, the most repeated DF21 message is an altitude message containing BDS register 40h, which in turn provides ‘selected vertical intention’. These are the parameters extracted from the decoding of the message, using python and the ‘pyModeS’ library:

>>> pms.bds.bds40.is40('A8000AB4C84E4270A8000048F5AD') True >>> pms.bds.bds40.selalt40mcp('A8000AB4C84E4270A8000048F5AD') 37008 >>> pms.bds.bds40.selalt40fms('A8000AB4C84E4270A8000048F5AD') 37008 >>> pms.bds.bds40.p40baro('A8000AB4C84E4270A8000048F5AD') 1013.2

Here we first have checked that the message indeed contains a BDS40h, and then in the same message we decode the selected altitude in the MCP (Mode Control Panel) where the pilots have manually input the altitude, and the FMS (Flight Management System). The BDS 40h also has the reference pressure of the altimeter. It can be well understood that it is important to ask two, three, or

8 pyModeS is a Python library that helps with the decoding of raw Mode S messages. 40 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

even four times the selected altitude of the aircraft, plus, the DF4 or DF20 already provide the altitude of the aircraft, so in this second 19 (9 DF21 with BDS 40h + 10 DF20 messages) altitudes are reported. Even if the airplane was changing its altitude with the highest vertical speed possible, 19 altitude reports per second is an exaggerated value. Interestingly, the other DF21 messages are identity messages with BDS registers 50h, 60h and 20h (track & turn, heading & speed and aircraft identification), and these BDS registers are requested with lower rates than the BDS 40h.

Regarding the DF20, which already contains the altitude encoded in the reply, we see as well a message that gets repeated. This message contains the BDS register 60h.

>>> pms.bds.bds60.is60('A00017B0C1A9F930FFD400EBD23B') True >>> pms.bds.bds60.ias60('A00017B0C1A9F930FFD400EBD23B') 252 >>> pms.bds.bds60.hdg60('A00017B0C1A9F930FFD400EBD23B') 184.57 >>> pms.bds.bds60.vr60ins('A00017B0C1A9F930FFD400EBD23B') 0

We check that the message really contains BDS 60h, and we get the Indicated Air Speed, the magnetic heading and the vertical rate. Again, we see that requesting the BDS register 60h 6 times is not giving more robustness to the system and is contributing to RF pollution. It could be useful if the vertical rate was changing, instead of zero, or that the magnetic heading is also changing, to control the turn of the aircraft, but as there are 6 exact messages, the 6th message is not providing us more useful data than the 5th or the 4th. Notice that the DF21 message ‘A8000AB4C1A9F930FFF400E28EB1’ provides the same BDS register 60h that is also being requested in the DF20 messages. They give the same information, so if we wanted robustness or a double-check factor, with one BDS 60h request for each long DF reply should be enough.

Analogously, in communications between humans, sometimes we do not listen correctly to the one that is talking to us, so we double-check the communication with some “Could you repeat that please?” or “I didn’t understand you”. So the interlocutor repeats the message. Then, in a radar scenario, why does the radar need seven or eight (if not more) messages from the same aircraft giving the same information it has given some milliseconds ago? The answer is to get a higher update rate of the position of the aircraft, but that is by far not the most efficient way to solve the issue. Usually, the “en route9” phase of any flight is travelled at constant altitude and speed (cruising speed). Knowing this fact in advance, radar manufacturers should have created an efficient communication with the transponder in this common scenario. We have found a weak point of the current Mode S system that has to be optimised while keeping the robustness and safety of air surveillance.

9 The en route phase is that part of the flight between the end of the take-off and initial climb phase and the commencement of the approach and landing phase. Analysis of RF pollution in central Europe 41

And finally, to finish the task, let’s take a quick look to Mode A/C replies. As said previously, it is not the main interest of this thesis, but as it is still the technology that we see most often in the total number of messages, we should not ignore it. Similar to Mode S, I have counted the peak-rates in each minute and plotted them on a chart.

Fig. 3.9 Peak rate of Mode A and Mode C replies of the flight.

We clearly see some important things in here. As the disconnections from the flight are not visible in here, meaning that some noise has been interpreted as real Mode A/C messages. Luckily, we have parity check on Mode S technologies to discard messages received with noise. Plus, in any point of the flight the peak- rate never exceeds 500 messages per second, as the SPI-IR defines. Even it does not reach the half of the value (250 messages/second), so having all this into account, Mode A and Mode C do not make a huge impact to the RF pollution over Europe. It is true that these kinds of replies are way higher in number, but on the other hand they are very short, 21 μs compared to 64 or 120 μs of Mode S short and long replies respectively. Same scenario happens regarding the interrogations.

To sum up the flight analysis, we conclude that even at first glance the total Mode S replies and Mode A/C replies do not exceed the threshold limit stipulated by the Article 6 on the SPI-IR regulation, the flight has not complied with the regulation as the long Mode S replies exceed the threshold limits. We have identified some weak points on the air surveillance systems, one of them being that SSR stations are not configured correctly, generating too many interrogations and requesting too many BDS registers in a really short period of time. 42 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

A second data analysis on the flight back to Brussels was performed on the 10th January 2021. Similar results are expected, as with Covid-19 the traffic will remain approximately the same and the radars would be configured in the same manner in such a short time between the two flights.

3.2.3. Second try: analysis on the flight back

With the same material to perform the analysis, on the 10th January 2020 the flight FR2918 from Barcelona El Prat Airport to Brussels Zaventem Airport was analysed. This time, a continuous gathering of data was carried out, starting at the Pyrenees where the GPS signal was first obtained until the arrival at Brussels.

Let’s start with the overall Mode S signals:

Fig. 3.10 Mode S replies and highest rate on the flight of 10th January.

Since the start of the recording to somewhere over Paris we get near the overall Mode S SPI-IR threshold, we can feel that the 1090 MHz channel is loaded and, Analysis of RF pollution in central Europe 43

not far from reality, right after passing Paris the threshold is surpassed five times, with the maximum rate at 06:57:59 UTC. The number of times it has passed the threshold here becomes irrelevant, as we can find other similar values as 46,47,48 and 49 several times, so it is not only five isolated cases surpassing the threshold, it is also a matter of chance, anywhere over France the threshold could have been passed as values were already high.

Digging a bit into the contribution of the highest peak-rate, 37 messages were all- call replies, 20 were long replies and 4 were TCAS messages. On this same exact second, we see that even the long Mode S threshold stipulated on the SPI-IR is also surpassed, and an important thing to take notice is that from these 37 all-call replies, there are 8 unique messages. This means that in that second on the air, at least 8 different SSR stations were sending all-call messages to the aircraft and the aircraft has still not locked them out.

Fig. 3.11 all-call replies on the highest rate of the flight.

Eight unique messages for the sum of 37 all-call replies message in a second is actually not that much; that is, eight unique messages means that there are at least eight different SSR stations with their Interrogator Code. It could happen that other SSR stations share one of these IC, as in a multisite operation. Furthermore, there could even be more SSR stations sending all-call interrogations but that the transponder has already locked out, so It is fairly easy to have 12-13 radars pointing at the aircraft flying over Paris that the Mode S transponder has not locked out. Count as well the number of other all-call interrogations that are locked out, so they have not triggered a reply. That is a considerable amount of radars pointing at the same aircraft in the same second. 44 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Not to our luck, as an airplane works, electromagnetically speaking, as a metallic box with a few slits (the windows), we cannot see the interrogations that caused these all-call replies, although as the aircraft is approaching Belgium, it is probably detecting interrogations with low power from Belgium, Luxembourg and probably other SSR stations on southern England.

The problem here is quite clear: the current acquisition methods for air surveillance may not be the best, but we have to be worried about the amount of SSR stations over Europe.

Let’s asses what happens regarding the long Mode S messages.

Fig. 3.12 peak rates and maximum peak rate of long replies.

From South to Mid France, the peak rates of long replies are similar to the first flight, or even worse: over 90% of the minutes on the flight had some second that exceeded the SPI-IR threshold, arriving to an alarming rate of 30 long Mode S replies in a single second.

We could analyse any of these seconds in the detail, but to keep a harmony on the study, the highest rate is adopted again, although the pattern over the peak Analysis of RF pollution in central Europe 45

rates is repeated. For the moment, while the overall Mode S reply rates are usually under the threshold and in some minutes, there are a couple of seconds that exceed the threshold, the long Mode S replies are usually exceeding the threshold during all the flight and we cannot keep this as the normal situation.

Fig. 3.13 Long replies of the highest peak rate.

We see that both DF20 and DF21 share the amount of messages fairly well: 14 for DF21 and 16 for DF20. There are no TCAS messages, which means that the problem does not come from other TCAS, but from ground stations. That is also the reason why we exceed the SPI-IR threshold continuously, as long TCAS message usually involves a collision hazard, which could happen sporadically.

Similar to Fig. 3.8, there is also a repetition of identic replies within the same second, or sometimes even on the same decimal of a second. It does not give much redundancy in the system as the parity check is already a mechanism to know if a message is corrupted. It appears fine to have redundancy and make a double-check, but it is not a good practice to exhaust redundancy.

On this case, the DF 21 message: “A80009BC8FA402B0A80000DF84BE” has appeared for the first time at 07:12:19 UTC, and from that minute until 07:14:34 UTC the Mode S transponder on board has send this message 185 times. The interesting part about this is that this message is an identity reply containing BDS 40h (altitude data). The fact that it appears 185 times in two minutes with the same value, it means that altitude has not changed over that time yet the transponder is still replying its altitude, as it should do. This problem comes along the previous one: there is an excess of SSR stations. For sure these 185 exact messages in two minutes will be sent to different SSR stations, although with less SSR stations we could keep the same level of safety and know exactly the same information we need. The fact that BDS register 40h is requested so many times is because air traffic controllers want the minimum latency time, so the controller 46 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

display is refreshed every few seconds, but that is not an excuse to pollute the 1030 and 1090 MHz frequency bands.

