What's Actually in an ADS-B Message?

An ADS-B message is 112 bits. Into that envelope, Automatic Dependent Surveillance-Broadcast must pack an aircraft's identity, position, altitude, and velocity, on a frequency shared with thousands of other aircraft, with no handshake and no acknowledgment, in a format published openly enough that anyone can decode it. Almost every part of the message is a compromise with those limits.

Here is one laid out, each field sized to its share of the 112 bits. Everything reads most-significant-bit first, left to right. The address and the checksum land on byte boundaries and read directly from the hex; the type code does not, which is why a decoder works in bits, not bytes.

The 112-bit envelope

The number is not arbitrary. It follows from the radio link. This message uses the 1090 MHz Extended Squitter, usually written 1090ES, the same channel a Mode S transponder already uses to answer radar. The link runs at one megabit per second using pulse position modulation, one of the simplest schemes in digital radio: each bit occupies one microsecond, and the transmitter places a pulse in the first half of that window to mean a one and in the second half to mean a zero. A receiver does not need to lock a carrier phase or track a frequency. It only has to detect which half of each window holds the pulse.

A transmission opens with an eight-microsecond preamble, a fixed pattern of four pulses that marks the start of a message and lets the receiver set its timing. After that comes the data. A short frame carries 56 bits, used for the older surveillance replies. The long frame carries 112 bits, enough for everything ADS-B reports. At one bit per microsecond the whole long message is 112 microseconds of pulses, 120 with its preamble. Because the length is fixed and known in advance, the message needs no field telling the receiver how long it is and no marker showing where it ends. The cost is that everything an aircraft broadcasts must fit into the same 112 bits, every time.

Four bytes to name an aircraft

The first byte of the message is bookkeeping. The opening five bits are the downlink format, the value that determines how to read everything after it. A value of 17 means an extended squitter from a Mode S transponder, the ordinary case for an airliner. A value of 18 covers ADS-B from equipment that cannot be interrogated as a Mode S transponder, whether a non-transponder device broadcasting its own position or a ground station rebroadcasting traffic that radar has detected. Three more bits carry a capability code describing what the transponder can do. Then comes the field that carries identity: 24 bits holding the aircraft's ICAO address.

Twenty-four bits give a little under 16.8 million distinct addresses, and ICAO allocates them to countries in blocks. An address is assigned to an airframe when it is registered and, in principle, stays with it. It is not the tail number. The registration painted on the fuselage must be recovered from the address through a lookup, sometimes a published algorithm and sometimes a national table. What the message carries is the raw 24-bit number, here 40621D, and nothing more.

That is 32 bits of overhead before any report about the flight. The middle 56 bits carry the report, and the last 24 bits are a checksum. The design keeps the overhead small so the payload can be as large as the envelope allows.

A payload that describes itself

Fifty-six bits is not much room, and ADS-B must use it for different content at different times: a callsign, a position, a velocity. Rather than define separate message types on the radio, the format makes the payload describe itself. The first five bits of those 56 are a type code, and they tell the receiver how to interpret the remaining 51. That nests two tags one inside the other: the downlink format at the front already identified this as an extended squitter, and the type code identifies which kind.

One five-bit field turns a single message layout into many. A few type codes cover everything an aircraft routinely reports.

The message decoded here carries type code 11, an airborne position. Read the type code first and the other 51 bits resolve into a specific set of fields; read it wrong and every number after it is nonsense. The type code is the cheapest way to make one fixed-length frame carry many kinds of report.

A callsign that isn't ASCII

The identification message shows how tightly the format is packed. It has to carry the eight-character callsign a controller sees, something like a flight number, in 56 bits. A byte per character, the way text is usually stored, would need 64 bits for the characters alone, before the type code and the category field. It does not fit.

So ADS-B does not use bytes. It defines its own six-bit character set, a reduced alphabet of the capital letters, the digits, and a space, which is all a callsign needs. Six bits times eight characters is 48 bits. Add the five-bit type code and a three-bit category that sorts the aircraft into a coarse class, light or large or heavy or rotorcraft, and the total is exactly 56. The message spends nothing on characters it will never send. The same avoidance of unused capacity runs through the format, and it is sharpest in how position is handled.

The position you can't read from one message

You would expect a position report to contain a position. It does not, at least not in a form readable on its own. Latitude and longitude are never sent as plain numbers.

The reason is again the bit budget. A latitude accurate to a few meters, written as an ordinary signed number, needs about 24 bits, and a longitude needs as many again. The airborne position message allocates 17 bits to each. To fit fine resolution into that space, ADS-B uses a scheme called Compact Position Reporting, and it gains that resolution at a cost.

CPR divides the world into a grid of zones and, within a zone, spends all 17 bits on a high-resolution offset. The problem is that 17 bits of offset repeat: the same value marks a location in every zone at once. A zone is a band of latitude about six degrees tall, and the offset alone does not say which band the aircraft is in.

