Mode S CRC checker

How this works

One checksum, three meanings

Every Mode S frame ends in 24 bits of checksum. What is left over after checking it (the residual) means different things depending on the downlink format. On a DF17 or DF18 broadcast the parity is a plain checksum, so the residual should be zero. On a DF11 all-call reply the interrogator code is mixed in, so the residual is that code. On DF0, 4, 5, 16, 20 and 21 the aircraft address is mixed in, so the residual is the address itself. Same arithmetic, three different answers.

Single-bit error correction

The CRC code is linear. Flipping bit i always shifts the residual by a fixed amount that depends only on i. A broken broadcast can be tested against all 112 of those shifts. If one matches, that is the bit that changed. Receivers use this constantly, which is why a noisy antenna still produces usable traffic.

8D40621D58C382D690C8AC2863A7

Original residual

000000

Click a character above

—

Why two-bit repair is not offered

There are 6,216 pairs of bit positions in a 112-bit frame against only 24 bits of residual to match. A false repair at two bits is no longer a rare accident. Single-bit repair is a strong hint, not a certainty, for the same reason. Surveillance replies get no verdict at all: with the address XORed into the parity there is nothing left to check against.