The other messages on the other hand are not repeated much (7-15 unique messages though all the flight), although a mechanism like a strike of two or three messages on 1090MHz by the transponder every time the aircraft changes its altitude would suffice to let the radar knows that there has been a change of altitude. In addition to BDS 40h, we have DF4 and DF20 providing altitude and ADS-B, which reports altitude at least twice per second.

Finally, a few lines are devoted to the classical Mode A/C replies.

Fig. 3.14 Mode A/C peak rates on the 10th January.

The results regarding classic Mode A/C replies are in some way similar to the results we had on the last flight. There is only one point where the peak rate surpasses the 250 replies per second, but nothing to worry about, as the threshold is at 500 replies per second. The rest of the peak rates are still below half of this value. We could see that at the beginning the receiver is interpreting noise as Mode A/C replies, and from 6:01 UTC the real recording starts. It follows a bit in parallel what we have seen on Mode S: from Pyrenees (6:01 UTC) to Paris (6:50 UTC) there is a more or less stable pattern (in green) with a maximum of 200 messages per second, with the exception of the peak. After Paris, the peaks get a bit higher (in orange), and finally as the flight loses altitude it also receives less interrogations and thus it sends less replies.

In a few words, we get similar results as the first flight but with a bit more reliability, as the dataset is continuous and we have noticed new aspects like the excessive repetition of unique messages outside the highest peak-rate minute. We can also validate the analysis since both data analysis brought us similar results, as expected. The overall Mode S rates exceed the SPI-IR threshold, as well as the long Mode S rates, and we still do not have to worry much about the Mode A/C, Analysis of RF pollution in central Europe 47

as it is still far away from any trouble. An important thing to remember from both analysis is that redundancy must have its limits. We cannot just pollute the air with RF messages for the sake of safety, or later we will have safety issues related to RF pollution.

3.3. Overall European Surveillance System Analysis

To get a wide overview of the whole European surveillance system it is necessary to create a network of passive receivers covering different areas across Europe. This is what the CNS unit team in EUROCONTROL has done over the last year, deploying a network of openAir duo receivers from Avionix over strategic places over Europe and connecting them to a centralised server via VPN. All the data is stored and then processed to be displayed in a webpage so that the different Air Navigation Service Providers (ANSP) can quickly asses what is happening on their airspace. This web service is called EMIT, or European Monitoring of Interrogated Transponders (see [17]) and we will see in this chapter how handy this private tool can be.

3.3.1. The EMIT tool

Without the data we cannot know how the transponders are performing in a large scale. This is the reason why EMIT excels as a versatile and powerful tool, used to get a quick overview of the load of surveillance frequency channels (1030-1090 MHz), get warnings when message rates exceed certain thresholds, track the performance of certain aircraft or even localise problems from certain ground stations. It is not the purpose of this work to provide all details on how the EMIT tool works. Rather, those specific functions that help to analyse what is happening in Europe are adopted.

The EMIT tool is quite new, less than one year old, whereby it is still under development. There are currently 26 functional receivers and by the end of next year more than 70 receivers are expected to be operational. However, 26 receivers are enough to obtain a general overview of the european airspace.

Another important issue is that the Mode A/C messages do not carry a unique identification embeded in the message, so Mode A/C replies received by the receivers on the ground are not that useful. Hence, for a wide analysis it makes more sense to focus on Mode S replies.

Regarding the Article 6 of the SPI-IR regulation, thanks to the EMIT tool it can be easily seen that almost every day the message rates from Mode S transponders are exceeding by far the thresholds. The examples in Fig. 3.15 raise the attention on the usefulness of the EMIT tool. 48 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Fig. 3.15 Daily warnings on aircrafts detected exceeding the SPI-IR [17]

As you can see, a daily alert was received from EMIT on how many aircraft were exceeding a threshold of over 100 messages per second, twice as many the amount that the SPI-IR stipulates. Since these emails were received almost every day, the threshold was raised to 200 messages per second, and, some daily warnings were still received regarding aircraft exceeding the threshold with over 200 messages per second. A compressed file was attached to every e-mail so that each aircraft exceeding the threshold limit could be identified.

Another function of EMIT is the alert function, which works similarly to the warning function but it sends you an email every time an aircraft exceeds a stipulated threshold. The main difference with this other functionality is that it provides you the FIR, ICAO 24 bit address, position, callsign and the rates broken down by formats.

Fig. 3.16 Daily alerts on aircrafts detected exceeding the SPI-IR [17]

Three examples were adopted over the time period from October-December 2020 , each one of them exceeding by far the SPI-IR regulations. Paying attention to where it happened, the first and third alerts of Fig. 3.16 show us that something is happening on the LCCC FIR over Cyprus, on different months and different heights but with a similar problem. Both alerts have enormous rates Analysis of RF pollution in central Europe 49

on short downlink formats 4 and 5, which could be a malfunctioning radar over- interrogating the aircraft’s transponders. What’s more, solely the downlink format 11 is already taking the threshold limit by itself, with 40 messages per second on the aircraft with ICAO address ‘4ba975’ and 52 messages per second on the aircraft with ICAO address ‘471f7d’. The other flight on the LOVV FIR, over Wien, has been detected sending 224 messages per second, 193 of them are with format 11 (all-call replies).

As observed on the flight under analysis on the 16th December that the maximum rate was 42, and 25 of them were sent with DF 11. There is clearly a problem with DF11 across Europe almost every time we see an aircraft sending high rates of messages.

As an example, a picture from EMIT tool is taken showing the historical record of all Mode S messages received by the EMIT network of receivers over the last four hours. Each dot in the map is colour coded depending on the rate of messages sent from an aircraft, as done in analogous manner on the flight analysis.

Fig. 3.17 Map of 1090 MHz rates over Europe (26/12/2020, 12:24 UTC) [17]

Some ‘hot spots’ can be identified on the busiest zones of Europe (London, Paris, Frankfurt, etc.) where it is quite normal to have more than 50 replies per second. Additionally, most messages are caused by all-call replies, so this is an issue that needs to be solved as soon as possible. Regarding the data on the same minute, we see that more than 10 aircraft exceed the 50 Mode S messages per second and the majority of them has over 30-40 all-call replies in it. We also see that some of the long Mode S rates exceed as well the SPI-IR regulation. 50 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

Fig. 3.18 Chart of highest rates over Europe at 12:24 UTC (26/12/2020) [17]

The chart in Fig 3.8 represents a random pick from different minutes and days to illustrate that the rates are almost always exceeded. In the first analysis, we have seen that the all-call replies contribute in a great deal to the overall pollution of the 1090 MHz band, and this is due to the use of different technologies involved on the acquisition of Mode S transponders. However, we cannot normalise the fact that over Europe there will always be some aircrafts that are not complying with the Article 6 of the SPI-IR regulation and we have to work to reduce the flow of messages on 1090-1030 MHz bands while keeping the safety of air surveillance: less messages, same information.

3.4. Optimisation of the airspace

An efficient way to reduce RF pollution on the air surveillance bands (1030- 1090MHz) would be to focus on the weak points we have found, for instance, changing the way acquisition is performed. As an example, the EMIT tool and some well-known applications as flightradar24 or opensky network are acquiring and tracking aircraft over all Europe using only passive systems. The ADS-B messages have the raw hexadecimal ICAO address and they also provide position. The easiest way to reduce DF11 and UF11 rates would be to integrate the ADS- B technologies within each SSR station. With this, only few all-call interrogations (for robustness) would be needed. There are some obvious difficulties on this solution as the synchronisation of the position of the aircraft with the moment where the radar must send the interrogation to hit the target. Also adding the situational awareness to each SSR station so they can know their latitude, longitude and altitude and the ones from aircrafts on their surroundings. What’s more, ADS-B messages from aircraft in close slant range could overlap on a single receiver, resulting on garbled messages, but the garbling problem would be easily solved with this ADS-B integration on the radar. We could just put two or three different passive ADS-B receivers some dozens of kilometres away from each other inside the range of the radar, and later connecting them to obtain Analysis of RF pollution in central Europe 51

another factor of security. You can see that there is a whole new field of application bounding this idea.

Other solutions to keep low all-call interrogations and replies would be to make more radar clusters inside each country, or improving intercommunication between radars from ground links, so when an aircraft exits a coverage zone of a radar, the adjacent radar is ready to receive it without the need of acquiring it.

Regarding the long messages, there is a straightforward solution: each ANSP should check their radars’ configuration to avoid the excessive requests of BDS registers. The problem concerning this matter can be quickly analysed with the help of the EMIT tool, which ANSPs will have access to, helping to see which radar is requesting exhaustively for BDS registers. Changing the configuration of SSR stations to provide communication between radar stations would help to reduce the amount of BDS register requests, although on the other hand the cost of interconnecting all the SSR stations would increase substantially. Another way to help a great deal with this issue would be to change the methodology of GICB. Instead of being initiated on the ground, the aircraft could broadcast or send the most important BDS registers every time their value varies. This way the case on Fig. 3.13, where the altitude was requested 185 times in 120 seconds would not happen again. One more thing that can be done is enhancing communication between radar manufacturers and ANSPs, as the former makes the radars and the latter watches the flaws of the radars.

Lastly, it is important to notice that there are superfluous radars over Europe. An example would be Luxembourg, a country of 2.586 square kilometres does not need two Mode S radars, as they are planning to have in the near future. The same happens in Belgium and the Netherlands, these two small countries could be covered with the use of four or five radars, but each country uses more than five. Radar coverage does not understand of borders, so a good number of radars situated near borders could be reduced. Civil aviation has been founded in a compromise between countries from all over the world who knew that cooperation is the main pillar for a better civil aviation scenario.

