The 1090 Megahertz Riddle (second edition)

A Guide to Decoding Mode S and ADS-B Signals
By: Junzi Sun (

ADS-B Basics

ADS-B is short for Automatic Dependent Surveillance-Broadcast. It is a satellite-based surveillance system. Parameters such as position, velocity, and identification are transmitted through Mode S Extended Squitter (1090 MHz). Nowadays, the majority of aircraft broadcast ADS-B messages constantly. Starting from the year 2020, civil aviation aircraft in Europe and United States are required to be ADS-B compliant. Old aircraft which are not compliant with ADS-B requirements are required to be retrofitted or phased out within a number of years.

Message structure

An ADS-B frame is 112 bits long and consists of five main parts, shown as follows:

|  DF (5)  |  CA (3)  |  ICAO (24)  |         ME (56)        |  PI (24)  |

Civil aircraft ADS-B message starts with the Downlink Format 17. It corresponds to 10001 in binary for the first 5 bits. Bits 6–8 indicated the transponder capability. After that, the 24-bit transponder code (also known as ICAO code) is included. The last two segments are 56-bit payload and 24-bit parity. Table 1.1 lists the key information of an ADS-B message.

Structure of ADS-B frame
Bit No. bits Abbreviation Information
1–5 5 DF Downlink Format
6–8 3 CA Transponder capability
9–32 24 ICAO ICAO aircraft address
33–88 56 ME Message, extended squitter
(33–37) (5) (TC) (Type code)
89–112 24 PI Parity/Interrogator ID

It is worth noting that the ADS-B Extended Squitter sent from a Mode S transponder uses Downlink Format 17 (DF=17). Non-Transponder-based ADS-B Transmitting Subsystems and TIS-B Transmitting equipment use Downlink Format 18 (DF=18). By using Downlink Format 18 instead of 17, an ADS-B/TIS-B Receiving Subsystem will know that the message comes from equipment that cannot be interrogated.


The second field of an ADS-B message consists of three bits that indicate the transponder level. The capability value can be a decimal value between 0 and 7. The definitions of these values are shown in Table 1.2.

Mode S transponder capability (CA)
CA Definition
0 Level 1 transponder
1–3 Reserved
4 Level 2+ transponder,
with ability to set CA to 7,
5 Level 2+ transponder,
with ability to set CA to 7,
6 Level 2+ transponder,
with ability to set CA to 7,
either on-ground or airborne
7 Signifies the Downlink Request value is 0,
or the Flight Status is 2, 3, 4, or 5,
either airborne or on the ground

ICAO address

In each ADS-B message, the sender aircraft can be identified using the Mode S transponder code assigned according to ICAO regulations [Blythe et al. 2011]. The Mode S transponder code is also often referred as ICAO address, or hex code.

The ICAO address is located from 9 to 32 bits in binary (or 3 to 8 in hexadecimal positions). A unique ICAO address is assigned to each Mode S transponder of an aircraft and serves as the unique identifier for each aircraft.

In principle, this code does not change over the lifetime of the aircraft. However, it is possible to reprogram a transponder so that the messages contain a different address. This has been observed for some military aircraft, as well as some private airplanes opt-in for the FAA Privacy ICAO Address System [Gray and Barrett 2019].

ADS-B message types

To identify what information is contained in an ADS-B message, we need to take a look at the Type Code of the message. The Type Code is located at bits 33–37 (or the first 5 bits of the ME segment). In the following Table 1.3, the relationships between each Type Code and its information contained in the ME segment are shown.

ADS-B Type Code and content
Type Code Data frame content
1–4 Aircraft identification
5–8 Surface position
9–18 Airborne position (w/Baro Altitude)
19 Airborne velocities
20–22 Airborne position (w/GNSS Height)
23–27 Reserved
28 Aircraft status
29 Target state and status information
31 Aircraft operation status

Example of ADS-B message structure

Let us use an example to illustrate the decoding process. First, a raw message is received, which is represented in hexadecimal format:


It can be converted into binary conveniently. The structure of the binary message is shown as follows:

| HEX | 8D         | 4840D6       | 202CC371C32CE0       | 576098       |
| BIN | 10001  101 | 010010000100 | [00100]0000010110011 | 010101110110 |
|     |            | 000011010110 | 00001101110001110000 | 000010011000 |
|     |            |              | 110010110011100000   |              |
| DEC |  17    5   |              | [4] ...............  |              |
|     |  DF    CA  |   ICAO       |          ME          | PI           |
|     |            |              | [TC] ..............  |              |

The first five bits show that the downlink format is 17 (or 10001 in binary), which indicates the message is an ADS-B message. The first five bits of the ME field shows that the type code is 4 (or binary 00100), which indicates the message is an identification message.

