SINCE THE SEPT. 11 DISASTER, government and industry experts have been scrutinizing an essential but unheralded piece of avionics safety equipment-the onboard aircraft transponder. Following the tragic events in New York and Washington, Secretary of Transportation Norman Mineta formed a "rapid response team" to deal with inadequacies in aircraft security. On Oct. 1, 2001, the team issued a report titled "Meeting the Aircraft Security Challenge" (www.dot.gov/affairs/aircraftsec.htm); it contains 17 recommendations, including such dramatic proposals as arming crew members.
Task Force Established
Not making the headlines was the Department of Transportation’s (DoT’s) recommendation No. 16: to create a task force "to develop modifications to transponders to assure continuous transmission of a hijack signal, even if the flight deck-selected code or function is turned off." Air traffic control (ATC) tapes from Sept. 11 revealed that identification and altitude information ceased from the hijacked aircraft after the aircraft made dramatic deviations from their approved courses. Thus it became apparent that the perpetrators had disconnected or disabled the aircraft’s transponders.
The Mode S transponders aboard Boeing 767 and 757 aircraft, such as those used on 9/11 as "flying bombs," deliver aircraft identification and altitude and can supplement FAA’s radar by "providing ATC and traffic alert collision avoidance system (TCAS)-equipped aircraft the ability to determine position and heading information," according to DoT. "A lesson from 9/11 is the importance of ensuring continuous transponder communication with ATC, regardless of a hijacking.
"Without the transponder switch in a fully active position, ATC can track an aircraft only by primary radar, which does not indicate aircraft identity and altitude," states DoT. "The loss of this information causes other aircraft to lose awareness of the flight in progress."
Locking in 7500
DoT recommendation No.16 charged the task force to examine all options for setting and locking in the hijack code (7500) via the transponder control panel ID selection, so that hijackers cannot disable it. The group was also tasked to look into a "panic button" that initiates the hijack code in an emergency situation and an independent transponder that cannot be disabled. DoT added that while such new features could require a major redesign, it had "learned of possible modifications that could be accomplished more quickly."
The FAA/industry task force delivered to FAA on Nov. 5, 2001, a report with recommendations to help airlines initiate design efforts with vendors, manufacturers and certification offices. However, the report has not been released.
In forming the task force, FAA urged the avionics industry to "create a safe, secure environment around transponders," says Cyro Stone, technical staff engineer for Aviation Communication and Surveillance Systems (ACSS), which participated in the group. "We were to look at all things that needed to happen, keeping in mind the financial implications for the airlines." The group came up with a list of 15 requirements and ways to meet them. Two different aircraft configurations had to be considered:
One, prevalent in older aircraft, has one modern Mode S transponder, usually installed when the TCAS was required, along with an air traffic control radar beacon system (ATCRBS), considered a Mode A or C transponder.
The other configuration, common in most modern fleets, has dual Mode S transponders, along with a TCAS computer. This group was further broken down into two subsets by antenna configuration: a single antenna set, with a top and bottom antenna accompanying two transponders; and a dual antenna set, with one set of antennas for each transponder.
Cutting the Power
Another issue for the task force to consider has been power management. Besides disabling the transponder by switching the unit to "standby" on the control panel, hijackers could simply disconnect the appropriate circuit breaker. To prevent this would require changing the circuit breaker switch to ensure that the power supply was switched from the bus that hijackers could control to a secure power source.
One proposed method called for a third (independent) remotely mounted transponder. But considering the retrofit cost to the operators–including aircraft downtime to install and rewire the new system–the task force rejected the idea.
The panel presented three other methods for consideration:
-
Acquiring software modification kits, allowing users to reprogram their air transport data link (ATDL) transponders so as to "latch" the 7500 hijack code and accommodate the panic button option. In addition, a remotely located circuit breaker could be selected. The change would assure power to the transponder. This method meets all derived requirements.
-
Installing a remotely located transponder control head, preset to the hijack code, in the avionics equipment bay. The panic button would feed into it. This method, which requires adding a new unit to the aircraft, also meets all derived requirements. Airbus recommends this solution to its customers.