3.5. Conclusions

Airspace surveillance is a complex subject, involving different technologies on the same framework. Having understood the technologies involved on Mode S and having performed different analyses over Europe, the following observations are extracted from the analyses:

- The current weak points on the Mode S surveillance system are the methods involved on the all-call interrogations and the excessive requests of BDS registers. - It is quite common to see at any time over Europe some aircrafts not complying with the SPI-IR regulation, and this cannot remain the normal situation. 52 Analysis and optimisation of radio spectrum pollution on 1030/1090MHz bands associated with Mode S transponders

- The two flight analyses done in this thesis do not comply with the regulation: the first exceeds the long Mode S threshold, and the second exceeds the overall Mode S and long Mode S thresholds. - There is no need to request for the same information many times. - There is a trade-off between robustness and validity of the data, but the balance of this trade-off only weights on the robustness side, without taking care of the obtained data. - Air traffic controllers want their displays to be updated in a couple of seconds, and to do so radars request BDS registers to the aircrafts but sometimes the BDS register requested is not changing. This involves emitting unnecessary messages to the air or polluting the airspace. Changing the way BDS register request work would help considerably to reduce the airspace pollution. - Regarding Mode S, since all-call replies are higher in number, the long replies are occupying more time the frequency bands. - Regarding Modes A and C, passive systems cannot help much with the provision of an overall pollution analysis due to the nature of the system. They provide less information than Mode S messages, they do not have parity check and it is more difficult to track them, as Mode A and Mode C replies share the same binary format. - Although Modes A and C are nowadays the most used messages on the airspace, they do not contribute much to the total RF pollution of the 1030- 1090 MHz frequency bands. - The current complexity of Mode S acquisitions methods contributes to the RF pollution over Europe. Integrating ADS-B technologies on SSR stations would deal with the decrease of uplink and downlink messages with format 11. - Cooperation between different entities, such as SSR manufacturers, Transponder manufacturers and ANSPs would help to discuss and provide solutions to misconfigurations of SSR stations and better usage of 1030- 1090 MHz frequency bands. - Intercomunications between SSR stations would improve in a great deal the reduction of the amount of BDS request. - There is an excess of SSR stations over Europe due to political reasons. It would make sense for military purposes that each country manages their own radars, but for civilian air surveillance purposes, the situation is different: cooperation between countries is the basis to reduce infrastructure costs and pollution on the two surveillance frequency bands. Analysis of RF pollution in central Europe 53

Bibliography

[1] International Civil Aviation Organisation, Annex 10 Aeronautical Telecommunications, Volume IV Surveillance and Collision Avoidance Systems. 5th Edition (2014)

[2] Official Journal of the European Union, Comission Implementing Regulation 1207/2011 (2011)

[3] International Civil Aviation Organisation, Doc 9924 Aeronautical Surveillance Manual. 1st Edition (2010)

[4] International Civil Aviation Organisation, Doc 9863 Airborne Collision Avoidance System Manual. 1st Edition (2006)

[5] International Civil Aviation Organisation, Doc 9871 Technical Provisions for Mode S services and Extended Squitter. 2nd Edition (2012)

[6] EUROCONTROL, Principles of Mode S operation and Interrogator Codes. 2nd Edition (2003)

[7] EUROCONTROL, Specification for the Mode S IC allocation coordination and IC conflicte management. 1st Edition (2013)

[8] EUROCONTROL, Mode S transponder in Airport/A-SMGCS Environment. 1st Edition (2005)

[9] Eurocae, Minimum Operation Standard for secondary surveillance radar Mode S transponder. Ed. 73-E (2011)

[10] Junzi Sun, The 1090MHz riddle. 2nd Edition. (2020)

[11] https://en.wikipedia.org/wiki/Identification_friend_or_foe

[12] https://www.britannica.com/technology/radar/History-of-radar

[13] www.aeroelectric.com

[14] www.radartutorial.eu

[15] www.skybrary.aero

[16] mode-s.org/decode

[17] emit.sero-systems.de Annex I – History on Radar technology

Non-cooperative surveillance

The origin of radar technology took place on the last decades of the 19th century, when Heinrich Hertz proved that radio electric waves can be reflected from metallic objects. Although not much of it had advanced on the next few decades, it was on the 1930’s when the effort to improve radar technology became notorious. It was developed mainly for military purposes, since it was being used to detect aircrafts and ships. The term RADAR (RAdio Detecting And Ranging) was coined by the U.S. navy and has been thereinafter extended all over the world.

The early radars worked in a simple way. The radar on the ground sent a high- power electromagnetic pulse burst to the air. In the scenario where some metallic object was on the air, this same object reflected the radar pulse burst in all directions, this is what we call scattering. A small part of this reflection returned back to the radar, like an echo. Knowing the time between the sent signal and the received echo the rough distance between the radar and the aircraft could be calculated. This type of radar is called Primary Surveillance Radar, from now on PSR.

Every PSR is composed of at least four components, which are the transmitter, duplexer, receiver and display.

Fig. I.1 Components of a PSR.

The PSR has in the same installation the transmitter and the receiver. The transmitter has to be powerful enough to receive a decent amount of energy from the backscatter. As the backscatter is normally attenuated by all the distance that has to travel, the receiver has also to have good levels of sensibility (-100 dBm) and relatively low bandwidths (1MHz) to increase the SNR.

To better understand the ratios of power between the transmitted signal and the received echo we should regard the radar equation, from which we can obtain a handful of information. We know that the power density at a certain point radiated by an isotropic antenna is the transmitted power divided by the area of the spherical wave front.

푃푡 (I.1) 푃 = 4휋푅

Where 푃 is the power density, 푃푡 is the transmitted power and 푅 is the range or distance from the observation point to the transmitter.

The transmitting radar antennas normally have high directivity in order to achieve better the bearing of the target. If we place a receiving antenna at a distance R, the power captured by the antenna results from the product of the power density in (I.1) by the effective area (퐴푒푓푓) of the receiving antenna, that is:

푃푡 퐺 퐴푒푓푓 푃푟 = 4휋푅 (I.2)

The most notorious factor in this equation is the dependence on the squared range.

In the PSR, the transmitted signal impacts a target and is scattered all around the surroundings of the airplane. The reflection of the signal will depend on the size, shape, material and orientation of the target. The “Radar Cross Section” (RCS) provides a measure on the attenuation of the signal when reflected back to the radar. We will not get into further detail about RCS because it is a wide subject that we will not study in this thesis. However, it is an important concept we may keep in mind for the better understanding on how a radar works.

To get the final radar equation, we must also take into account the distance the signal will travel back. Because it is an echo and not an active reply from the aircraft, the attenuation will be analogous to equation (I.2) but taking into account the round-trip travel of the transmitted signal. Thus, the received power by the radar will be:

푃푡 퐺 퐴푒푓푓 1 푃푟 = 푅퐶푆 4휋푅 4휋푅

(I.3)

If we simplify the previous equation, we will get the so-called Radar Equation:

푃푟 = () (I.4)

Where, unlike in (I.2), in Radar systems the transmitting antenna is the same as the receiving antenna.

In view on (I.4), in order to achieve a good received power we will have to try our best to enlarge the transmitted power, the directivity and the effective area of the Antenna. The RCS depends on the target itself and the key parameter in this equation is the range, which attenuates our transmitted signal at the power of 4.

This also means that for big ranges of surveillance the required transmitted power becomes normally enormous and the received power is likely to be quite small. As the same radar sends the transmitted signal and listens to its highly attenuated reply, a duplexer is needed to separate the transmissions of the signals and their receptions. If the radar were to transmit and listen at the same time, the power of the transmitted signal will destroy the receptor. Hence, the use of a duplexer is crucial to isolate the transmitter and the receiver stages.

Finally, the display is the last key component on a PSR since it plots the target in a screen which makes it easy to get an idea of where the target is located.

The main advantage of this system is that most objects that reflect electromagnetic waves can be detected with a wavelength that is short enough. The drawbacks are that a lot of power is being radiated and we can only get the distance and bearing from the target.

IFF - Cooperative surveillance

As the World War II began, identification of friend or enemy aircraft became a difficult task, since aircrafts flew high enough not to be recognisable at first glance and PSR was useless for aircraft identification. Then the Identification, Friend or Foe (IFF) system was created in order to recognise friendly aircraft.

The idea of IFF system was similar to the PSR, but the radar on the ground identified only the friendly aircrafts. This was achieved with the codification of the replies. Instead of receiving an echo from a friendly aircraft, a transmitting responder (transponder) was on board the aircraft and replied with a known, codified pulse burst. Thus, the aircraft that were detected passively who did not answer with the codified reply were considered as enemies.

The system presents several advantages, as all friendly aircraft can be identified, using much less power than PSR because the radar doesn’t receive an echo but an actual transponder reply. However, there are still some drawbacks, for example, a friendly aircraft whose transponder is not working properly or powered off will result on identifying the friendly aircraft as an enemy.

The first transponder to be active was IFF Mark I, it was an experimental model made by the British Royal Air Force in 1939. Instead of producing IFF Mark I, they quickly put IFF Mark II into production, with some corrections of deficiencies that the IFF Mark I carried. During the war, IFF Mark III, IFF Mark IV and IFF Mark V were developed, each one being more advanced and using higher frequencies than the previous one. The most remarkable progression on the IFF system was the use of two different frequencies: one used for interrogations and the other used for replies. This technique is known as cross-band transponder.

With the end of World War II, the IFF system was still being developed. IFF Mark X was introduced at the beginning of the 1950s with the advantage of a selective identification feature, meaning that the reply could be shaped differently than the predefined one. The replies could contain up to 12 pulses, representing 4 octal digits of 3 bits each one. Depending on the length of the interrogations, the transponder could reply in different ways. The main advantage of this technique was the possibility to identify individual aircraft rather than only telling if it is a friend or an enemy. Each aircraft could dial the code in the transponder and select the Mode in which they were operating. Mode 1 replied with the mission or type of aircraft (reconnaissance, for example), Mode 2 replied with the tail number of the aircraft and Mode 3 replied with the identification code.

As civil aviation experimented a great expansion on the early 1950s it was decided to use a slightly modified IFF system to detect civil aircrafts but this time not for the purpose of identification by itself. It was rather to provide more information than range and bearing as well as using less power than PSR.

