Air traffic radar: primary and secondary, modes A, C and S, garble and FRUIT, ADS-B, multilateration and IFF

European skies see tens of thousands of flights every day, and each one is followed at every instant by the control centres. The main tool is not a “classic” radar listening to echoes, but a cooperative system: the radar interrogates the aircraft, and an on-board device, the transponder, replies with its identity and altitude. This lesson describes air traffic surveillance systems: primary and secondary radar, modes A, C and S, the problems of overlapping (synchronous) and unwanted (asynchronous) replies, automatic surveillance with ADS-B, multilateration and military IFF identification. The code decodes a real ADS-B message and computes a position by multilateration.

The idea in simple words

An ordinary radar is like someone searching for a person in the dark with a torch: they see whoever is lit, but do not know who it is. Air traffic control instead uses a system closer to a phone call: the radar “calls” (interrogates) and each aircraft “answers” with a message containing who it is and at what altitude it is flying. The on-board device that answers is called a transponder. Since the reply is a signal transmitted by the aircraft, and not a faint echo, it arrives strong even from far away.

Difficulties arise when there are many aircraft: two replies may overlap, an aircraft also answers the calls of other radars, and the system must sort everything out. Mode S (each aircraft has a personal address, like a phone number) and ADS-B (the aircraft broadcasts its own GPS position) have solved many of these problems.

Primary and secondary radar

The primary radar (PSR) is an ordinary radar: it receives the echo reflected by the airframe. It sees any object, even non-cooperative ones (an aircraft with a failed transponder, a drone, a flock of birds), but does not know who it is nor at what altitude it flies (unless it also has an elevation beam). Airports have primary approach radars in S band, with a range of 50-60 nautical miles and an antenna turn every 4-5 seconds; en-route radars, in L band, reach 200-250 miles with a turn every 10-12 seconds.

The secondary surveillance radar (SSR) transmits an interrogation at 1030 MHz; the aircraft transponder replies at 1090 MHz. Decisive advantages:

• the reply is generated by the aircraft, so the received power falls as and not as : much lower powers suffice for longer ranges;
• different frequencies on the way out and back: no clutter, no ground echoes;
• the reply contains information: identity and altitude.

The secondary antenna is usually mounted on top of the primary one and rotates with it, and the data of the two are combined.

Modes A and C

The interrogation consists of two pulses, P1 and P3, whose spacing says what is being asked: 8 μs for mode A (identity), 21 μs for mode C (altitude). The reply is delimited by two framing pulses, F1 and F2, 20.3 μs apart, with up to 12 code pulses in between at 1.45 μs intervals: combinations.

• Mode A: the four-digit octal identity code (from 0000 to 7777), assigned by the controller to the pilot (the “squawk”). Some codes are reserved: 7500 hijacking, 7600 radio failure, 7700 emergency.
• Mode C: the barometric altitude, in 100-foot steps (Gillham code), read directly from the altimeter.

Sidelobe suppression. The radar antenna has sidelobes: a nearby aircraft could receive the interrogation through a sidelobe and reply, appearing in a wrong direction. To avoid this the radar transmits a pulse P2, 2 μs after P1, with an omnidirectional antenna: if the aircraft receives P2 stronger than P1, it knows it is not in the main beam and does not reply.

Synchronous and asynchronous replies: garble and FRUIT

The A/C system has two defects, linked precisely to the distinction between synchronous and asynchronous.

• Synchronous garble: two aircraft in the same beam, at ranges from the radar that differ by less than the length of a reply, answer the same interrogation and their replies overlap in time. The reply lasts 20.3 μs, which corresponds to a range difference of km (about 1.6 nautical miles): two aircraft closer than this, seen in the same direction, produce a garbled reply, with codes that mix. It is frequent in holding areas near airports.
• FRUIT (false replies unsynchronized in time): a transponder answers all the radars that interrogate it. The radar therefore also receives the replies to other radars, which are not synchronised with its interrogations: they arrive at random instants and look like targets at random ranges. The remedy is the defruiter: a true reply appears at the same range in successive interrogations, an asynchronous reply does not; comparing several interrogations, uncorrelated replies are discarded.

Mode S

Mode S (selective, from the 1990s) solves both problems at the root. Each aircraft has a unique 24-bit address (the ICAO address, over 16 million values, assigned by the State of registration). The radar can interrogate one aircraft at a time, by address: no overlapping replies and far fewer unnecessary replies. The replies are digital messages of 56 or 112 bits at 1 Mbit/s, pulse-position modulated, protected by a 24-bit CRC check code (added to the address, so that a message for another aircraft gives a wrong check). Mode S also carries data: flight identification, altitude in 25-foot steps, heading, speed, pilot intentions. It is the basis of the on-board collision avoidance system (TCAS/ACAS), which interrogates the transponders of nearby aircraft and advises coordinated climb or descent manoeuvres.

ADS-B: the aircraft that says where it is

With ADS-B (automatic dependent surveillance, broadcast) the aircraft does not wait to be interrogated: it spontaneously transmits, about twice a second, its own GNSS position, altitude, velocity and identification, with extended mode S messages (1090ES, DF17 format of 112 bits). Anyone with a 1090 MHz receiver can receive them: this is how the websites showing flights in real time work, fed by thousands of amateur receivers. The surveillance is “dependent” because the position comes from the on-board navigation, not from a radar measurement: this is why ADS-B complements radars but does not replace them completely, and the declared position is verified with independent measurements.