In this example, The ICAO address is 4840D6 (010010000100000011010110 in binary format). Various online tools can be used to find out more about the aircraft with a given ICAO address.1 For instance, using the previous ICAO 4840D6 example, it will return the result of a Fokker 70 with the registration of PH-KZD.

Try it out Using pyModeS, we can find out what information is contained in this ADS-B message:

import pyModeS as pms


         Message: 8D4840D6202CC371C32CE0576098 
    ICAO address: 4840D6 
 Downlink Format: 17 
        Protocol: Mode~S Extended Squitter (ADS-B) 
            Type: Identitification and category 
        Callsign: KLM1023_ 

Availability and transmission rate

Different ADS-B messages have different transmission rates. The update frequency also differs depending on whether the aircraft is on-ground or airborne, as well as whether the aircraft is still or moving when on the ground. Table 1.4 indicates the transmission rate of these messages.

ADS-B message transmission rates (ADS-B version 2)
Messages TC Ground (still) Ground (moving) Airborne
Aircraft identification 1–4 0.1 Hz 0.2 Hz 0.2 Hz
Surface position 5–8 0.2 Hz 2 Hz -
Airborne position 9–18, 20–22 - - 2 Hz
Airborne velocity 19 - - 2 Hz
Aircraft status 28 0.2 Hz (no TCAS RA and Squawk Code change)
1.25 Hz (change in TCAS RA or Squawk Code)
Target states and status 29 - - 0.8 Hz
Operational status 31 0.2 Hz 0.4 Hz (no NIC/NAC/SIL change)
1.25 Hz (change in NIC/NAC/SIL)

It is worth noting that for Target states and Operational status messages, when there is a change in some key parameters, the transmission is changed to a higher rate for approximately 24 seconds.

ADS-B versions

Since ADS-B was first introduced, there have been three different versions of implementations. The main reason for these updates is to include more information in ADS-B. The documentation available on these versions and differences is quite far from user-friendly. The official ICAO 9871 document [ICAO 2008] is confusing to read. In this section, I have put the difference pieces of scattered information together.

There are three ADS-B versions implemented so far, starting from version 0 (specification defined in RTCA document DO-260). Version 1 was introduced around 2008 (DO-260A), and version 2 around 2012 (DO-260B). Version 3 is currently being developed. Next, major changes in version 1 and version 2 are summarized.

From version 0 to 1

The most significant changes in version 1 are new message types and replacing the previous uncertainty indicators with the new integrity indicators. Details of all major changes in ADS-B version 1 are:

  • Added Type Code 28 and 31 messages.

    • TC=28: Aircraft status – Emergency/priority status and ACAS RA Broadcast.

    • TC=31: Operational status.

  • Removed the Navigational uncertainty categories (NUC). Introduced the new Navigation integrity category (NIC) and Surveillance integrity level (SIL).

    • Both the Type Code and a NIC Supplement bit (NICs) are used to define the NIC.

    • NIC Supplement bit is included in operation status message (TC=31).

  • The ADS-B version number is now indicated in operation status message (TC=31).

From version 1 to 2

In version 2, the integrity categories are refined comparing to version 1. Details of major changes in version 2 are:

  • Re-defined the structure and content of TC=28 and TC=31 messages.

  • Introduced two additional NIC supplement bits.

  • NICa is defined in operational status messages. (TC=31)

  • NICb is defined in airborne position messages. (TC=9–18)

  • NICc is defined in operational status messages. (TC=31)

  • Introduced an additional Horizontal Containment Radius (Rc) level within NIC=6 of the airborne position message (TC=13).

Identification of the ADS-B Version

There are two steps to check the ADS-B version, due to the fact that ADS-B version information in version 0 is not included in any message.

  1. Step 1: Check whether an aircraft is broadcasting ADS-B messages with TC=31 at all. If no message is ever reported, it is safe to assume that the version is version 0.

  2. Step 2: If messages with TC=31 are received, check the version numbers located in the bits 41–43 in ME (or bits 73–75 in the message).

After identifying the correct ADS-B version for an aircraft (which does not change often), one can decode related TC=28 and TC=31 messages accordingly.

Blythe, W., Anderson, H., and King, N. 2011. Ads-b implementation and operations guidance document. International Civil Aviation Organization.
Gray, D.E. and Barrett, C.W. 2019. Privacy impact assessment (PIA) - federal aviation administration (FAA) privacy ICAO address system. U.S. Department of Transportation.
ICAO. 2008. Technical provisions for mode s services and extended squitter. International Civil Aviation Organization.

  1. For example, an online database from OpenSky can be used:↩︎

© Copyright 2021 Junzi Sun. Build with LaTeX, Pandoc, and GitHub