Two Modes were added for civil aviation, which are Mode A, paired with the military Mode 3 used for identification, and Mode C, that returned the encoded barometric altitude of the aircraft. Because Mode 3 and Mode A have an identical interrogation shape, it is sometimes called Mode 3/A.

We could state that the Secondary Surveillance Radar (SSR) exists as a result of the evolution of the IFF system. Although SSR systems have been used to perform different applications as time passed by, so nowadays it involves a broader scope and the IFF system has resulted into a specific military application of the whole SSR system.

There’s not a specific date in which SSR was invented, as we can see it was more as a result of improving the previous systems. We could say IFF Mark X, on the beginning of the 1950s draw the thin line that separates IFF system from the whole SSR system. The early SSR stations, which englobed mode 3/A and Mode C, were called Air Traffic Control Radar Beacon System (ATCRBS). Whenever we call an ATCRBS transponder we are referring to the transponder with Mode A and Mode C capabilities.

Nowadays the IFF system is still functioning and the current version of it is IFF Mark XII, apart from the civil modes, it also supports Mode 4 and Mode 5. Both modes have classified information about the shape of the interrogation, so that the form of the interrogation cannot be easily reproduced. It is important to keep in mind, though, that this system is currently used for military purposes. Annex II – Mode S messages in a nutshell.

PARITY

Not every message contains the ICAO 24-bit address directly in binary. Usually, it is ‘hidden’ inside the parity information. This is done to profit the bits of the signal and not to waste 24 bits of message into a single field, in addition to add protection against the occurrence of errors.

The parity information overlaid with either the ICAO 24-bit address or the interrogator identification will result on the Adress/Parity (AP) field or Parity/Interrogator Identifier (PI) respectively. The parity information is created with the use of polynomial sequences, that are useful to check whether the received information is correctly received or not.

A binary polynomial division between the message information (M(x) x24) and the following 24th order polynomial equation generates the parity check sequence.

ퟐퟒ 풊 푮(풙)= ∑풊ퟎ 풙 품풊 (II.1)

Where 푔i is 1 for i = 1,3,10 and 12 through 24 and is 0 otherwise.

The message information (M(x)) is the following:

푀(푥) = 푚 + 푚푥 + 푚푥 +⋯+ 푚푥 (II.2)

The message information comprises the first 32 or 88 bits (k=32 or 88), depending if it is a short or long message. 24 ZEROs are added at the end of M(x) by multiplying it with x24. The ZEROs will be used to make a Cyclic Redundancy Check.

The result of the former division (equation II.1 divided by equation II.2) will provide us a quotient (Q(x)) and a remainder (R(x)) of order <24. This R(x) is going to be the parity information.

In the uplink formats, the parity information is always overlaid with the ICAO 24 bit address, resulting always to have the AP field on the end of each interrogation. Uniquely the uplink formats do a small modification while overlaying the 24-bit address. These small modifications consist in the ICAO 24 bit address being multiplied with the binary H(x) polynomial.

ퟐퟒ 풊 푯(풙)= ∑풊ퟎ 풙 풉풊 (II.3)

Where ℎi is 1 for I = 0 through 12, 14, 21 and 24 and is 0 otherwise.

With this slightly modified ICAO 24 bit address, we overlay the parity information and we get the AP field on all the interrogation messages. On the downlink side, the AP field is calculated in the same way, but the small modification of the AA field (equation II.3) is not performed. Furthermore, not always the parity field is the AP field, it could happen to be the IP field.

The IP field is also extracted doing a similar procedure than the extraction of the AP field. Instead of overlaying the parity information to the AA field, the parity information is overlaid over a 24-bit sequence comprising some information fields from the interrogations. This fields are the 4-bit Code Label (CL) and the 3-bit interrogator identification code (IC). To match up the numbers, the first 17 bits of are ZEROs.

The IP field is only filled on the DF 11, 17 and 18. This is because the three downlink formats already carry the raw ICAO 24-bit address/AA field in binary on its own reply.

DF11 can be a squitter or a reply. If it is a reply, it means it has been triggered by a SSR. The DF11 reply encodes the interrogation information (CL and IC fields) from the SSR that triggered the reply, and adds it at the end of the message, on the IP field. Thereinafter, the SSR that sent the interrogation expects the reply with the ICAO 24-bit address and its own CL and IC on the IP field.

If it is a squitter, the CL and IC fields are turned into ZEROs. Meaning the parity information is overlaid with 24 ZEROs. Remember, the DF11 squitters are mainly used by TCAS systems while the DF11 replies are used by SSR system to acquire new aircrafts.

On the other squitters, such as DF17 and DF18, it happens the same. We can state that all squitters encode the parity information with 24 ZEROs. Only DF11 replies to the SSR stations carry IP field overlaid the corresponding interrogator identifier.

FORMATS

The first 5 bits of every Mode S message are dedicated to explain which information it is going to be inside the message. As the field for the format number is 5 bit long, it means there are 32 different possible combinations of formats, although, we use only 10 as we have seen in chapter 2.1.

Each format serves a different purpose. It is easy to recognise what information we expect in a message thanks to the format number. I.e. when we talk of format 0 or 16, we know it is TCAS.

The next two figures show the detailed information and fields inside every message. Note that the first 5 bits define the rest of the message.

Fig. II.7 Mode S uplink formats and its information.

Fig. II.8 Mode S downlink formats and its information.

In both uplink/downlink fields we can see that format and parity bits remain the same, whereas the information inside the message varies a lot.

On UF 20 and 21, if DI field has the value 0, 3 or 7, the SD field will have the overlay control bit (OVC) set to ONE. That’s why we can see on the DF 20 and 21 there is DP meaning Data Parity, if the OVC bit is set to ZERO, we get the AP (Address Parity). Data Parity is achieved overlaying parity information with a modified AA address, which in time is also overlaid by the BDS registers. FIELDS

I am going to take a step deep into the format of the messages, to know in detail what is inside the message, excluding the format and the parity. Even though the messages are explained in great detail on ICAO Annex 10, Vol IV, for the better understanding of the analysis it is important to know what the fields on each message are.

Starting with the uplink formats, the UF0 has 3 fields:

- RL: Reply Length. Requests for a long or short reply. - AQ: Acquisition. Controls RI field of DF0. - DS: Data Selector. Contains the BDS code. The reply will be DF16.

UF4 and UF5 share the same fields, the main difference is on the RR field:

- PC: Protocol. Contains operating commands of the transponder. - RR: Reply Request. Contains the length and content of a requested reply. - DI: Designator Identification. Identifies the structure of SD field. - SD: Special Designator. Contains control codes to accomplish communication information from the ground stations.

UF11 has 3 fields:

- PR: Probability of Reply. - IC: Interrogator Code. Contains either the 4-bit interrogator identifier code (II) or the lower 4 bits of the 6-bit surveillance identifier code (SI), depending on the value of the CL field. - CL: Code Label. It defines the contents of the IC field.

I need to do a further explanation for the sake of analysis about UF11. All the SSR stations must have a code to identify themselves.

Firstly, 4 bits were assigned to identify the SSR stations, making up to 16 possible different identifications called Interrogator Identifiers (II). As new radar techniques came out, the Surveillance Identifier (SI) was created in 2007 to extent the 16 available identification codes. SI code has 6 bits, making up to 64 different codes that can be allocated in the SSR stations.

At the beginning of 2008 and 2009, not all the transponders were CL capable, meaning that they could not reply to a SI code, only to the II code. Nowadays, 99.9% of passenger aircrafts in Europe carry a CL capable transponder.

Take a look at the values of the IC field depending on the 3 bits of the CL field.

- 000 : IC field contains II codes 0 to 15 - 001 : IC field contains SI codes 1 to 15 - 010 : IC field contains SI codes 16 to 31 - 011 : IC field contains SI codes 32 to 47 - 100 : IC field contains SI codes 48 to 63

Note that SI code 0 does is not used, while II code 0 is used.

To allow interoperations between old transponders and CL capable transponders, the ground stations were instructed to process matching codes. As the IC field is the first field, followed by the CL field, old transponders will only read the first 4 bits of information and ignore the rest, obtaining the II code. They will interpret the SI code 17 as the II code 2 because they will ignore the 010 CL field, and consequently reply with the II code 2 and not the SI code 17 on the parity information on IP field. Radars know if a transponder is CL capable with the BDS register 10h.

The II=0 is a reserved code used for Mode S interrogators that have not been assigned a unique discrete IC, i.e. active MLAT and WAM systems, Mobile Mode S interrogators and lockout override techniques.

In Europe, the Mode S Interrogator Code Allocations (MICA Cell from EUROCONTROL) assigns the codes to the European Mode S radars.

UF16, used by TCAS as well has the same fields of UF0 but DS is changed to MU:

- RL: Reply Length. Requests for a long or short reply. - AQ: Acquisition. Controls RI field of DF0. - MU: requests for Comm-B reply, RA is active when UF16 is triggered.

UF20 and UF21 are exactly the same messages than UF4 and UF5 with the Comm-A field before the Address Parity. Remember MA or Comm-A messages are requesting for a BDS register on the expected reply.

The last uplink format, UF24, has 3 fields:

- RC: Reply Control. Designates segment significance and reply decision. - NC: Number of C-segment. Designates the number of the message segment contained in MC. - MC: MC-message, Comm-C.

About downlink formats, DF0 is again from TCAS and has 5 fields:

- VS: Vertical Status. On air or on ground. - CC: Cross-link Capability. Supports the decoding the DS field or not. - SL: Sensitivity Level. - RI: Reply Information. Maximum cruise air speed and type of reply. - AC: Altitude Code.

DF4 and DF5 have 4 fields:

- FS: Flight Status. Ground/Air, alert and SPI. - DR: Downlink Request. Contains downlink information. - UM: Utility Message. Contains transponder communications status. - AC/ID: Altitude Code/Identity. DF4 encodes its altitude and DF5 its identity in accordance as a Mode A reply.