The DF17 message: 5 bits of format (17), 3 bits of capability, 24 bits of ICAO address, 56 bits of data (whose first field, the “type code”, says the type: 1-4 identification, 9-18 airborne position, 19 velocity) and 24 bits of parity. The position uses a compact encoding (CPR) with two alternating types of messages, even and odd, which must be combined.

The code below decodes the example message 8D4840D6202CC371C32CE0576098, widely used in ADS-B documentation: the CRC check gives a zero remainder (intact message), format 17, ICAO address 4840D6, type code 4 (identification), and the 6-bit characters of the identification give KLM1023. Changing a single bit, the CRC remainder is no longer zero: the message would be discarded.

Multilateration

Multilateration (MLAT, or WAM, wide area multilateration, over large areas) locates an aircraft without a rotating radar: several ground stations, precisely synchronised (with GNSS), receive the same transponder reply and measure its time of arrival. The time difference of arrival between two stations defines a hyperbola (in three dimensions, a hyperboloid) on which the aircraft lies; with four or more stations the hyperbolas intersect at a point. It works with any transponder (even without ADS-B), and also serves to verify the position declared by ADS-B. With a synchronisation and measurement error of 20 ns (6 m of path), four stations at the corners of a 40 km square locate an aircraft with an error of a few metres (2.4 m in the simulation of the code below; over 500 repetitions with different noise the mean error is 5.4 m, and in 95 % of cases it stays below 11 m).

IFF: friend or foe

Military IFF (identification friend or foe) uses the same principle and the same frequencies as the secondary radar, with its own modes:

• modes 1 and 2: mission and identity codes of the military aircraft;
• mode 3/A: coincides with civil mode A, for integration into air traffic;
• mode 4 (now replaced) and mode 5: encrypted replies. A friendly aircraft answers correctly only if it knows the keys of the day; an aircraft that does not answer or answers wrongly is not a “friend”. Mode 5 is based on the mode S format and can include the GNSS position.

Encryption is essential: an IFF without authentication could be imitated by an adversary. The details of the encrypted modes are not public; the principles described here are those of the open literature.

Summary

• The primary radar sees everything by echo but does not identify; the secondary interrogates at 1030 MHz and receives identity and altitude at 1090 MHz.
• Modes A (4-digit code) and C (altitude); the P2 pulse suppresses replies to sidelobes.
• Garble (overlapping replies to the same interrogation) and FRUIT (replies to other radars) limit the A/C system; mode S solves them with the 24-bit address and the CRC.
• ADS-B: the aircraft broadcasts its GNSS position and identification by itself; MLAT locates from times of arrival; IFF identifies military aircraft with encrypted replies.

The code

import numpy as np

# 1) ADS-B: CRC-24 check and decoding of the identification
msg = "8D4840D6202CC371C32CE0576098"
bits = bin(int(msg, 16))[2:].zfill(112)
GEN = "1111111111111010000001001"                     # generator polynomial of the mode S CRC (25 bits)

def crc_remainder(b):
    b = list(map(int, b)); g = list(map(int, GEN))
    for i in range(len(b) - 24):                      # polynomial division modulo 2
        if b[i]:
            for j in range(25):
                b[i + j] ^= g[j]
    return b[-24:]

print("CRC remainder:", sum(crc_remainder(bits)), "(0 = intact message)")
fmt, address, tc = int(bits[0:5], 2), msg[2:8], int(bits[32:37], 2)
CHARS = "#ABCDEFGHIJKLMNOPQRSTUVWXYZ##### ###############0123456789######"
name = "".join(CHARS[int(bits[40 + 6 * i:46 + 6 * i], 2)] for i in range(8))
print(f"format {fmt}, ICAO address {address}, type code {tc}, identification '{name.strip()}'")
wrong = bits[:50] + ("1" if bits[50] == "0" else "0") + bits[51:]
print("with one wrong bit the remainder is non-zero:", sum(crc_remainder(wrong)) > 0)
print(f"synchronous garble below {299792458 * 20.3e-6 / 2 / 1e3:.2f} km of range difference")

# 2) multilateration: 4 stations, times of arrival with 20 ns of error, least squares (Gauss-Newton)
c = 299792458.0
rng = np.random.default_rng(0)
stations = np.array([[0, 0], [40e3, 0], [0, 40e3], [40e3, 40e3]], float)
aircraft = np.array([15e3, 27e3])
arrivals = np.linalg.norm(stations - aircraft, axis=1) / c + rng.normal(0, 20e-9, 4)
p = np.array([20e3, 20e3])                            # starting point: the centre
for _ in range(20):
    r = np.linalg.norm(stations - p, axis=1)
    residuals = (r - r[0]) - c * (arrivals - arrivals[0])   # measured minus predicted range differences
    J = (p - stations) / r[:, None] - (p - stations[0]) / r[0]
    p = p - np.linalg.lstsq(J[1:], residuals[1:], rcond=None)[0]
print(f"estimated position {np.round(p)} m, error {np.linalg.norm(p - aircraft):.1f} m")

Running it prints remainder 0, format 17, address 4840D6, type code 4, identification KLM1023, the wrong-bit check, 3.04 km for garble, and a position with 2.4 m of error.