The 1090 Megahertz Riddle (second edition)

A Guide to Decoding Mode S and ADS-B Signals
By: Junzi Sun (

ADS-B Basics

ADS-B is short for Automatic Dependent Surveillance-Broadcast. It is a satellite-based surveillance system. Parameters such as position, velocity, and identification are transmitted through Mode S Extended Squitter (1090 MHz). Nowadays, the majority of the aircraft are broadcasting ADS-B messages constantly.

Message structure

An ADS-B frame is 112 bits long and consists of 5 main parts, as follows:

|  DF (5)  |  CA (3)  |  ICAO (24)  |         ME (56)        |  PI (24)  |

Any ADS-B message must start with the Downlink Format 17. In case of a TIS-B message, the Downlink Format is 18. They correspond to 10001 or 10010 in binary for the first 5 bits. Bits 6-8 are used as an additional identifier, which presents different meanings within each ADS-B subtype.

In Table 1.1, the key information of an ADS-B message is listed.

Structure of ADS-B frame
Bit No. bits Abbreviation Information
1-5 5 DF Downlink Format
6-8 3 CA Transponder capability
9-32 24 ICAO ICAO aircraft address
33-88 56 ME Message, extended squitter
(33-37) (5) (TC) (Type code)
89-112 24 PI Parity/Interrogator ID

It is worth noting that the ADS-B Extended Squitter sent from a Mode S transponder uses Downlink Format 17 (DF=17). Non-Transponder-Based ADS-B Transmitting Subsystems and TIS-B Transmitting equipment use Downlink Format 18 (DF=18). By using DF=18 instead of DF=17, an ADS-B/TIS-B Receiving Subsystem will know that the message comes from equipment that cannot be interrogated.


The second field consists of three bits that indicate the transponder level. The capability value can be between 0 and 7. The definitions of these values are shown in Table 1.2.

Mode S transponder capability (CA)
CA Definition
0 Level 1 transponder
1-3 Reserved
4 Level 2+ transponder,
with ability to set CA to 7,
5 Level 2+ transponder,
with ability to set CA to 7,
6 Level 2+ transponder,
with ability to set CA to 7,
either on-ground or airborne
7 Signifies the Downlink Request value is 0,
or the Flight Status is 2, 3, 4 or 5,
either airborne or on the ground

ICAO address

In each ADS-B message, the sender (originating aircraft) can be identified using the Mode S transponder code assigned according to ICAO regulations . The Mode S transponder code is also often referred as ICAO address, or hex code.

The ICAO address is located from 9 to 32 bits in binary (or 3 to 8 in hexadecimal positions). A unique ICAO address is assigned to each Mode S transponder of an aircraft and serves as the unique identifier for each aircraft.

In principle, this code does not change over the lifetime of the aircraft. However, it is possible to reprogram a transponder so that the messages contain a different address. This has been observed in military aircraft and private airplanes opt-in for the FAA Privacy ICAO Address System .

ADS-B message types

To identify what information is contained in an ADS-B message, we need to take a look at the Type Code of the message. The Type Code is located at bits 33 - 37 (or the first 5 bits of the ME segment). In following Table 1.3, the relationships between each Type Code and its information contained in the ME segment are shown.

ADS-B Type Code and content
Type Code Data frame content
1 - 4 Aircraft identification
5 - 8 Surface position
9 - 18 Airborne position (w/ Baro Altitude)
19 Airborne velocities
20 - 22 Airborne position (w/ GNSS Height)
23 - 27 Reserved
28 Aircraft status
29 Target state and status information
31 Aircraft operation status

Example of ADS-B message structure

Let us use an example to illustrate the decoding process. First, a raw message is received, which is represented in hexadecimal format:


It can be converted into binary conveniently. The structure of the binary message is shown as follows:

| HEX | 8D         | 4840D6       | 202CC371C32CE0       | 576098       |
| BIN | 10001  101 | 010010000100 | [00100]0000010110011 | 010101110110 |
|     |            | 000011010110 | 00001101110001110000 | 000010011000 |
|     |            |              | 110010110011100000   |              |
| DEC |  17    5   |              | [4] ...............  |              |
|     |  DF    CA  |   ICAO       |          ME          | PI           |
|     |            |              | [TC] ..............  |              |

The first five bits show that the downlink format is 17 (or 10001 in binary), which indicates the message is an ADS-B message. The first five bits of the ME field shows that the type code is 4 (or binary 00100), which indicates the message is an identification message.

