![](media/image1.png){width="1.1402777777777777in"
height="1.0993055555555555in"}

![](media/image2.png)

**Thierry CABANNES**

**Electronic engineer of Flight Inspection Laboratory**

**DGAC/STNA**

**31 035 Toulouse cedex**

**FRANCE**

# 

# TRANSPONDER JAMMING

**[Abstract :]{.underline}**

**The purpose of this paper is to present an original case of
transponder jamming.**

# 1. Introduction

During the month of October 2000, Roissy Charles de Gaulle International
Airport approach controllers reported several incidents of temporary
label loss and multi-secondary surveillance radar track loss on their
screens for periods ranging from one to two minutes.

The frequency of this phenomenon increased to reach a first maximum
between the 9^th^ and the 12^th^ November 2000 leading to capacity
restrictions. These incidents affected specific aircraft in a delimited
geographical area.

# 2. Phenomenon analysis

In late 2000 the incident analyses showed that in certain cases aircraft
had not been detected by any mono-pulse radars for one to two minutes.
However, the Mode-S radar located in the Paris area received information
coming from the transponders, correctly and without loss, from these
same aircraft.

![](media/image3.jpeg){width="5.303472222222222in"
height="6.452083333333333in"}The varied technical investigations
executed during the period when the problem occurred have allowed us to
exclude jamming induced by a Paris area Mode-S station (radar) that is
still experimental and disconnected from the operational system.

Nevertheless, it has been proved that the aircraft involved in these
incidents were all fitted with the same brand of transponders. Two
distinct kinds of transponders were involved : the General Aviation and
the civil Airliner versions. They both had the same receiver board
design.

Laboratory analysis lead by Eurocontrol Brétigny (France) has allowed us
to confirm a deficiency in this equipment concerning the response rate.
The standard requires that the transponder must reply with a probability
of one hundred percent to interrogation rates of 1200 per second in mode
A/C. The results showed that transponders responded at a rate of only 50
per cent. ( only 600 responses per second).

The presence of a jamming device was soon suspected because the
incidents often occurred in the same geographical areas (5 to 20
nautical miles north west of Roissy) and from flight levels 80 to 120.

The disappearances could happen at any time; day, night, week day or
week-end.

The phenomenon suddenly reappeared between the 21^st^ and the 26^th^
March 2001 and then again between the 13^th^ and the 26^th^ April 2001.
Radar losses were identified at several locations to the west and the
north of Roissy airport. The altitudes related to the radar echo
disappearance were variable and seemed to increase in the northern Paris
area.

These incidents occurred in a well defined area along the Toussus/Creil
axis and between flight levels 40 (Roissy) and 350 (north east).

The duration of each occurrence was variable depending on the aircraft
track. Indeed the phenomenon was of short duration (about ten seconds)
for paths perpendicular to the axis but could occur for longer (a few
minutes) for paths parallel to the axis.

Moreover we have to note that in late March 2001 Air France pilots,
flying B767s equipped with new transponders, reported many TCAS warnings
in the Roissy Charles De Gaulle Airport area.

# 3. OPERATIONAL CONSEQUENCES

Globally, these events put the operational services into sensitive
situation because the label disappearances did not affect all aircraft
and their random nature caused stress and uncertainty to controllers.

At Roissy, during the label losses, only the primary radar information
remained displayed on the screen.

At least two of these incidents could have been serious. One of these
cases concerned a close proximity event between two aircraft, one at
flight level 110 and the other at flight level 100. The controller only
had the primary radar returns of these two aircraft.

When the phenomenon occurred, capacity restrictions were taken. The
normal capacity of the control centre is about 70 arrivals per hour.
While the label loss incidents were occurring, the controller work load
increased significantly. Internal measures were taken to limit the
departure flow rate when too many label losses were reported along the
runway axis. For instance, on 18^th^ April, simultaneous departures were
stopped and on 24^th^ April the departure rate was limited to 37 per
hour. This situation generated a total of 23085 delay minutes during the
three concerned periods.

# 4 PHENOMENON PROBABLE CAUSES AND FALSE TRACKS

The principal difficulty in the management of such an anomaly lies in
the impossibility to turn off the operational radar in order to isolate
a jamming signal.

## 4.1 The Mode S experimental station located in the Paris area

The first suspected device was the experimental Orly MODE S radar.

