Reverse engineering of an Aircraft Transponder

Some time ago I obtained from eBay a transponder control head. You may start asking what is such thing, and what does it have to do with a blog where most frequently, home automation topics are discussed.

Well, for starting, while home automation is the main focus, I always look forward to cover technology in a broader sense, and whenever possible find the links between different domains where technology is developed and applied. It is quite notable how humans progress and iterate over their areas of expertise, first to solve a problem and later to progressively optimize their solution. It is however much less natural to use such journeys to bring up patterns and produce knowledge that is valuable across different domains. As such it is not unusual to see in different fields, solutions that were coincidentally designed in a similar manner, or  on the other hand, designed in totally different ways to achieve the same or similar effect.

As such taking a peek at other areas can sometimes be inspiring, or help us learn about certain long solved problems, and be able to add robust solutions to our new designs, without having to go through the same iterations that others went through long ago.

In order to give some context, the Transponder Control Head is basically a console that sits together with the many other controls that can be found in a commercial airliner cockpit:

It serves to control and configure a special type of transmitter, known as transponder. This is basically a device that transmits information whenever the air traffic control (ATC) places a query via a system known as ADS-B (you may find more on this topic in a previous post that I have placed some time ago - https://www.creationfactory.co/2014/10/again-with-sdr-software-defined-radio.html).

The main types of information transmitted are:

• a squawk code (a numeric code made of 4 digits between 0 and 7, that is assigned by the ATC before a flight);
• altitude reporting;
• and if the transponder is capable, the GPS coordinates along with speed and heading information;

Normally an airport or ATC has a tower with the primary radar antenna, and on top of it there is a smaller rectangular antenna. The latter is the ADS-B antenna, and basically what happens is that this antenna is constantly sending queries that are received by any aircraft in the range and direction of it. Upon receiving a query, the transponder of the aircraft will send a reply. The ATC software coalesces the information provided by the replies with the data obtained from the primary radar. As such, we can easily understand that the squawk code is the bare minimum information that the aircraft needs to provide, as it is necessary for identification. In order to determine the position, approximate speed and heading, the primary radar can still calculate these from the echo signature that is picked up from the aircraft. But this is not absolutely accurate and quickly updated (the primary radar is only as fast as its motor is capable of spinning the antenna). As such in order to allow for redundancy and more accurate data, the ATC expects that most aircraft are also capable of using ADS-B for reporting the position and altitude.

In the 1997 Con Air movie, Swamp Thing (the rogue pilot) makes it look like the transponder unit is a standalone device mounted in the cockpit, which can be wired to a battery and operated without extra hardware - so that he can place it in another (completely different) aircraft without disruption of the position reporting:

In reality, on a typical airliner, this control head and the actual transponder unit are separate devices, where the former is mounted in the central section of cockpit, below the throttle levers and radios, and the latter is in a special avionics rack, in a separate section of the aircraft. 

This is where the actual "brain" of the transponder is. It consists of a powerful radio transceiver (that small 6 Volt battery would hardly be enough to keep it going) and some logic to encode and decode ADS-B replies and queries respectively. It also needs to acquire information from sensors (e.g. pressure and/or radar altimeters) and GPS, and aggregate this data into the ADS-B reply.

My intention with this purchase was to be able to go through the inner workings of this type of aircraft component and appreciate with more detail the rigorous manufacturing principles that are applied to such hardware.

This unit in particular was manufactured by Gables Engineering, and I could only determine that it belonged to either a Douglas DC-9 or an old Boeing 737. It also has an interesting serial number (# 3) marked in the back plate:

This gives a clue of how low volume production this type of aviation hardware is (the cost being, of course, inversely proportional to the manufacturing volume).

The unit also has some dates printed on it, indicating that it was produced in the early 80's (or even before that):

After purchasing the unit, I didn't do much with it except to do some tracing to determine how to power it up (or at least part of it).

I expected that it would be powered by one of the standard voltages normally available in an aircraft. The options here generally are:

• 115-120 VAC @ 400 Hz;
• 24-28 VAC @ 400 Hz;
• 24-28 VDC
• 14 VDC

Taking a look at the inside, I could find what seemed to be the power supply circuitry:

With a large inductor, the single electrolytic capacitor in the unit, and some other components such as rectifier diodes and a power transistor, it certainly looked like this board would play a role in the filtering and eventually rectification of the input voltage (in case it is delivered in AC at 400 Hz).

So by tracing the connections between this board and the MIL connector in the back of the unit, it was clear where the power would come from. The ground pin would have continuity with the metal chassis, which is to be expected. 

As such I started by applying a low voltage while keeping the current limited, using my bench power supply, and gradually increased the voltage until something would happen (ultimately the magic smoke). But it was not without some joy that the squawk code display turned on in its full orange glory:

It is quite remarkable to see that after all the years that it counted (and probably many nautical miles), this piece of aircraft electronics seemed to work without hesitation. The squawk code input knobs worked just fine, allowing to control each digit independently with values between 0-7 for each digit. The test button was also working - upon pressing it, the display would light all the segments, i.e. 8888.

I expected that the device would also have a back-light for the labels, but at this point, even though these were not lighting up, I didn't consider to be conclusive that these would be faulty because I was able to locate the bulbs and these measured a resistance.

I also expected that these would be controlled and/or powered separately, because aircraft cockpit lights can be dimmed via a global adjustment.

Much later and with more patience available, I decided to try to figure out the remaining pin mappings.