DF11 has only two fields:

- CA: Capability. Indicates the performance of the carrying transponder. - *A: Address Announced. Contains the plain 24-bit ICAO address.

For long messages, TCAS uses DF16 with 5 fields, 4 of them are like the ones in DF0:

- VS: Vertical Status. - SL: Sensitivity Level. - RI: Reply Information. - AC: Altitude Code. - MV: Message. Contains the information requested in DS field.

Squitters DF17 and DF18 have 3 fields:

- CA/CF: Capability/Control Field. Capability is used by DF17 in the same way than DF11. Control Field defines the format of DF18 transmissions. - AA: Announced Address. Same than DF11. - ME: Message, Extended Squitter. Supported by Registers 05h,06h,07h,08h,09h,0Ah,61h and 6Fh.

Remember, DF18 is used for non-transponder devices, usually ground movement equipment on the airports.

DF20 and 21 have 5 fields, the same than DF4 and 5 but with the Comm-B message:

- FS: Flight Status. - DR: Dowlink Request - UM: Utility Message - AC/ID: Altitude Code/Identification. - MB: Message, Comm-B. Contains the requested BDS register.

Finally, the DF24 has 3 fields:

- KE: Control, ELM. Defines the contents of the message. - ND: Number of D-segment. Contains the number of message segment. - MD: Message, Comm-D. It contains the segment of the downlink ELM or control codes for an uplink ELM.

The detailed information about the different values of each field is exhaustedly explained on the ICAO Annex 10 Vol IV. Annex III – Codes used to process the data

Code for the Mode A/C reply graph import pandas as pd import numpy as np import pyModeS as pms import simplekml import datetime as dt import time import os import matplotlib.pyplot as plt

dirname = os.path.dirname(os.path.abspath( file )) file = os.path.join(dirname, '20210110-05-TotalPKT.csv') dfPKT = pd.read_csv(file,names=['timestamp','RxId','msgtype','message','confir med','SNR','strength','DF','icao24','correctedBits','LowConf','freqOff st'], dtype={'timestamp': str, 'RxId': int, 'msgtype': int, 'message': str, 'confirmed': object, 'SNR': float, 'strength': float, 'DF': float, 'icao24': str, 'correctedBits': float, 'LowConf': float, 'freqOffst': float}) dfPKT["timestamp"] = dfPKT["timestamp"].str.replace('.', '').astype('int64') # del a["timestamp"] dfPKT.set_index(pd.DatetimeIndex(dfPKT["timestamp"]), drop=True, inplace=True) dfPKT=dfPKT.loc[dfPKT['msgtype']==2] dfPKT.rename_axis(index=None, columns=None,inplace=True) # This is useful to remove the 'timestamp' label on the index dfPKT.sort_index(inplace=True) # The altitude is expressed in meters

allminutes = dfPKT.index.floor('60S').unique() lastmin = allminutes[-1] firstmin = allminutes[1] print('Processing... The flight takes ' + str(lastmin - firstmin) + ' (HH:MM:SS)') minutestoplot=[] MAXOFMAX=[] for minute in allminutes: hour = minute.strftime('%H:%M') minutestoplot.append(hour) print('Processing... (' + str(minute.strftime("%H:%M")) + '/' + str(lastmin.strftime("%H:%M")) + ')')

# RATES MODEAC=0 allseconds = pd.date_range(minute, minute + pd.Timedelta(seconds=60), freq='S', closed='left') inallseconds=[] for second in allseconds: # for each second in the minute, messagesxsec = (dfPKT.loc[second:(second + pd.Timedelta(seconds=1))]) # these are the rates for each second inallseconds.append(len(messagesxsec)) MODEAC=max(inallseconds) MAXOFMAX.append(MODEAC) print(MODEAC) plt.plot(minutestoplot,MAXOFMAX) plt.ylabel('Max rate of Mode A/C replies') plt.xticks(minutestoplot[::5],rotation='30') plt.show() nametosave ='MODEAC16DEC.csv' print('Result saved in ' + nametosave) print("ModeAC.py finished.")

Code for the Mode S reply peak rates. import pandas as pd import numpy as np import pyModeS as pms import simplekml import datetime as dt import time import os

def createKMLpoint(hours, lat, long, alt, rates, second, doc): if rates == 0: return None else: pnt = doc.newpoint(name=str(rates), visibility=0) pnt.coords = [(long, lat, alt)] pnt.altitudemode = 'absolute' pnt.style.iconstyle.icon.href = "http://maps.google.com/mapfiles/kml/pal2/icon26.png" pnt.style.iconstyle.scale = 2 * (((rates + 20) / 90)) # this formula is to get the scale nice, is made up. pnt.description = "Is the maximum Rate at " + hours + ':' + second + "

Altitude:
" + str( round((alt / 0.3048))) + " feet."

if doc == doc21 or doc == doc20 or doc == doc16 or doc == docLong: if rates > 30: pnt.style.iconstyle.color = "FFCD3D01" elif rates > 20: pnt.style.iconstyle.color = "FFAB01AF" elif rates > 16: pnt.style.iconstyle.color = "FF0101F7" elif rates > 13: pnt.style.iconstyle.color = "FF0153F3" elif rates > 10: pnt.style.iconstyle.color = "FF3FD8EE" elif rates > 7: pnt.style.iconstyle.color = "FF7BE638" else: pnt.style.iconstyle.color = "FF5A9F28"

else: if rates > 80: pnt.style.iconstyle.color = "FFCD3D01" elif rates <= 80 and rates > 60: pnt.style.iconstyle.color = "FFAB01AF" elif rates <= 60 and rates > 50: pnt.style.iconstyle.color = "FF0101F7" elif rates <= 50 and rates > 40: pnt.style.iconstyle.color = "FF0153F3" elif rates <= 40 and rates > 30: pnt.style.iconstyle.color = "FF3FD8EE" elif rates <= 35 and rates > 20: pnt.style.iconstyle.color = "FF7BE638" else: pnt.style.iconstyle.color = "FF5A9F28" return pnt

dirname = os.path.dirname(os.path.abspath( file )) file = os.path.join(dirname, '20210110-05-TotalPKT.csv') dfPKT = pd.read_csv(file,names=['timestamp','RxId','msgtype','message','confir med','SNR','strength','DF','icao24','correctedBits','LowConf','freqOff st'], dtype={'timestamp': str, 'RxId': int, 'msgtype': int, 'message': str, 'confirmed': object, 'SNR': float, 'strength': float, 'DF': float, 'icao24': str, 'correctedBits': float, 'LowConf': float, 'freqOffst': float}) dfPKT["timestamp"] = dfPKT["timestamp"].str.replace('.', '').astype('int64') # del a["timestamp"] dfPKT.set_index(pd.DatetimeIndex(dfPKT["timestamp"]), drop=True, inplace=True) dfPKT=dfPKT.loc[(dfPKT['msgtype']==1) & (dfPKT['icao24']=='4CA2D7') & (dfPKT['confirmed']=='1')] dfPKT.rename_axis(index=None, columns=None,inplace=True) # This is useful to remove the 'timestamp' label on the index dfPKT.sort_index(inplace=True) print(dfPKT) # The altitude is expressed in meters

# Now we give positions: latitude = [] longitude = [] altitudes = [] msgEven = None msgOdd = None TimeOdd = 0.0 TimeEven = 0.0 for msg, index in zip(dfPKT["message"], dfPKT.index): if len(msg) == 28 and pms.df(msg) == 17 and 9 <= pms.adsb.typecode(msg) <= 22 and not pms.adsb.typecode( msg) == 19: if msgEven == None or msgOdd == None: if pms.hex2bin(msg)[53] == '1': # maybe duct to list or something msgOdd = msg TimeOdd = dt.datetime.timestamp(index) elif pms.hex2bin(msg)[53] == '0': msgEven = msg TimeEven = dt.datetime.timestamp(index)

latitude.append(np.nan) longitude.append(np.nan) altitudes.append(np.nan)

elif pms.hex2bin(msg)[53] == '1': msgOdd = msg TimeOdd = dt.datetime.timestamp(index) positions = (pms.adsb.airborne_position(msgEven, msgOdd, TimeEven, TimeOdd)) if positions == None or pms.adsb.altitude(msg) == None: # bds05 returns a None if the Lats (odd and even) are different. latitude.append(np.nan) longitude.append(np.nan) altitudes.append(np.nan) else: altitudes.append(pms.adsb.altitude(msg)) latitude.append(positions[0]) longitude.append(positions[1])

elif pms.hex2bin(msg)[53] == '0': msgEven = msg TimeEven = dt.datetime.timestamp(index) positions = (pms.adsb.airborne_position(msgEven, msgOdd, TimeEven, TimeOdd)) if positions == None or pms.adsb.altitude(msg) == None: # bds05 returns a None if the Lats (odd and even) are different. latitude.append(np.nan) longitude.append(np.nan) altitudes.append(np.nan) else: altitudes.append(pms.adsb.altitude(msg)) latitude.append(positions[0]) longitude.append(positions[1])

else: latitude.append(np.nan) longitude.append(np.nan) altitudes.append(np.nan) dfPKT["latitude"] = latitude dfPKT["longitude"] = longitude dfPKT["altitudes"] = altitudes

