Decoding the sky

What ADS-B is, in one page

Air traffic control has to know where every aircraft is, continuously, to keep them apart: an airliner at cruise covers 250 m every second, and the separation rules require 300 m vertically or 9 km horizontally between aircraft under radar control. For seventy years the way to know was radar: a ground station sends a pulse and times the echo, or, in the improved secondary form, interrogates a transponder on the aircraft that answers on 1090 MHz with an identity and an altitude. Radar has limits: it needs enormous power, it sees each aircraft only once per antenna rotation, and it cannot cover oceans or mountains.

ADS-B, Automatic Dependent Surveillance - Broadcast, inverts the problem. Every modern aircraft carries a satellite navigation receiver and therefore knows its own position to a few metres. ADS-B simply has the aircraft's transponder announce that position, together with its identity, altitude and velocity, about twice a second, on 1090 MHz, to no one in particular. Automatic because nothing triggers it; dependent because the information comes entirely from the aircraft's own instruments; surveillance because its purpose is knowing where aircraft are; broadcast because it is sent in the clear to anyone listening. Since 2020 it has been mandatory for most aircraft in European and American airspace. Controllers use it alongside radar, other aircraft use it to see each other, and a 25-euro USB receiver on a school roof hears exactly the same messages.

To understand the system you have to understand five things, and each is a lesson: the electromagnetic wave that carries the message; the timing that gives the aircraft its position, and that lets a network find an aircraft which will not say where it is; the digital message and how errors in it are caught; the geometry and energy that limit how far it can be heard; and the antenna and receiver that turn it back into data. The full narrative is in the reference course; read its chapters 3 and 5 before lesson 3 and chapters 6 to 8 before lessons 4 and 5.

Lesson 1

The wave: radio as invisible light

The message leaves the aircraft as an electromagnetic wave: oscillating electric and magnetic fields propagating through space with no medium, at the speed of light c = 3.00 x 10^8 m/s. Visible light is the same phenomenon at a higher frequency; your eyes respond to roughly 4 to 8 x 10^14 Hz, while ADS-B is transmitted at 1.09 x 10^9 Hz, half a million times lower. There is no difference in kind between the plane's message and the light from this screen, only in frequency.

Since the wave travels at a fixed speed, its frequency determines its wavelength. In one second the wave advances c metres and completes f cycles, so each cycle occupies c / f metres: c = f x lambda. For ADS-B, lambda = 3.00 x 10^8 / 1.09 x 10^9 = 0.275 m. The wave passing between an aircraft and your antenna has crests 27.5 cm apart, between a mobile phone signal (17 cm) and an FM radio station (3 m) on the spectrum. Draw that spectrum yourself, on a logarithmic axis from 10^6 Hz to 10^18 Hz, and place on it FM radio, ADS-B, mobile phones, Wi-Fi, infrared, visible light and X-rays. The aircraft's wave sits among the things in your pocket.

What a radio wave is not is sound. Sound is a pressure wave in a medium, travelling at 343 m/s in air, 1 500 m/s in water, and not at all in vacuum. Radio is light: it needs no medium, which is how it crosses the vacuum from a satellite to the aircraft, and it is faster by a factor of 3.00 x 10^8 / 343, about 875 000. If an aircraft 30 km away emits a sound and a message at the same instant, the message arrives in 100 microseconds; the sound arrives 87 seconds later, by which time the aircraft has flown 22 km. A rope wave shares with light the properties that matter, a wavelength, a frequency and a fixed speed, so that faster shaking means shorter waves and not faster ones; it differs in needing the rope.

One property of the wave will matter in lesson 5: its polarisation. The electric field oscillates in a definite direction perpendicular to the direction of travel. Aircraft antennas are vertical, so the ADS-B wave is vertically polarised, and a receiving antenna laid on its side intercepts almost none of it, as a rope wave shaken vertically is stopped by a horizontal slot. Predict now what will happen to your receiver's range if the antenna is horizontal; you will test it in the project.

Lesson 2

Timing and position: how the aircraft knows where it is

The position in every ADS-B message comes from satellite navigation, and satellite navigation is a measurement of time. About thirty satellites per system (GPS, Galileo, GLONASS, BeiDou) orbit at roughly 20 200 km, each with an atomic clock, each transmitting a signal that states its own position and the exact instant of transmission. The receiver on the aircraft notes the instant of arrival. The difference, multiplied by c, is the distance to that satellite; from directly overhead the signal takes 20 200 / 300 000 = 0.0673 s. One distance puts the receiver on a sphere around that satellite; two spheres meet in a circle; three meet in two points, one of them far from the Earth and discarded. Three satellites would suffice if the receiver had a perfect clock. It has a quartz crystal that drifts by microseconds, and one microsecond is 300 m of range. So the receiver treats its own clock error as a fourth unknown and uses a fourth satellite: four equations, four unknowns (x, y, z and the clock offset), solved continuously. As a by-product, every satellite receiver keeps time to tens of nanoseconds, which the second half of this lesson depends on.