-
And changing the current control panel where the codes are set. One possible modification would have 7500 code locked, if selected; if the hijacker turns the knobs, the computer ignores the input. The task force felt that this change, which requires opening up the control panel and eliminating the "standby" function, did not meet all derived requirements; ATC operators did not want to lose the standby function, which is needed in an overloaded traffic environment or when transponders malfunction.
Boeing recommends that its customers acquire software mod kits for their transponders. Also called the "software solution," it is less complex than the other solutions and thus could be viewed as an interim solution. "We want to wait for industry and regulators to determine the final solution," says a Boeing official.
Timetable
The timetable for developing the changes to Mode S transponders and equipping the entire U.S. air transport fleet, along with a cost analysis and an examination of the pros and cons of each method, are known only within DoT. And they will remain that way until the task force report is released to the public.
But last fall, FAA asked RTCA to have a special committee of transponder experts "come out of retirement" to draft a change–known as Change 1–to the minimum operational performance specifications (MOPS) document DO-181C, which addresses performance requirements of Mode S transponders under "hijack" conditions. As of mid-April, RTCA expected to obtain its program management approval of Change 1 by June 2002.
Preparing for the Mod
Once RTCA approves the subcommittee’s MOPS change, FAA’s Aircraft Certification Division will advise its field offices that the modifications can be incorporated in Mode S transponder equipment, according to an FAA spokesman.
"Before we begin to look at certification, if nothing changes [as a result of comments to a possible notice of proposed rulemaking], engineers can do prototype testing on the bench," says Stone. "If FAA certifies the changes [to transponders], operational systems could be available three to four months after that. When FAA certifies hardware, then another side [of the agency] deals with the airlines."
FAA is working on a proposed rule that will require Part 121 operators to add provisions "for the continuous operation of the transponder in threat situations," an agency spokesman says. However, the rule is not dependent on the Change 1 to DO-181C and will be "performance-based," he adds.
The agency must then decide whether the changes apply to airlines only, or if they would involve business or general aviation. And it must decide how to coordinate with overseas regulatory authorities and whether to apply the new requirements to foreign airlines flying into North American airspace.
The task force’s recommended transponder modifications assume no changes to the ATC network, but are designed to work with the current system. However, if new Mode S ground stations are installed, more capabilities will be possible, says Stone.
ADS-B Messages
Mode S transponders allow the operator to transmit and receive digital messages between the aircraft and ATC. ACSS’ XS-950 transponder has "Level 4" data link capabilities that will transmit and receive 16-segment, extended-length (80-bit) messages. It also can transmit and receive a standard-length message (56 bits), as required for the automatic dependent surveillance-broadcast (ADS-B) environment. (Note: both standard-length and extended-length messages are transmitted in the airspace in a 112-bit Mode S format message.)
"All of this can be automated," says Don Schumann, ACSS director of commercial programs. "The functionality is already there in the transponder, but the operators don’t make use of it."
Other countries far exceed the United States in the use of data link technology, Schumann maintains. "Qantas [in Australia] uses it on their B747s across the Pacific. It works great until you reach the Oakland [ATC] center," he adds. "Then you’re back to microphone and voice."
Progress Made
By upgrading the XS-950 with Change 7 software (developed to improve traffic alert collision avoidance performance), the transponder can provide aircraft latitude/longitude position, east-west velocity and track angle rate to both ground-based and airborne interrogators. The XS-950 "does that right now, but ground stations in the U.S. aren’t able to use this," Schumann says.
Progress in data link communications with transponders is being made in the United States. Some operators in the Cargo Airline Association (CAA) have been conducting trials using this expanded capability, and FAA has been involved in tests of advanced surveillance systems and air traffic procedures along the Ohio River valley.
ACSS: Past, Present and Future
Aviation Communication and Surveillance Systems (ACSS), formed in May 2000 from the spinoff of Honeywell’s successful TCAS 2000 product line, is a significant player in the transponder/TCAS industry. When the spinoff mandated by the Allied Signal-Honeywell merger resulted in the sale of Honeywell’s TCAS unit–including transponders, computers and cockpit displays–the successful bidder was L-3 Communications, which was interested in a commercially oriented enterprise to balance its concentration in defense markets. When Phoenix-based ACSS became a division of L-3 Communications, it had a workforce of 60 employees; currently, it employs 225 persons, many coming from nearby Honeywell.