# this replaces the NaN with positions in the whole dataset dfPKT["latitude"].fillna(method='ffill', inplace=True) dfPKT["latitude"].fillna(method='bfill', inplace=True) dfPKT["longitude"].fillna(method='ffill', inplace=True) dfPKT["longitude"].fillna(method='bfill', inplace=True) dfPKT["altitudes"].fillna(method='ffill', inplace=True) dfPKT["altitudes"].fillna(method='bfill', inplace=True) dfPKT.to_csv('Analysiswithpositions.csv') kml = simplekml.Kml() allminutes = dfPKT.index.floor('60S').unique() # We create the folders and documents global doc16, doc20, doc21, docLong fol = kml.newfolder(name='Downlink Formats') doc0 = fol.newdocument(name="DF0") doc4 = fol.newdocument(name="DF4") doc5 = fol.newdocument(name="DF5") doc11 = fol.newdocument(name="DF11") doc16 = fol.newdocument(name="DF16") doc17 = fol.newdocument(name="DF17") doc20 = fol.newdocument(name="DF20") doc21 = fol.newdocument(name="DF21") folTCAS = kml.newfolder(name="TCAS") docTCAS = folTCAS.newdocument(name="TCAS") folADSB = kml.newfolder(name="ADSB") docADSB = folADSB.newdocument(name="ADSB") folNOTADSB = kml.newfolder(name="Total(w/o ADS-B)") docNOTADSB = folNOTADSB.newdocument(name="Total (w/o ADS-B)") folNOTSQUITTER = kml.newfolder(name="Air-Ground") docNOTSQUITTER = folNOTSQUITTER.newdocument(name="Air-Ground") folLONG = kml.newfolder(name='LongDF') docLong = folLONG.newdocument(name="Long (w/o ADS-B)") lastmin = allminutes[-1] firstmin = allminutes[1] print('Processing... The flight takes ' + str(lastmin - firstmin) + ' (HH:MM:SS)') for minute in allminutes: # first 12 points every minute has. latitudes = dfPKT["latitude"].loc[ ((dfPKT.index) > minute) & ((dfPKT.index) < (minute + pd.Timedelta(seconds=60)))].median() longitudes = (dfPKT["longitude"].loc[ ((dfPKT.index) > minute) & ((dfPKT.index) < (minute + pd.Timedelta(seconds=60)))]).median() altitudes = ((dfPKT["altitudes"].loc[((dfPKT.index) > minute) & ( (dfPKT.index) < (minute + pd.Timedelta(seconds=60)))]).median() * 0.3048) # in meters hour = minute.strftime('%H:%M') print('Processing... (' + str(minute.strftime("%H:%M")) + '/' + str(lastmin.strftime("%H:%M")) + ')')

# RATES DF0max = 0 DF4max = 0 DF5max = 0 DF11max = 0 DF16max = 0 DF17max = 0 DF20max = 0 DF21max = 0 TCAS = 0 NOTADSB = 0 NOTSQUITTER = 0 LONG = 0

# Secondsofrates DF0index = '' DF4index = '' DF5index = '' DF11index = '' DF16index = '' DF17index = '' DF20index = '' DF21index = '' TCASindex = '' NOTADSBindex = '' NOTSQUITTERindex = '' LONGindex = ''

allseconds = pd.date_range(minute, minute + pd.Timedelta(seconds=60), freq='S', closed='left') for second in allseconds: # for each second in the minute, messagesxsec = (dfPKT.loc[second:(second + pd.Timedelta(seconds=1))]) # these are the rates for each second DF0 = len(messagesxsec.loc[messagesxsec["DF"] == 0]) DF4 = len(messagesxsec.loc[messagesxsec["DF"] == 4]) DF5 = len(messagesxsec.loc[messagesxsec["DF"] == 5]) DF11 = len(messagesxsec.loc[messagesxsec["DF"] == 11]) DF16 = len(messagesxsec.loc[messagesxsec["DF"] == 16]) DF17 = len(messagesxsec.loc[messagesxsec["DF"] == 17]) DF20 = len(messagesxsec.loc[messagesxsec["DF"] == 20]) DF21 = len(messagesxsec.loc[messagesxsec["DF"] == 21])

if DF0 > DF0max: DF0max = DF0 DF0index = second.strftime("%S")

if DF4 > DF4max: DF4max = DF4 DF4index = second.strftime("%S")

if DF5 > DF5max: DF5max = DF5 DF5index = second.strftime("%S")

if DF11 > DF11max: DF11max = DF11 DF11index = second.strftime("%S")

if DF16 > DF16max: DF16max = DF16 DF16index = second.strftime("%S")

if DF17 > DF17max: DF17max = DF17 DF17index = second.strftime("%S")

if DF20 > DF20max: DF20max = DF20 DF20index = second.strftime("%S")

if DF21 > DF21max: DF21max = DF21 DF21index = second.strftime("%S")

if (DF0 + DF16 > TCAS): TCAS = DF0 + DF16 TCASindex = second.strftime("%S")

if (DF0 + DF4 + DF5 + DF11 + DF16 + DF20 + DF21 > NOTADSB): NOTADSB = DF0 + DF4 + DF5 + DF11 + DF16 + DF20 + DF21 NOTADSBindex = second.strftime("%S")

if (DF4 + DF5 + DF11 + DF20 + DF21 > NOTSQUITTER): NOTSQUITTER = DF4 + DF5 + DF11 + DF20 + DF21 NOTSQUITTERindex = second.strftime("%S")

if (DF16 + DF20 + DF21 > LONG): LONG = DF16 + DF20 + DF21 LONGindex = second.strftime("%S")

ADSB = DF17max ADSBindex = DF17index

# it could give an error puting the index as an int not as a str createKMLpoint(hour, latitudes, longitudes, altitudes, DF0max, str(DF0index), doc0) createKMLpoint(hour, latitudes, longitudes, altitudes, DF4max, str(DF4index), doc4) createKMLpoint(hour, latitudes, longitudes, altitudes, DF5max, str(DF5index), doc5) createKMLpoint(hour, latitudes, longitudes, altitudes, DF11max, str(DF11index), doc11) createKMLpoint(hour, latitudes, longitudes, altitudes, DF16max, str(DF16index), doc16) createKMLpoint(hour, latitudes, longitudes, altitudes, DF17max, str(DF17index), doc17) createKMLpoint(hour, latitudes, longitudes, altitudes, DF20max, str(DF20index), doc20) createKMLpoint(hour, latitudes, longitudes, altitudes, DF21max, str(DF21index), doc21) createKMLpoint(hour, latitudes, longitudes, altitudes, LONG, str(LONGindex), docLong) createKMLpoint(hour, latitudes, longitudes, altitudes, TCAS, str(TCASindex), docTCAS) createKMLpoint(hour, latitudes, longitudes, altitudes, ADSB, str(ADSBindex), docADSB) createKMLpoint(hour, latitudes, longitudes, altitudes, NOTADSB, str(NOTADSBindex), docNOTADSB) createKMLpoint(hour, latitudes, longitudes, altitudes, NOTSQUITTER, str(NOTSQUITTERindex), docNOTSQUITTER) nametosave ='ThesisFlight10jan.kml' kml.save(nametosave) print('Result saved in ' + nametosave) print("PKTtoKML.py finished.") Code to get the Interrogator Code from the Parity Check def interrogatorcode(msg): try: if pms.common.df(msg) == 11: # check that the msg is DF11 '''Returns the IC/II code of the Mode S all-call reply (DF11)''' binaryraw = pms.common.hex2bin(msg) PI = binaryraw[-24:] DATA = binaryraw[:-24]

Gx = '1111111111111010000001001000' Mx = DATA[::-1].zfill(len(DATA) + 24)[::-1] Gx = Gx[::-1].zfill(len(Mx))[::-1] while len(Mx) > 24: # since Mx will be divided by the parity. Before it was len(Mx)>initialdifference. MSB = Mx[0] if MSB == '1': result = int(Mx, 2) ^ int(Gx, 2) Mx = str(bin(result)[2:]) Gx = Gx.rstrip('0')[::-1].zfill(len(Mx))[::-1]

else: # If the Mx starts with a 0 Mx = Mx[1:] Gx = Gx[:-1]

SIcode = bin(int(Mx, 2) ^ int(PI, 2))[2:].zfill(7) # Mx is the parity sequence and PI is the last field of the DF11. if int(SIcode[0:3], 2) > 0: if int(SIcode, 2) - 16<63: return str("SI" + str(int(SIcode, 2) - 16)) else: print("SI" + str(int(SIcode, 2) - 16) + " is a non existing SI code.") print(msg) raise NameError("Corrupted message: " + str(msg)) else:

if int(SIcode, 2)<16: return str("II" + str(int(SIcode, 2))) else: print("II" + str(int(SIcode, 2)) + " is a non existing II code." ) print(msg) raise NameError("Corrupted message: " + str(msg)) except:

raise RuntimeError("Incorrect or inconsistent message types") Annex IV – Avionix openAir Duo

running full. Depending on the location it is est+mated that a month of message data and a week or RF data is buffered on the disk. it is possible to access the storage data over network vfa SFTP.

2.3 Receiver Description

Mechanical character sttcs

oinenoons weight

2.3.1 Front panel

F i gu e 3 - Rec e ive r un it i fio n t view *

Item

Po'wr button owe Url mL L . pool o i , us. po'w'er on. r iasi ing. wer ouwn in progress G l“b inpuI F'S antenna connector [SMA IernaJej IUSU rnpul IU'JtJ MNz signal connec1or \N-rype lemale j IiJJU rnpu US ixir1z signal connectur \zs- rype female j

we uesc u‹iui i ir I M u peel

rseo LbU. F’ufse iur n iessage on i uuU nil-tz

bed LLL+, F'ulse for message oi i I UAU MI-Iz green LLu - ucea0y UN. all LiK, STATUS SW Flashing: problem will software module

Yellow LfiU - LF'> pulse-per-second

oiue Lr-u - ulacon is connected to nerworx green Lr-Lt - ‹eao\' on. a4 w , STATUS HH'’ Flashing: problem wifh hardware module

Diue LLu - L1UU accivi ’

TsbJe 1 — F to n t p a net d+s c rigti on

2.3.2 Rear panel

F i gu re d — R ece i Y'er u nit If ac I vte w )

Item Uescr‹ption

Izv oe ecu connector

r-we me m conneczon i v-so jacxj

USD ins, e g. for mouse Nov NJ Sn max, ie nux sinJuiwneous r-nnni1Jg point

Ta hte x — Rea r pa ne I Ue s crfpion

2.3.3 Side panel

Figs re 5 - R ecerv er +Jn i I (s*de view]

Item LJescnpton

warm ouipui n maintenance access

Tzb ie 3 — 5 ide panel des cripflan

Receiver Unit

PJgiJ r e 3 - Rece iver unit

Al- charactensttcs Inpu‹ zensiuviry -uodbm ‹uulvnuni pose ‹ipu I u Obm Impedance GUIL I-requency I UJUMNz and I UOUMNz I-Iecuical sha ac‹eiisucs

Input vo!‹oge

F'o'w'er consumpuon lY4UCf Jfin1M) CN UW C T Ur1S l*W is male ter ›npulj Connector \ype SMA male fGPS input) v›’eqh\ I.6 rg Le‹igth / width / Weight I z. I cm /1 6.mcm / dcm working ‹enipelature U — ou ‘

Annex V – SPI-IR Regulation

L 305}36 Official Journal of the European Union 2 3.11.2011

(14) This Rcgulation should not cover military operations and (c) surveihance data processing sF stems, their constituents and training as referred in Article 1(2) of Regulation (£C) No associated procedures; 5 49}2004.