Looking at the inside of the unit, it is apparent how well built it is. A piece of fine craftsmanship where the priority in the construction is the quality and reliability, and  not the effort and the overall cost:

The first step was to try to understand which pins would carry signals. I expected that somehow the squawk code for example would be communicated to the the main unit via some of the pins. Given the not very abundant electronics and this being a design from the 70's  or early 80's, I did not expect to find a very sophisticated communications bus for this purpose (aviation tends to be a very conservative industry when it comes to embracing change - safety is always first).

Anyway, with the device powered up, I started poking the MIL connector pins with the oscilloscope probe and see what signals where present while turning the squawk code selection knobs.

I quickly found TTL level signals in several pins, and these would rise from 0 to 5 volts and vice-versa as I would turn the knobs.

It didn't took too long to find that the squawk code was simply being encoded as BCD digits (Binary Coded Decimal), with the bit values inverted.

After that, I decided to try to figure out the rest of the pins, considering the functions provided in the panel. After some continuity tests and tracing of the wiring inside the unit, I determined the following pin mappings:

Considering the 4 digits of the squawk code as D3 D2 D1 D0:

The value is then encoded according to the following tables:

Digit	Pin
D0	P	N	M
0	1	1	1
1	1	1	0
2	1	0	1
3	1	0	0
4	0	1	1
5	0	1	0
6	0	0	1
7	0	0	0

Digit	Pin
D1	K	J	H
0	1	1	1
1	1	1	0
2	1	0	1
3	1	0	0
4	0	1	1
5	0	1	0
6	0	0	1
7	0	0	0

Digit	Pin
D2	G	F	E
0	1	1	1
1	1	1	0
2	1	0	1
3	1	0	0
4	0	1	1
5	0	1	0
6	0	0	1
7	0	0	0

Digit	Pin
D3	D	C	B
0	1	1	1
1	1	1	0
2	1	0	1
3	1	0	0
4	0	1	1
5	0	1	0
6	0	0	1
7	0	0	0

There is no clock signal, the transponder unit will probably just be triggered and perform a read when there is a transition in any of these pins. It is therefore a very simple communication method.

Regarding the rest of the pins, I was able to determine the function of each, by flipping the switches, pressing buttons and looking for any changes in the pins.

There is basically the following:

• Pin A - this pin is pulled to GND when the power knob (on the top left corner of the control head) is in the ON position;
• Pins X,Y,Z - when the MKR switch is in the HI position, there is continuity between Z, X and Y. When it is in the LO position there is no continuity between any of these 3 pins;
• Pins L and U - these provide power to the REPLY light. These pins are isolated from the GND and any other power rails. While the exact voltage of the bulb is not known, it appeared to glow with a normal intensity when powered at 6.5 Volts;
• Pin R - this pin  is pulled to GND when the IDNT button is pressed;
• Pin S - this pin is pulled to GND  when the ALT RPTG switch is on;
• Pin T - this pin is pulled to GND when the TEST button is pressed;
• Pin t - this pin is the input power for the panel illumination bulbs. When connected in parallel with the REPLY light, it draws about 0.5 Amps at 6.5 Volts.
• Pin V - this pin is pulled to GND when the TFR switch is in position 1 and the power/mode switch is in the ON or LO positions;
• Pin W - this pin is pulled to GND when the power/mode switch is in the ON or LO positions and the TFR switch is in position 2. Together with Pin A, it is therefore possible to determine any of the positions of the power knob (0 indicates pull to GND):

TFR Switch	Power Switch	Pin
		A	V	W
1	STBY	1	1	1
1	ON	0	0	0
1	LO	1	0	0
2	STBY	1	1	1
2	ON	0	1	0
2	LO	1	1	0

Regarding the concrete meaning and function of these buttons and switches, there is nothing obscure to figure out because, of course this is a standard instrument in any commercial aircraft. A certified pilot is probably familiar with most of these controls. I am not a pilot, and as such I resorted to obtaining the information I could online. 

Starting from the upper left we have:

• STBY / ON / LO - while in STBY mode the transponder does not transmit a squawk code. The transponder should be in that position while the aircraft is in the ground and before the ATC having assigned a squawk code to be used. ON is the normal operating mode. Regarding LO I could not obtain information on its purpose, as more recent transponders (for which there are manuals and more detailed information available) don't seem to have this function named this way at least;
• ATC display indicates the currently transmitted squawk code;
• MKR appears to be related to the Marker Beacon Receiver, although it is not clear what is the relationship with the transponder as it is normally a distinct device in the aircraft;
• ALT RPTG allows the altitude reporting function to be turned on or off;
• TEST - performs the display test, but also the test output pin goes high, which suggests that a transponder self-test is initiated when this output is asserted;
• REPLY - this light pulses when a reply signal is transmitted by the transponder;
• IDNT is normally used when the ATC explicitly requests the pilot to use this function. It causes the squawk code to be re-transmitted during the button press, with a higher RF power, and the reply containing a SPI (Special Position Identification) pulse. Usually the pilot is not allowed to deliberately use this function, except in an emergency;
• TFR  - I could not find the exact function of this switch, but in similar control heads there is the XPDNR switch with the positions 1 and 2 as well. In this case it allows the active transponder to be selected;
• The rotary knobs, as previously mentioned, allow the selection of the squawk code;

While I don't have a concrete plan for this unit, I believe that the details explained here can be useful for a future project or relevant for a user intending to build a flight simulator cockpit or otherwise tinker with this type of hardware. Given the simplicity of the design it shouldn't be extremely challenging to interface this device with a micro-controller and add logic to integrate with some flight simulator API. It would certainly be a nice touch being able to select the squawk code of the next simulated flight using the real, flight proven control head.