In the example above, The ICAO address is 4840D6 (or 010010000100 in binary format). Various online tools can be used to find out more about the aircraft with a given ICAO address.1 For instance, using the previous ICAO 4840D6 example, it will return the result of a Fokker 70 with the registration of PH-KZD.

Try it out Using pyModeS, we can find out what information is contained in this ADS-B message:

import pyModeS as pms


         Message: 8D4840D6202CC371C32CE0576098 
    ICAO address: 4840D6 
 Downlink Format: 17 
        Protocol: Mode~S Extended Squitter (ADS-B) 
            Type: Identitification and category 
        Callsign: KLM1023_ 

Availability and transmission rate

Different ADS-B messages have different transmission rates. The update frequency also differs depending on if the aircraft is on-ground or airborne, as well as if the aircraft is still or moving when on the ground.

In Table 1.4, the transmission rate of these messages are indicated.

ADS-B message transmission rates
Messages TC Ground (still) Ground (moving) Airborne
Aircraft identification 1-4 0.1 Hz 0.2 Hz 0.2 Hz
Surface position 5-8 0.2 Hz 2 Hz -
Airborne position 9-18, 20-22 - - 2 Hz
Airborne velocity 19 - - 2 Hz
Aircraft status
Target states 29 - - 0.8 Hz
Operational status

For Target states and Operational status messages, when there is a change in some key parameters, the transmission is changed to a higher rate for approximately 24 seconds.

ADS-B versions

In this section, we are going to look into different versions and the evolution of ADS-B.

Since ADS-B was first introduced, there have been three different versions of implementations. The main reason for these updates is to include more information (types of data) in ADS-B. The documentation available on these versions and differences is quite far from user friendly. The official ICAO 9871 document is confusing to read. In this section, I have put the difference pieces of scattered information together.

There are three versions implemented so far, starting from version 0. The version 1 is introduced around 2008, and the version 2 is introduced around 2012. Major changes in version 1 and version 2 are listed as follows:

From version 0 to 1

The changes introduced in version 1 are summarized as follows:

  • Added Type Code 28 and 31 messages.

    • TC=28: Aircraft status - Emergency/priority status and ACAS RA Broadcast.

    • TC=31: Operational status.

  • Removed the Navigational uncertainty categories (NUC). Introduced the Navigation integrity category (NIC) and Surveillance integrity level (SIL).

    • Type Code and a NIC Supplement bit (NICs) are used to define the NIC.

    • NIC Supplement bit included in operation status message (TC=31).

  • The ADS-B version number is now indicated in operation status message (TC=31).

From version 1 to 2

The changes introduced in version 2 are summarized as follows:

  • Re-defined the structure and content of TC=28 and TC=31 messages.

  • Introduced two additional NIC supplement bits.

  • NICa is defined in operational status messages. (TC=31)

  • NICb is defined in airborne position messages. (TC=9-18)

  • NICc is defined in operational status messages. (TC=31)

  • Introduced an additional Horizontal Containment Radius (Rc) level within NIC=6 of the airborne position message (TC=13).

Identification of the ADS-B Version

There are two steps to check the ADS-B version. This is because ADS-B Version 0 is not included in any message.

  1. Step 1: Check whether an aircraft is broadcasting ADS-B messages with TC=31 at all. If no message is ever reported, it is safe to assume that the version is Version 0.

  2. Step 2: If messages with TC=31 are received, check the version numbers located in the bits 41-43 in ME (or bits 73-75 in the message).

After identifying the correct ADS-B version for an aircraft (which does not change often), one can decode related TC=28 and TC=31 messages accordingly.

  1. For example, an online database from OpenSky can be used:↩︎

Site maintained by @junzis. Build with LaTeX, Pandoc, and GitHub