The 1090 Megahertz Riddle (second edition)

A Guide to Decoding Mode S and ADS-B Signals
By: Junzi Sun (

All-call reply

Chapter [chap:intro] shows that Mode S all-call replies can be generated by Mode S transponder to answer Mode S-only all-call interrogations and Mode A/C/S all-call interrogations.

Downlink format 11 is used for the all-call reply, and the length of the messages is 56 bits. The structure of an all-call reply message is quite simple. It only contains four fields, which are shown in Table 1.1.

All-call reply
Downlink format DF 1–5 5
Capability CA 6–8 3
Address announced AA 9–32 24
Parity/interrogator identifier PI 33–56 24

The fields can be decoded as follows:

For a message with downlink format 11, PI is overlaid with the interrogator identifier.1 Hence, assuming there is no error in the data, the CRC will produce the interrogator identifier code for all-call replies. The interrogator identifier code can be zero. In this case the message is generated due to a spontaneous acquisition squitter (see Chapter [chap:acas]).

A decoding example is shown as follows:

MSG HEX:  5D484FDEA248F5
MSG BIN:  01011   101    010010000100111111011110  101000100100100011110101
          [DF=11] [CA=5] [AA=484FDE]               [CRC=22]

With the capability value (CA=5), we can see the aircraft has a Level 2+ transponder, with the ability to set CA to 7 and that it is airborne. The CRC remainder indicates the interrogator identifier code is 22.

Try it out Using pyModeS, we can obtain the ICAO address as:

import pyModeS as pms

msg = "5D484FDEA248F5"



  1. In fact, PI in ADS-B is also overlaid with the interrogator identifier. However, since ADS-B is not interrogation-based, the identifier is set to 0. Thus, PI is always the same as the CRC remainder in ADS-B.↩︎

© Copyright 2021 Junzi Sun. Build with LaTeX, Pandoc, and GitHub