IFF &
DECONFLICTION

Blue Force Tracking

Every Lisa 26 drone and ground node broadcasts a heartbeat every 2 seconds via MANET: node ID, position (from AHRS/barometer, or GPS if available), heading, speed, altitude, battery level, and mission status. This heartbeat is authenticated via the MANET encryption layer — only nodes with the current AES-256 key can generate valid heartbeats. Lisa 26 plots every friendly node as a blue APP-6D symbol on the COP. If a heartbeat is not received for 30 seconds, the node is marked LOST (amber). If 120 seconds: marked MISSING (gray).

Engagement Safety Check

Before generating any L2 strike recommendation, Lisa 26 performs a spatial check: is any blue force asset within a configurable safety radius (default: 100m) of the proposed target? If yes: the L2 recommendation displays a FRATRICIDE WARNING banner with the identity and position of the nearby friendly. The platoon/company commander must explicitly acknowledge the warning before authorizing engagement. This check runs in <1ms (simple distance calculation against the blue force table) and adds no perceptible delay to the recommendation.

For L3 autonomous interceptor: the check is more restrictive. The target must be classified as DRONE (not vehicle/person), must NOT be broadcasting a valid MANET heartbeat, must be on an inbound vector to a friendly position, and must have confidence >85%. If the target drone IS broadcasting a MANET heartbeat with a valid key, it is friendly — L3 will NOT engage regardless of flight path. This prevents interceptor fratricide when a friendly drone flies an unusual path.

The IFF Limitation — Honest Assessment

Lisa 26's IFF relies on MANET cryptographic identity. A drone with a valid AES-256 key is friendly. A drone without it is unknown/hostile. This has two failure modes:

False positive (friendly appears hostile): a friendly drone with a failed MANET radio broadcasts no heartbeat. Lisa 26 cannot distinguish it from an enemy drone. If it flies toward a friendly position, L3 could engage it. Mitigation: before L3 launch, Lisa 26 checks all KNOWN friendly drone positions from last heartbeat and projects their trajectory. If the unknown drone matches a projected friendly trajectory within 200m, L3 is inhibited and L1 alert is generated instead.

False negative (hostile appears friendly): an enemy recovers a captured MANET radio with valid keys and mounts it on their drone. Lisa 26 sees the drone as friendly. Mitigation: key rotation within 1 hour of any drone loss (see Captured Drone Protocol). Silvus MANET supports cryptographic challenge-response — each node must respond to a random challenge with the correct encrypted answer within 100ms. A replayed or cloned key without the challenge-response algorithm fails this check.

Article 36 Considerations

Additional Protocol I, Article 36 requires states to review new weapons to ensure they comply with international humanitarian law. Lisa 26 L3 autonomous interceptor must satisfy: distinction (only engages drones, not humans — enforced by classification requirement), proportionality (interceptor-to-interceptor, no collateral damage from air-to-air drone collision), and precaution (IFF check, confidence threshold, spatial deconfliction). FSG-A recommends that Swedish Armed Forces conduct a formal Article 36 review of the L3 interceptor function before operational deployment. The technical constraints are documented in code and this wiki. The legal determination is for military lawyers, not engineers.

IFF Protocol and Fratricide Prevention

Every Lisa 26 networked drone broadcasts a 27-byte IFF heartbeat packet every 2 seconds on the MANET mesh. The heartbeat contains: node ID (4 bytes), latitude/longitude/altitude (12 bytes), heading (2 bytes), status (1 byte), and HMAC authentication (8 bytes). Only nodes with the correct MANET encryption key can generate valid heartbeats — enemy drones cannot spoof friendly identification because they do not possess the key.

Before any strike engagement, Lisa 26 performs a fratricide check: compare the target coordinates with all current blue force positions from the heartbeat database. If any friendly asset is within 100 meters of the target: strike is BLOCKED. The operator sees a red warning: "FRATRICIDE RISK — friendly at 67m from target." The block cannot be overridden by the drone team leader — only the company commander can authorize a strike within 100 meters of a friendly position, and only after verbal confirmation with the friendly unit that they are clear of the target area. This two-level authorization prevents both automated fratricide (AI targeting friendly vehicle) and human-error fratricide (operator misidentifying the target).

Try the interactive Decision Engine Simulator →

Open the interactive Decision Engine →

← Del av Lisa 26 Architecture

Implementation

# IFF Heartbeat — Blue Force Tracking
import struct, time, hashlib

def generate_heartbeat(node_id, position, heading, key):
    """2-second heartbeat broadcast on MANET."""
    payload = struct.pack(">I3fHB",
        node_id,                    # 4 bytes: unique node ID
        position.lat,              # 4 bytes: latitude
        position.lon,              # 4 bytes: longitude  
        position.alt,              # 4 bytes: altitude MSL
        int(heading * 10),         # 2 bytes: heading 0-3600
        0x01                       # 1 byte: status (0x01=active)
    )
    # HMAC-SHA256 authentication — only nodes with key can generate
    hmac = hashlib.sha256(key + payload + struct.pack(">Q", int(time.time()))).digest()[:8]
    return payload + hmac  # 27 bytes total

