Emergency squawks and flight anomalies: building an alerting layer

Every analyst who has watched a live air picture knows the two failure modes of alerting. Either the system is so quiet that a real emergency goes unnoticed for minutes, or it is so noisy that people mute it by lunchtime. This post is the rulebook we use for the airspace alerting layer in Kimo Defense Intelligence: what to alert on, how to avoid drowning analysts, and how to measure whether it works. It builds on the air-picture model described in Airspace awareness from open ADS-B data.

§01What do squawk codes 7500, 7600 and 7700 mean?

A squawk is the four-digit octal code a pilot sets on the transponder. Mode S encodes it in a 13-bit identity field, covering codes 0000 to 7777³Source 3 · Junzi Sun, TU Delft (mode-s.org)The 1090 Megahertz Riddle: Mode S surveillance repliesmode-s.org. Most codes are assigned by air traffic control for identification. Three are reserved for emergencies, and European rules spell out their use in the Standardised European Rules of the Air, SERA.13005¹Source 1 · UK Civil Aviation Authority regulatory librarySERA.13005 SSR transponder — Mode A code setting (Regulation (EU) No 923/2012)regulatorylibrary.caa.co.uk:

SKYbrary summarizes the same three special codes: 7500 for unlawful interference, 7600 for loss of communication, and 7700 for a general emergency²Source 2 · SKYbrary Aviation SafetyTransponderskybrary.aero. In open data you also have a second, related signal. In ADS-B, the aircraft status message carries emergency status and the squawk, and its broadcast rate rises from 0.2 Hz to 1.25 Hz when the squawk changes⁴Source 4 · Junzi Sun, TU Delft (mode-s.org)The 1090 Megahertz Riddle: ADS-B basicsmode-s.org, so a code change propagates quickly to ground receivers. OpenSky state vectors expose squawk and an spi (special purpose indicator) flag directly⁵Source 5 · OpenSky NetworkOpenSky REST API documentationopenskynetwork.github.io.

§02How should an emergency-squawk alert be designed?

The naive rule, "alert when squawk = 7700", fires on every transient value: a single corrupted decode, a code briefly passed through while the pilot changes settings on older equipment, or a test. The fix is cheap: require persistence.

1234567891011121314151617alert: emergency_squawk
model: tracks
when:
  squawk: { in: ['7500', '7600', '7700'] }
persist:
  min_reports: 3        # distinct state vectors carrying the code
  min_duration: 20s     # first to last report
  max_gap: 60s
group_by: [icao24]
episode:
  close_after: 15m      # no emergency code for 15 min ends the episode
severity:
  '7500': critical
  '7600': high
  '7700': high
notify: [pager:airspace-oncall, channel:airspace-watch]
include: [callsign, alt_baro_m, vertical_rate, nearest_airport, position_source, coverage]

Three reports over at least 20 seconds keeps latency well under a minute at OpenSky's 5–10 second resolution while eliminating single-frame noise. The episode block is just as important: an aircraft squawking 7700 for forty minutes during a diversion is one incident with updates (altitude, heading, nearest airport), not forty alerts.

§03Which flight anomalies are worth a second look?

Beyond emergency codes, most of what analysts care about is unusual behavior. None of these patterns implies anything by itself: training flights loiter, survey aircraft fly grids, medical helicopters land in fields. That is why they belong in a scored queue.

The signal-loss rule only applies in cells where coverage is known to be good, which you can compute from the feed itself (median number of receivers per cell). Without that condition, signal loss is dominated by coverage edges. The implausible-jump rule overlaps with GNSS interference mapping: a cluster of jumps in one area on one day is often a navigation-quality problem rather than anything about the individual aircraft.

Geofences that do not cry wolf

Geofences are the rule most likely to flood a queue, because the polygons people draw first are usually too large and ignore altitude. Three habits keep them useful. Give every zone a floor and ceiling, not just an outline, so traffic overflying at cruise altitude does not trigger a low-level zone. Give every zone an owner and a reason, stored with the polygon in the zones model. And score zones individually: a hospital helipad buffer and a restricted area around a power plant should not share a number. Reference geometry such as airports and infrastructure can come from OpenStreetMap, which keeps the polygons reproducible.

§04Worked example: one 7700 episode, end to end

Here is how a single (simulated) emergency flows through the layer. The aircraft is a twin-engine airliner at cruise that declares an emergency and diverts.

The analyst received one page and a stream of updates, not thirty notifications. During the same window the anomaly lane would also have flagged a rapid descent for this aircraft; Kimo attaches that anomaly to the open emergency episode instead of raising it separately, because an emergency descent during a declared emergency is expected behavior.

§05How do you keep alerts from drowning analysts?

1. 1Two lanes. Emergency codes page; anomalies go to a queue sorted by score. Never mix the lanes.
2. 2Combine, then threshold. An aircraft that is loitering and inside a geofence and recently lost signal scores higher than any single rule. Sum capped scores and alert at 70.
3. 3Suppress the known. Allow-list recurring benign operations (training areas, survey contracts, published holds) with an expiry date, so the list does not rot.
4. 4Rate-limit per zone. If a zone produces more than N anomalies an hour, raise one "zone is busy" alert and batch the rest.
5. 5Close the loop. Every alert gets a disposition (true, benign, data quality). Rules with a benign rate above 80% for two weeks are reviewed.

§06How do you know the alerting layer works?

Treat alerting as a product with metrics. We track four, all as measures in the Kimo semantic layer so they show up in Ask Kimo and on the Airspace watch template dashboard:

The data-quality share is the one most teams skip. When it rises, the problem is usually upstream (a receiver offline, a decoding change) and the fix belongs in the ingestion model, not in the alert rule.

§07Setting this up in Kimo

Deploy the Airspace watch template to get the tracks model, both alert lanes and the anomaly queue. Rules are YAML files versioned next to the model and editable from Alerts; see the alerts documentation for channels and escalation. For a deeper treatment of thresholds and geofence design, read Airspace alerting rules that analysts trust.