(d) ground-to-ground communications systems uscd for distribution of surveillance data, their constituents and With a view to maintaining or enhancing existing safely associated procedures. levels of operations, Member States should be required to ensure that the parties concerned carry out a safety assessment including hazard identification, risk assessment 2. This Regulation shall apply to all flights operating as and mitigation processes. Harmonised imple- mentation of general air trafhc in accordance with insttument flight rules these processes to the systems covered by this Regulation within the airspace provided for in Article 1(3) of Regulation requires the identification of specific safety requirements (bC) No 551}2(l04 of the European Parliament and of the for a]l interoperability and performance requirements. Council (') with the exception of Articles 7(3) and 7(4) which shall apply to all flights operating as general air trafhc.

(**) In accordance with Regulation (EC) No 552/2004, imple- 3. This Regulation shall apply to air traffic service providers menting rules for interoperability should describe the which provide air traffic control services based on surveillance specific conformity assessment procedures to be used to data, and to communication, navigation or surveillance service assess either the conformity or the suitability for use of providers which operate systems laid down in paragraph 1. constituents as well as the verification of systems.

(17) In the case of air traffic services provided primarily to

aircraft flying as general air tra&c under military super- vision, procuwment constraints could prevent For the purpose of this Regulation, the definitions in Article 2 compGance witb tab RcgtJaGon. of Regulation (£C) No 549}2004 shall apply.

(18) The measures provided for in this Regulation arc in The following definitioris shah also apply accordance with the opinion of the Single Sky Committee, (1) ’surveillance data’ means any data item, time stamped or not, within the surveillance system that pertains to:

HAS ADOFTED THIS REGULATION: (a) aircraft 2D position;

(b) aircraft vertical position; Subject matter

This Regulation lays down reqttirements on the systems contributing to the provision of surveillance data, their (c) aircraft attitude; constituents and associated procedures in order to ensure the harmonisation of performance, the interoperability and the effi- ciency of these systems within the European air traffic (d) aircraft identity management network (EATMN) and for the purpose of civil-

(e) 24-bit ICAO aircraft address;

(I) aircraft intent: Scope 1. This Regulation shall apply to the surveillance chain constituted of: (g) aircraft velocity;

(h) aircraft acceleration: (a) aébome surveillance systems, their constituents and associated procedures; (2) ‘operator’ means a person, organisation or enterprise engaged in or offering to engage in an aircraft operation; (b) ground-based suryeillance systems, their constituents and associated procedures: (') OJ L 96, 31.3.2004, p. 20.

23.11.2011 Official Journal of the European Union L 30S{5 7

(5) ‘ADS-B' means automatic dependent surveillance — (l 5) ‘accuracy means the degree of conformity of the provided broadcast, a surveillance technique in which aircraft auto- value of a data item with its actual value at the ttme when matically provide, via a data link, data derived from on- the data item is output from the surveillance chain; board navigation and position-fixing systems:

(4) ‘ADS-B Out’ means the provision of ADS-B surveillance (16) ‘availability’ means the degree to which a system or data from an aircraft transmit perspecnve: component is operational and accessible when required for use:

('i) ‘harmM interference’ means interference that prevents the achievement of thc performance requirements; (17) ‘integrity’ means the degree of undetected (at system level) non-conformity of the input value of the data item with its output value: (6) ‘surveillance chain’ means a system composed of the aggregation of airborne and ground-based constituents used to determine the respective surveillance data items of aircraft, including the surveillance data processing system, if deployed; (18) ‘continuity’ means the probability that a system will perform its required function without unscheduled inter- ruption, assuming that the system is available at the initiation of the intended operation: (7) ‘cooperative surveillance chain’ means a surveillance chain requiring both ground and airborne components to determine surveillance data items*

‘timeliness’ mearis the difference between the time of output of a data item and the time of applicabiliy of that (8) ‘surveillance data processing system’ means a system that data item. processes all surveillance inputs received to form a best

estimate of the current aircraft surveillance data•

Artirk' 4 (9) ‘aircrafi identification' means a group of letters, figures or a combination thereof which is either identical to, or the Performance regtziremenEs coded equivalent of, the aircraft call sign to be used in air- to-ground communications, and which is used to identify 1. Air navigation service providers shall ensure seamless the aircraft in ground-to-ground air traffic services operations within the airspace under their responsibility and at communications; the boundary with adjacent airspaces by applying appropriate minimum requirements for the separation of aircraft.

‘State aircraft means any aircraft used for military, customs and police pwposes; 2. Air navigation service providers shall ensure that systems referred to in points (b), (c) and (d) of Article 2(1) are deployed as necessary to support the minimum requirements for the separation of aircrak applied in accordance with paragraph 1. Transport type Statc aircraft’ means fixed wing State aircraft that are deigned for the purpose of transporting persons and{or cargo;

3. Air navigation service Froviderx xhall ensure that the (12) ‘extrapolate’ means to project, predict or extend know output of the suryeillance chain referred to in Article 2{1)

data based upon values an already observed time complies with the performance requirements set out in Annex interval; I provided that the airborne constituent functions used are compliant with the requirements set out in Annex II.

‘coasted’ means extrapolated for a period longer than the ground surveillance systems update period; 4. If an air navigation service provider identifies an aircraft whose avionics exhibit a functional anomaly, he shall inform the operator of the flight of the deviation from the performance (14) ‘time of applicability’ means the time at which the data requirements. The operator shall investigate the matter before the item has been measured by the surveillance chain or the next flight is initiated and any rectification necessary shall be time for which it has been calculated by the surveillance introduced in line with normal maintenance and corrective chain: procedures for the aircraft and its avionics.

Official Journal of the European Union 23.11.201 1

8 January 2015, are equipped with secondary surveillance radar transpondeis having the capabilities set out in Part A Interoperability requirements of Annex II; I. Air navigation service providers shall ensure that all surveillance data transferred from their systems identified in points (b) and (c) of Article 2(1) to other navigation service aircraft with a maximum certified take-off mass exceeding providers comphes with the requirements set out in Annex III. $ 700 kg or having a maximum cruising true airspeed capa- bility greater than 250 knots, operating flights referred to in Article 2(2), with an individual certificate of airworthiness 2. Air navigation service providers when transferring first issued before 8 January 201a arc equipped with surveillance data from their systems identified in points (b) and secondary surveillance radar transponders having, in (c) of Article 2(1) to other air navigation service providers, shall addition to the capabilities set out in Part A of Annex II, the establish formal arrangements with them for the exchange of the capabilities set out in Part B of that Annex; data in accordance with the requirements set out in Annex IV.

(c) fixed wing aircraft with a maximum certified take-off mass 3. Air navigation service providers shall ensure that, by exceeding 5 7 00 kg or having a maximttm cruising true 2 January 2020 at the latest, the cooperative surveJlance chain airspeed capability greater than 250 knots, operating flights has the necessary capability to allow them to establish referred to in Article 2(2), with an individual certificate of individual aircraft identification using do slinked aircraft identi- airworthiness first issued before 8 January 2015 are fication made available bar aircraft equipped in accordance with equipped with secondary surveillance radar trans- ponders Annex II. having, in addition to the capabilities set out in Part A of Annex II, the capabilities set out ki Part C of that Annex

4. Operators shall ensure that: 6. Operators shall ensure that aircraft equipped in accordance with paragraphs 4 and S and having a maximum certified take- off mass exceeding S 700 kg or having a maximum cruising (a) aircraft operating flights referred to in Articlc 2(2) with an true airspeed capability greater than 250 knots operate with individual cemficate of airworthiness first issued on or after antenna diversity as prescribed in paragraph 3.1.2.10.4 of 8 {anuary 2015 are equipped with secondary surveillance Annex 10 to the Chicago Convention, Volume IV, Fourth radar oansponders having the capabilities set out in Part A Edition including all amendments up to No 85. of Annex II;

Z. Member States may impose carriage requirements in accordance (b) aircraft with a maximum certified take-off mass exceeding 3 with point {b) of paragraph 4 and point (b) of paragraph S to all ZOO kg or having a maximum cruising true airspeed capa aircraft operating flights referred to in Article 2{2) in areas bility greater than 2§0 knots, operafing flights referred to in where surveillance services using the surveillance data Article 2(2), with an individual certificate of airworthiness identified in Part B of Annex II are provided by air navigation first issued on or after 8 January 2015 are equipped with service providers. secondary surveillance radar transponders having, in addition to the capabilities set out in Part A of Annex II, the capabilities set out or Part B of that Annex: 8. Air navigation service providers shall ensure that, before putting into service the systems referred to in points (b), (c) and (d) of Article 2(1), they are implementing the most efficient (c) fined wing aircraft with a maximum certified take-off mass deployment solutions taking into account the local operating exceeding â 700 kg or having a maximum cruising true environments, constraints and needs as well as airspace users airspeed capability greater than 2 $0 knots, operating flights capabilities. referred to in Article 2(2), with an individual certificate of airworthiness first issued on or after 8 {aniiary 201§ are equipped with secondary surveillance radar transponders having, in addition to the capabilities set out in Article 6 Part A of Annex II, the capabilities set out in Part C of that Spectrum protection Annex. 1. By S February 2015 at the latest Member States shall ensure that a secondary surveillance radar transponder on board any aircraft frying over a Member State is not subject to $. Operators shall ensure that by 7 December 2017 at the excessive interrogations that are transmitted by ground-based latest: surveillance interrogators and which either elicit replies or whilst not eliciting a reply are of sufficient power to exceed the minimum threshold level of the receiver of the secondary (a) aircraft operating flights referred to in Article 2(2), with an surveillance radar transponder. individual certificate of airworthiness first issued before