# Fratricide check before any strike
def check_fratricide(target_mgrs, blue_positions, safety_radius_m=100):
    for blue in blue_positions:
        dist = mgrs_distance(target_mgrs, blue.mgrs)
        if dist < safety_radius_m:
            return {"safe": False, "nearest_blue": blue, "distance": dist}
    return {"safe": True}

Worked Example — Fratricide Safety Radius Selection

Worked example: a FPV strike against a target 180 m from the nearest friendly platoon position. Substituting the engagement parameters into the fratricide-check function — target at MGRS 33VXH 45678 12345, nearest friendly at 33VXH 45820 12410 — the computed distance is 180 m. With the 100 m safety radius the check returns safe=True; reducing the safety radius to a lower value would not change this result. Substituting a closer friendly (e.g., MGRS 33VXH 45720 12370, distance 75 m) into the same check returns safe=False and blocks the engagement.

Deconfliction Implementation — Trajectory Corridor

Beyond the static fratricide radius, Lisa 26 also checks strike trajectories against friendly movement corridors. A FPV striking from east to west on a path that crosses a friendly platoon's MGRS track must be blocked even if the strike endpoint is >100 m from any friendly — the transit itself is the hazard. The implementation below is what ew_integration.py uses for trajectory deconfliction.

# trajectory_deconfliction.py — Corridor-based fratricide check
import math

def segment_to_point_distance(p1, p2, q):
    """Perpendicular distance from point q to segment p1-p2, in meters."""
    dx, dy = p2[0] - p1[0], p2[1] - p1[1]
    length_sq = dx*dx + dy*dy
    if length_sq == 0:
        return math.hypot(q[0] - p1[0], q[1] - p1[1])
    # Project q onto segment
    t = max(0, min(1, ((q[0]-p1[0])*dx + (q[1]-p1[1])*dy) / length_sq))
    proj = (p1[0] + t*dx, p1[1] + t*dy)
    return math.hypot(q[0] - proj[0], q[1] - proj[1])

def check_trajectory_safe(launch_point, target_point, blue_positions,
                         corridor_width_m=200):
    """Return True if strike trajectory stays outside friendly corridors."""
    for blue in blue_positions:
        d = segment_to_point_distance(launch_point, target_point,
                                      (blue['x'], blue['y']))
        if d < corridor_width_m:
            return (False, blue['id'], d)
    return (True, None, None)

# Example: FPV launched from (0,0) at target (5000, 0)
# Friendly platoon at (2500, 150) — 150 m from strike path
launch = (0, 0)
target = (5000, 0)
friendlies = [{'id': 'Platoon_3A', 'x': 2500, 'y': 150}]
safe, who, dist = check_trajectory_safe(launch, target, friendlies)
print(f"Strike safe: {safe}, nearest: {who} at {dist} m")
# Output: Strike safe: False, nearest: Platoon_3A at 150.0 m
# (150 m is within the 200 m corridor — strike blocked)

Why This Matters Operationally

IFF and fratricide prevention matter because a single blue-on-blue incident in a drone-enabled brigade operation can end the brigade commander's career and halt the entire drone program regardless of technical merit. The 2024-2026 Ukrainian experience documents multiple cases where FPV drones struck friendly positions because the operator misidentified or forgot to check — human error in high-tempo operations is structurally unavoidable. Automated IFF and fratricide checks eliminate the human-error mode entirely: Lisa 26 refuses to authorize an L2 strike that its own data says would hit a friendly, regardless of operator intent. This is a safety floor that cannot be bypassed by operator pressure or fatigue.

The 100 m fratricide radius combined with the 200 m trajectory-corridor check matters because it forces the FPV approach vector to be selected with deconfliction in mind. An operator planning a strike cannot simply launch a FPV toward a target — the launch point and approach heading are constrained by the blue-force corridors they must avoid. This is a doctrinal consequence of the mathematics: strike planning in a drone-enabled brigade is less about target selection and more about approach-vector selection. The Lisa 26 design reflects this by showing the operator blue-force corridors directly on the COP as exclusion zones, shaping the operator's mental model toward the correct geometric reasoning from the first engagement.

Related Chapters

Sources

Mathematical proofs. The 27-byte heartbeat packet size (4 + 12 + 2 + 1 + 8) is verified by provable_claims.py under identifier IFF_HEARTBEAT_BYTES. HMAC-SHA256 collision resistance (2.28 million years at 1000 heartbeats/sec) is verified under HMAC_COLLISION_YEARS — see whitelist.py for the authentication implementation.

Design parameters — not independently verified. The 100 m fratricide safety radius, 2-second heartbeat interval, 30-second LOST and 120-second MISSING timeouts, >85% classification confidence threshold, and 200 m friendly-trajectory deconfliction window are FSG-A design choices selected for operational balance. They are not derived from external standards and have not been validated against real mission data. Alternative values are possible and should be evaluated during an operational review.

External standards and references. Additional Protocol I, Article 36 (ICRC). NATO IFF standards. Silvus StreamCaster challenge-response authentication. Cross-references within the FSG-A wiki — fratricide geometric bounds derived from the decision-engine thresholds in lisa26-decision-engine.html; HMAC implementation detail in cybersecurity-mavlink.html; operator workload constraints governing how many deconfliction checks a human can review per cycle in human-autonomy-teaming.html.