Indeed, the first outage of the experimental radar coincided with the
disappearance of the phenomenon but the jamming resumed soon afterwards
whilst the Orly mode S radar was still out of service. However this
radar station was to become of great utility to STNA (Service Technique
de la Navigation Aérienne) in analysing the communication losses of the
three Air Traffic Control Centres affected and the localisation of the
problem source.

## 4.2 Defense Ministery installations

The first incidents appeared in Creil area, Creil being the site of a
military base. So this installation was suspected because wide spread
military exercises had been in preparation. Moreover notices of the new
system trial campaign were communicated to the DGAC (Direction Générale
de l'Aviation Civile).

## 4.3 Aeronautical maintenance organisations and aeronautical companies 

Preliminary STNA analysis quickly allowed us to suspect tests conducted
by an industrial or aeronautical maintenance organisations working on
aircraft equipment. All the known companies were made aware of the
importance of the issue of jamming. One of the suspected industrial
companies located in the south of Paris was contacted twice in order to
confirm the absence of tests.

## 4.4. TV broadcasting 

TV broadcasting signal harmonics were identified as a potential jamming
origin for transponders. The disrupted area included the Eiffel Tower
which hosts many radio frequency transmitters.

The DNA (Direction de la Navigation Aérienne) contacted the Conseil
Supérieur de l\'Audiovisuel, the broadcasting regulation organisation,
to find out exact locations of transmission sites in the Paris area.

## 4.5 TV amateur transmission

The kind of signal suspected, a narrow beam, and the activity period, a
few days in November and March, and the Easter holidays, allowed us to
believe that the jamming could have originated from a TV amateur
broadcast. The frequency band normally used is 1230 MHZ-1300 MHz but
sometimes radio amateurs broadcast on the 1000 MHz frequency for
testing. With the help of the National Frequency Agency and some radio
amateurs, this suspected jamming source was soon discounted.

# 5. METHOD USED TO IDENTIFY THE ANOMALY

During the three periods it was observed that certain mode S
transponders did not detect interrogations transmitted by secondary mono
pulse radar in mode A/C even though the same transponders in the same
aircraft, at the same time, responded to mode S radar interrogations on
the same frequencies (1030 MHz and 1090 MHz).

As indicated above in the document, the duration and the frequency of
the phenomenon were variable and depended on the aircraft track which
was related to the operational configuration of Roissy.

## 5.1 Secondary Surveillance Radar function mode 

A ground radar transmits interrogations to aircraft fitted with a
transponder. The uplink frequency is 1030 MHz and the downlink frequency
is 1090 MHz.

The ground stations transmit pulses cyclically at a certain frequency.
Generally all ground stations have a specific interrogation rate in
order to avoid ambiguous responses. If a ground station interrogates at
a 400 Hz rate, an aircraft will be requested every 2.5 milliseconds when
it is illuminated by the antenna beam (figure 1). Measuring the time
between two responses coming from the transponders, we obtain 2.5
milliseconds and we can easily deduce the identity of the radar
interrogating the aircraft equipment (figure 2).

![](media/image4.wmf) ![](media/image5.wmf)

**Figure 1 : aircraft detection via a ground station Figure 2 :cyclic
response spectrum**

On board the transponder shares the frequency band 962 MHZ-1215 MHz with
distance measuring equipment (DME) and the anti-collision system (TCAS).
As the power broadcast by these systems is very high (700 W), a link
connects all the equipment to avoid simultaneous transmissions and to
signal transmission in progress. This link, called the Suppressor, is
implemented using an electrical signal line which is put to +28 volts
during each transmission period by the transmitting equipment.

By analysing the suppressor signal, it is possible to identify the
transponder response rates and to distinguish different ground stations
(figure 3).

![](media/image6.wmf)

**Figure 3 : response spectrum for two ground radar**

# 6. THE REAL ORIGIN OF RADAR ECHO LOSSES

The Eurocontrol measurement bench allows the real time visualisation of
the response spectrum of an aircraft transponder. All airline
transponder systems available on the market can be connected to this
measurement bench.

The spectrum generally displayed in the Paris area is shown in Figure 4.
It identifies the interrogations from four ground radars.

![](media/image7.wmf)

**Figure 4 : response spectrum in the Paris area**

During laboratory tests, the suspected transponder type showed a
deficiency when over-interrogated. So firstly the idea that a ground
station was transmitting at abnormally high interrogation rates was
investigated. This line of research gave no result.

However spatial modelling of lost aircraft labels showed a possible
origin of a jamming signal south west of Paris. This lead was more
fruitful.