To recover the band, CPR sends two encodings on an alternating schedule, an even frame and an odd frame, laid on grids that divide the globe into a slightly different number of latitude bands: 60 for the even, 59 for the odd. That difference of one is what makes recovery possible. On its own, each frame gives a set of candidate latitudes, one in every band, all equally consistent with those 17 bits. The even set and the odd set are spaced slightly differently, so laid over each other they share exactly one value across the ambiguous span. A receiver that hears an even frame and an odd frame close together, before the aircraft has crossed into a new band, finds that shared value and reads the latitude. The same method fixes the longitude.

The frame above and its odd counterpart, sent moments later, resolve together to a point over the southern North Sea, 52.2572 degrees north and 3.91937 degrees east. Neither frame holds that answer alone. There is a way to avoid waiting for the pair: if a receiver already knows roughly where the aircraft is, from its own location or a previous fix, it can decode a single frame against that reference, because it only needs to pick the nearest of the repeating candidates. That is why a ground station tracking an aircraft continuously can update from every message, while a receiver hearing an aircraft for the first time waits for the pair. The wait is visible on any tracking map: an aircraft you have just begun to hear can remain invisible for a second or two, until the opposite frame arrives and fixes its first position.

Altitude is also compressed, though less severely. Twelve bits carry it, and one of those twelve is a resolution flag. In its usual setting, the other eleven bits count 25-foot steps above a floor 1,000 feet below sea level, so the 1,560 they hold here, at 25 feet a step up from that floor, comes to 38,000 feet. The position message uses barometric altitude, the pressure altitude the rest of the air traffic system is built around. A separate set of type codes reports the same position against geometric height from GNSS, the Global Navigation Satellite System, because the two altitudes are not the same number and controllers need to know which one they are reading.

Speed and climb, in a frame of their own

Velocity is not sent with position. It has its own message, type code 19, broadcast at about the same cadence. Rather than transmit a speed and a compass heading, which would fold direction and magnitude together, the common version sends two signed components, one for how fast the aircraft is moving east or west and one for north or south. Ground speed and track angle both follow from those two numbers by trigonometry, and the split keeps the encoding uniform no matter which way the aircraft points. A variant carries airspeed and heading instead, for the phases of flight where a GNSS ground velocity is not the useful figure. The same message also reports vertical rate, the climb or descent, and notes whether that rate and the altitude came from the barometric or the geometric source.

Put the two messages together, a position about twice a second and a velocity about twice a second, and a receiver has almost everything radar once provided, updated more often and more precisely, straight from the aircraft.

Error checking in 24 bits, and no one to ask again

The last 24 bits of every message are a checksum, the remainder from running the preceding 88 bits through a generator polynomial fixed across all of Mode S (1FFF409 in hex). When a message arrives, the receiver runs the same computation and compares. A mismatch means at least one bit flipped in flight, and on a channel this crowded, bits flip often. It is why a feeder's statistics always show a fraction of messages rejected, and why a distant aircraft appears only intermittently at the edge of range. Some decoders discard the bad message. Others use the checksum's structure to correct a single flipped bit or a short burst before giving up. Either way, the 24 bits are the message's only defense against a garbled copy.

The same 24 bits serve a second purpose elsewhere in the protocol. When a Mode S transponder answers a radar interrogation rather than broadcasting, the aircraft's address is XORed into the checksum instead of being sent in the clear. The receiving station computes the checksum it expects, XORs that against the field the aircraft sent, and the address is recovered, which confirms the reply came from the aircraft it interrogated. Extended squitters keep the address in the open, because a broadcast has no single intended recipient. The field serves two roles across the protocol, error check in one mode and address in another, without costing an extra bit.

What the message never receives is an acknowledgment. There is no reply confirming it arrived, no request to send it again, no connection of any kind. It is a broadcast in the literal sense, sent onto a 1090 MHz channel already crowded with radar replies and collision-avoidance transmissions from every aircraft in range, where messages regularly overlap. The design accepts that. Instead of guaranteeing any single message, ADS-B sends the next one a fraction of a second later, at intervals deliberately jittered so two aircraft do not repeatedly transmit at the same instant. Reliability comes from repetition, not from any promise built into the message.

Why the shape is the point

Read end to end, the message is small and rigid. It carries no more identity than a number. It splits a position across two transmissions to save room, encodes its text in a custom six-bit alphabet, and relies on repetition instead of acknowledgment. Each of those is a concession to the same few constraints.

The concessions are also why anyone outside air traffic control can see this data at all. A format specified this tightly is also fully published, and a broadcast with no addressing and no encryption is one that any receiver in range can decode without permission. That openness was a practical necessity for a system meant to let aircraft see each other, and it is the reason a rooftop antenna and an RTL-SDR dongle can receive the same 112-bit messages a controller uses. The physical side of that, from the antenna to the software that turns pulses into these fields, is covered in our guide to building an ADS-B receiver; what the system is and why it replaced radar is in what ADS-B is and the problem it solves.

Those decoded fields, gathered from millions of messages, are also the raw material we reconstruct flight paths from, and the shapes on the prints we make. The next time a tracking map shows an aircraft moving along its route, what actually crossed the air is a hundred-odd microseconds of pulses, twice a second, each a fixed 112 bits with just enough room to say where.