23.11.2011 EQN Official Journal of the European Union L 305}39

2. for the purpose of paragraph 1, the sum of such inter- Article 2(2) are equipped with secondary surveillance radar rogations shall not cause the secondary surveillance radar trans- transponders having the capability set out in Part A of Annex II. ponder to exceed the rates of reply per second, excluding any squitter transmissions, specified in paragraph 3.1.1.7. 9.1 for Mode ABC replies and in paragraph 3.1.2.10.3.7. 3 for Mode S replies of Annex 10 to the Chicago Convention, Volume IV, Fourth 2. Member States shall ensure that, by 1 January 2019 at the Edition, latest, transport-type State aircraft with a maximum certified take-off mass exceeding 5 700 kg or having a maximum cruising tme airspeed capability greater than 2 S0 knots, operating in accordance with Article 2{2) are equipped with secondary 3. By S February 201 S at the latest Member States shall surveillance radar transponders having in addition to the ensure that the use of a gmund based transmitter operated in a capability set out in Part A of Annex II, the capability set out Member State does not produce harmful interference on other in Part B and Part C of that Annex. surveillance systems.

4. In the event of disagreement between Member States 3. Member States shall communicate to the Commission by 1 regarding the measures detailed in paragraphs l and 3 the July 2016 at the latest the list of State aircraft that cannot be Member States concerned shall bring the matter to the equipped with secondary surveillance radar transponder that Commission for action. comply with the requirements set out in Part A of Annex II, together with the justification for non-equipage.

Amrlc/ AssocxedpmeAres Member States shall communicate to the Commission by 1 July 2018 at the latest the list of transport-type State aircraft with a 1. Aé navigation service providers shall assess the level of maximum certified take-off mass exceeding 5 700 kg or having performance of ground based surveillance chain before putting a maximum cruising true airspeed capability greater than 250 them into service as well as regularly during the service, in knots, that cannot be equipped with secondary surveillance radar accordance with the requirements set out in Annex V. transponders that comply with the requirements set out in Part B and Part C of Annex II, together with the justification for non- eqiiipage.

2. Operators shall ensure that a check is performed at least every two years, and, whenever an anomaly is detected on a specific aircraft, so that the data items set out in point 3 of Part A of Annex Il, in point 3 of Part B of Annex II and in point 2 of The justification for non-equipage shall be one of the following: Part C of Annex II, if applicable, are correctly provided at the output of secondary surveillance radar transponders installed on board their aircraft. If any of the data items are not correctly provided then the operator shall investigate the matter before the next flight (a) compelling technical reasons: is iniaated and any rectification necessary shall be introduced in line with normal maintenance and corrective procedures for the aircraft and its avionics. (b) State aircraft operating in accordance with Article 2(2) that will be out of operational service by l sanitary 2020 at the latest;

3. Member States shall ensure that the assignment of 24-bit ICAO aircraft addresses to aircraft equipped with a Mode S transponder complies with Chapter 9 and its appendis of Annex (c) procurement constraints. 10 to the Chicago Convention, Volume III, Second Edition including all amendments up to No 8S.

4. Where State aircraft cannot be equipped with secondary 4. Operators shall ensure that on board the aircraft they are surveillance radar transponders as specified by paragraphs 1 or 2 operating, any Mode. S transponder operates with a 24-bit ICAO for the reason set out in point (c) of paragraph I Member States aircraft address that corresponds to the registration that has been shall include in the justification their procurement plans assigned by the State in which the aircraft is registered. regarding these aircraft.

5. Air traffic service providers shall ensure that the State aircraft identified in paragraph 3 can be accommodated, provided that they can be safely handled within the capacity of the air 1. Member States shall ensure that, by 7 December 2017 at trafhc management system. the latest, State airnaft opemting in accordance with

L 305J40 Official Journal of the European Union 23.1I.20J I

6. Member States shall publish the procedures for the Annex VIII shall conduct a verification of the systems referred handling of State aircrafi which are not equipped in accordance to in points (b), (c) and (d) of Article 2(1) in compliance with with paragraphs 1 or 2 in national aeronautical information the requirements set out in Part A of Annex IN publications.

2. Air navigation service providers which cannot demon- 7. Air traffic service providers shall communicate on an strate that they fulfil the conditions set out in Arinex VIII shall annual basis to the Member State that has designated them their subcontract to a notified body a verification of the systems plans for the handling of Sute aircraft which are not equipped referred to in points (b), (c) and {d) of Article 2(1). This according with paragraphs 1 or 2. Those plans shall be defined verification shall be conducted in compliance with the by taking into account the capacity limits associated with the requirements set out in Part B of Annex IX. procedures referred to in paragraph 6.

Ankle 9 3. Certification processes complying with Regulation (EC) No 216}2008 shall be considered as acceptable procedures for the Salt 7eqwiremeaM verificafion of systems if they include the demonsmtion of compliance with the applicable interoperability, performance 1. Member states shall ensure that, by 5 February 2015 at the and safety re9uirements of this Regulation. latest, a safety assessment is conducted by the parties concerned for all existing systems referred to in points (b), (c) and (d) of Article 2(1).

AddiDonal requirements 2. Member States shall ensure that any changes to the existing systems referred to in points (b), (c) and (d) of Article 1. Air navigation service providers shall ensure that all 2{1) or the introduction of new systems are preceded by a safety personnel concerned are made duly aware of the requirements assessment, including hazard idennfication, risk assessment and laid down in this Regulatioii and that they are adequately trained mitigation, conducted by the parties concerned. for their job functions.

3. During the assessments identified in paragraphs 1 and 2, 2. Air navigation service providers shall: the requirements set out in Annex VI shall be taken into consideration as a mind

(a) develop and maintain operations manuals containing the necessary instructions and information to enable all Arficle 10 personnel concerned tn apply this Regulation; Conformity or suitabifity for use of constituents Before issuing an EC declaration of conformity or suitability for use prnvided in Article I of Regulation (EC) No 552{2004, (b) ensure that the manuals referred to in point {a) are manufacturers of constituents of the systems referred to in accessible and kept up to date and that their update and Article 2(1) of this Regulation or their authorised represenmlives distribution are subject tn appropriate quafity and documen- esiablished in the Union, shall assess the conformity or suit- tation configuration management; abiliy for use of those constituents in compliance with the requirements set out in Annex VII.

(c) ensure that the working methods and operating procedures comply with this Regulation. However, certification processes complying with Regulation (IiC) No 2l6{2008 of the Europcan Parliament and of the Council {'), shall be considered as acceptable procedures for the conformity assessment of constituents if they include the 3. Operators shall take the necessary measures to ensure that demonstration of compliance with the applicable interoper- the personnel operating and maintaining surveillance equipment ahility, performance and safery requirements of this Regulation. are made duly aware of the relevant provisions of this Regu- lation, that they are adequately trained for their job functions, and that instructions about how to use this equipment are available in the cockpit where feasible. Artifle 11

Verification of systems 1. Air navigation service providers which can demonstrate or 4. Member States shall ensure compliance with this Regu- have demonstratcd that they fulfil the conditions set out in lation including the pubhcation of the relevant information on surveillance equipment in the national aeronautical information (‘) O| L 79, 19.3.2008, p. I. publications.

23.1 I.2011 Official Journal of the European Union L 305{4l

Article 13 3. The Member States concerned shall communicate to the Commission by l July 2017 at the latest, detailed informafion Exemptions on the cooperative surveillance chain justifying the need for granting exemptions to these specific 1. For the specific case of approach areas where air traffic aircraft types based on the criteria of paragraph 5. services are provided by military units or under military super- vision and when procurement constraints prevent compliance with Article 5(3J, Member States shall commuriicate to the 4. The Commission shall examine the requests for exemption Commission by 31 December 2017 at the latest, the date of referred to in paragraph 3, and, following consultation with the compliance of the cooperative surveJlance chain that shall not parties concerned, shall adopt a decision. be later than 2 January 202S.

2. Following consultation with the Network Manager and 5. The criteria referred to in paragraph 3 shall include the not later than 31 December 2018, the Commission may review following: the exemptions communicated under paragraph 1 that could have a significant impact on the EATMN. (a) specific aircraft types reaching the end of their production life:

Exemptions on aircraft (b) specific aircraft types being produced in limited numbers; 1. Aircraft of specific types with a flxst certificate of airworthiness issued before 8 January 201S that have a maximum take off mass exceeding 5 700 kg or a maximum cruising true airspeed greater than 250 knots that do not have (c) disproportionate ze-engineering costs. the complete set of parameters detailed in Part C of Annex II available on a digital bus on-board the aircraft may be exempted from complying with the requirements of point (c)

Entry into force and applicanon This Regulation shall enter into force on the .20th day following 2. Aircraft of specific types with a first certificate of its publication in the OQcinl Journal o/ the European Union. airworthiness issued before 1 January 1990 that have a maximum take off mass exceeding 5 700 kg or a maximum cruising true airspeed greater than 2 J0 knots may be exempted from complying with the requirements of Article 5(fi). Article 4, Article 5{1) and (2} and Artide 7(1) shall apply from 13 December 2013.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 22 November 2011.

For tite Commission

José Manuel BARROSO