In this area, the transponder response spectrum (for all transponder
brands interrogated in the 1030 MHz band) became particularly alarming.
The aircraft equipment practically did not respond to any ground station
and seemed to be held in permanent transmission. This kind of behaviour
is totally unforeseen under normal transponder operational conditions
(figure 5).

![](media/image8.wmf)

**Figure 5 : response spectrum in the jamming vicinity**

In the vicinity of the nearest village, a national TV broadcasting
station relay, a radio amateur conducting transmission tests and a large
company making civil and military primary and secondary radar antennas
were identified. Different measurements have shown that the company
transmitted a 1030 MHz carrier-wave produced by a laboratory generator
linked to a small tube amplifier. This system was connected to a 6 meter
diameter parabolic antenna pointed towards their test receiver
installations which were in Roissy direction\... The tube amplifier
often tripped due to a temperature protection system and then was
automatically retriggered several hours later. This narrow beam carrier
wave transmission using a high gain parabolic antenna provoked an
immediate transponder lock-out with permanent transmission. This
particular case is not foreseen by the standards defining normal
transponder functioning. The competent DGAC services have been informed
of this event and will contribute to its resolution for the next
generations of equipment.

![](media/image9.jpeg){width="4.5569444444444445in"
height="5.620833333333334in"}

# 7. PROBLEM RESOLUTION CONDITIONS

During this investigation, we had great difficulties, and it took us a
long time to find the origin of the phenomenon. Indeed the cumulative
jamming period was only four weeks, in total, between November 2000 and
April 2001.

## 7.1 The difficult analysis of the problem

[The impossibility to stop radar transmission in the Paris
area.]{.underline}

It was difficult to localise a specific area because the jamming signal
(about 100 W power) was masked by the operational signals. Moreover the
receiver antenna directivity did not allow us to detect a measurable
field outside the transmission antenna beam. The efficiency of the STNA
aircraft was reduced because only field measurement were possible.
Without other information, it was difficult to accurately determine the
jamming origin.

[A long delay in processing affected aircraft tracks]{.underline}

The first reports concerning the November 2000 events given by the Air
Traffic Control Centres, contained neither the A/C mode transponder
codes nor the flight numbers. This essential information was received a
posteriori. Even the event times and positions were approximate.

After long and arduous study, the Mode S address and the aircraft A code
were found which allowed us to identify, via DGAC services, the aircraft
registration and consequently its associated on board equipment. This
pragmatic method showed that all incidents were related to a certain
kind of transponder which could be identified easily.

During March and April 2001, more complete information about the events
( A code, registration, estimated position, time) were provided by the
different control organizations.

With these new data and software tools, STNA could determine, with great
accuracy ,the geographical origin of the jamming signal; south west of
Paris

[A new jamming phenomenon for our services]{.underline}

Not prepared for this kind of incident, the different DGAC services
responsible for jamming research have had great difficulties isolating
this phenomenon and localising the real origin. Was it a parasite signal
transmitted via a point source or a malfunction of one of the
radar-transponder chain elements ? The difficulty was increased because
the suspected company twice answered to the DGAC request stating that
they did not test on their site.

[Jamming conditions were not favourable to efficient
investigation]{.underline}

The intermittent aspect did not allow easy phenomenon analysis.

The activity period of the jamming coincided with personnel
unavailability periods (week-ends, Easter holidays) delaying the problem
analysis.

These elements confirmed the idea the origin could be a single
individual.

[The absence of adequate research equipment]{.underline}

The absence of equipment able to work in the 1 GHz band in the DGAC
hindered the investigation.

The STNA managed to find the jamming signal due to Eurocontrol support
located in Paris area (Brétigny sur Orge).

In Europe, a ground and inflight monitoring system of mode S equipment
was put in place during 2000. Eurocontrol Brétigny, who is in possession
of a mode S transponder analysis bench, acts as the European centre of
expertise and centralizes mode S transponder malfunction reports. It
liases closely with equipment manufacturers and plays the role of an
information source for airline companies and national authorities.

## 7.2 The technical solution to this problem

The investigation showed us that a radio frequency spectrum analyser was
totally useless for detecting this kind of jamming.

Conversely, the best tool to detect such jamming is the on board
transponder itself. We only have to monitor the suppressor signal line
to detect the transponder, DME and TCAS responses. Software processing
extracts the transponder responses to visualize the response spectrum
and identify possible lock-out permanent transmission. Such a complete
system, implemented in hardware and software, has been developed by an
electronic engineer trainee. The next research campaign will be used to
test this new equipment in real conditions and to improve it if
necessary.