In June 2001, ACSS announced that France’s Thales Avionics had purchased a 30 percent interest in the fledgling firm, creating a joint venture company. ACSS operates as a separate legal entity and not as an L-3 division. The company’s product line remained located in a Honeywell facility until ACSS moved into its new 80,000-square foot (7,430-square meter) facility in October 2001. The company has plans for further expansion.
"We didn’t carve out this business just to build TCAS computers," says Joe Hoffman, ACSS president. "We plan to have other products, get into other markets and grow the business. This includes [products providing] awareness of other aircraft [TCAS], terrain [terrain avoidance warning systems], runway incursions, and other areas pertaining to safety and situational awareness."
Hoffman envisions the company becoming a strong competitor to Rockwell Collins, Honeywell and others in the communications and surveillance markets. Current ACCS products include the TCAS 2000 and 1500 traffic alert collision avoidance systems, and its family of Mode S transponders. The company delivered its 5,000th TCAS 2000 last summer. More than 8,000 ACSS TCAS units are operating in commercial, corporate and military aircraft. The spun-off business came with existing, original equipment manufacturer (OEM) contracts; Boeing, Gulfstream, Cessna, Bombardier and other airframe manufacturers guarantee future deliveries.
Aftermarket support has provided another business for ACSS. For example, updates to TCAS mandated by Change 7 software took place throughout 2001. Although the air transport market has suffered since the Sept. 11 event, military business remains strong for ACSS. Military forces, including the German Air Force, have accelerated plans to retrofit aircraft with Mode S transponders, according to Don Schumann, ACSS director of commercial programs.
ACSS offers the XS-950S/I transponder, which has Mode S data link and IFF capabilities. It performs all of the surveillance air traffic management functions of the air traffic control (ATC) radar beacon system (ATCRBS), and it meets U.S. Department of Defense specifications.
For its new T2 CAS product, ACSS combines its own technology and that of Thales. "ACSS is borrowing from Thales the terrain following and avoidance system technology developed for military fighter aircraft, taking the algorithms and putting them into the TCAS computer," Schumann explains. "Customers can send in their older TCAS computers, and we replace them with the new ones; they take no more room in the aircraft."
With the new system, "if you have an engine out, it will recalculate time-to-climb capability," Schumann claims. "It takes into account the weight of aircraft, as fuel is burned, and the climb rate is faster."
The current TCAS 2000 computer line replaceable unit (LRU) can be upgraded with terrain awareness warning system (TAWS) functionality, using a compact flash card slot to load terrain and airport databases and operational software. The new system also offers a windshear warning feature and GPS as options. Though they do not change the box size, these new capabilities will require some hardware changes.
In addition to the air transport market, the T2 CAS offers "a smaller, lighter TAWS solution" designed for regional, business or military aircraft. Flight tests of the new system are scheduled to begin this summer, with certification targeted for late 2002. ACSS expects to begin production of T2 CAS in 2003.
Transponder History
Transponders on aircraft date back to the IFF (identification, friend or foe) systems of World War II. Refinements to the technology were employed on military jets in the mid-1950s. An industry executive remembers that in 1964, prior to an instrument check ride, "my instructor asked me if I knew how to work that new transponder thing." Mode A and Mode C transponders started in the early 1960s, he recalls.
Recent transponder evolution has been spurred by the advent of traffic alert collision avoidance systems (TCAS), certified by FAA in the late 1980s, and the upgraded TCAS II, which provides resolution advisories in addition to showing the location of nearby aircraft. Transponders, in conjunction with a TCAS computer, make up the bulk of these systems. (These transponders are interfaced to the onboard TCAS computer via an ARINC 429 bus to enable proper coordination between TCAS-equipped aircraft.)
TCAS II, mandated for Part 121 operators in the United States, came on-line in 1994 and resulted in the need for modern Mode S transponders. Suppliers of transponders and TCAS systems include, in addition to ACSS, avionics giants Honeywell and Rockwell Collins, Raytheon, Northrop Grumman, BAE Systems and AIL Systems (antennas).