Hold on to the magnitudes: light travels 0.3 m per nanosecond and 300 m per microsecond. A position accurate to 3 m means timing accurate to 10 ns. A satellite whose clock ran 1 microsecond fast would push every receiver using it 300 m along the line towards it, which is why the satellite clocks are corrected from the ground several times a day.

The aircraft carries two altitudes. The satellite solution gives a geometric height above the reference ellipsoid. But the altitude it broadcasts for air traffic purposes is barometric: the air pressure at a port on the fuselage, converted to height through the International Standard Atmosphere, which assumes 1013.25 hPa and 15 degrees C at sea level and a lapse of 6.5 degrees per kilometre. When the real pressure differs from standard, every aircraft's barometric altitude is wrong by the same amount, which is precisely what separation needs: two aircraft reading flight levels 350 and 360 are 1 000 ft apart whatever the weather. The position message carries barometric altitude in 25-foot steps; the velocity message carries the difference between barometric and geometric height. If you have a spreadsheet, invert p = p0 (1 - 0.0065 h / 288.15)^5.255 and check that at 11 000 m the pressure is about 227 hPa, less than a quarter of sea level: the air an airliner flies through would not keep you conscious.

Now reverse the whole idea. Some aircraft transmit on 1090 MHz without a position: old transponders replying to radar with only identity and altitude, or aircraft whose satellite reception is jammed. A network of receivers can still locate them by multilateration. Suppose four receivers with synchronised clocks each record the arrival time of the same transmission. A message that reached receiver A one microsecond before receiver B was sent from a point 300 m nearer to A than to B, and all such points form a hyperboloid with A and B as its foci. Three independent pairs from four receivers give three hyperboloids, which intersect at the aircraft. It is the satellite problem with known and unknown exchanged: there, one receiver and four known transmitters; here, one transmitter and four known receivers. In both, what is measured is time, and 1 microsecond is 300 m. The receivers synchronise their clocks to about 100 ns from the same satellites the aircraft uses.

You can do it with sound. Three people with stopwatches at surveyed points on a playing field; a fourth, hidden, claps once; each records the delay. With sound at 343 m/s, a 0.1 s difference is 34 m, and a scale drawing with trial positions, or a sketch of the hyperbolae, finds the clapper. Then ask what precision the stopwatches would need to do the same with radio over 200 km, and you will understand why the network needs atomic time.

Lesson 3

The message: 112 bits, and how errors are caught

The transponder sends ADS-B as a Mode S extended squitter: an 8-microsecond preamble, then 112 data bits at one bit per microsecond. The preamble is a fixed pattern of four pulses at 0, 1, 3.5 and 4.5 microseconds, and its job is to answer a question you might not have thought to ask: in a channel full of noise and of other aircraft, how does a receiver know a message has started, and when each bit begins? The decoder watches continuously for that pattern, and when it sees it, it knows both. Every digital protocol you use, from Wi-Fi to a QR code, has an equivalent.

A transmitter can be on or off; how does it send a 1 or a 0? ADS-B uses pulse position modulation. Each one-microsecond bit slot is divided into halves: a pulse in the first half and silence in the second is a 1; silence then a pulse is a 0. There is always exactly one pulse per bit. Consider why that is better than "pulse means 1, no pulse means 0". The receiver never loses its timing, even through a long run of zeros, which in the naive scheme would be indistinguishable from silence. And it decides each bit by asking which half was louder rather than whether a pulse exceeded some fixed level, so a weak signal from 400 km decodes as reliably as a strong one from overhead.

The 112 bits are laid out as follows, and you should be able to reproduce this from memory. Bits 1 to 5: the downlink format, 17 for ADS-B from a transponder. Bits 6 to 8: a capability code. Bits 9 to 32: the 24-bit ICAO address, the aircraft's permanent identity, assigned on registration; 2^24 = 16 777 216 of them exist, allocated to states in blocks, Belgium's being 448000 to 44FFFF in hexadecimal. Bits 33 to 88: the 56-bit message field, whose first five bits, the type code, say what the other 51 contain. Type codes 1 to 4 carry the call sign as eight 6-bit characters, 64 symbols each. Type codes 9 to 18 carry an airborne position: 12 bits of barometric altitude in 25-foot steps, an even/odd flag, and 17 bits each of encoded latitude and longitude. Type code 19 carries velocity as east-west and north-south ground speed components, the vertical rate, and the barometric-geometric height difference. Bits 89 to 112: the 24-bit parity. Check the arithmetic: 12 bits of altitude at 25 ft cover 102 400 ft; 17 bits used naively over 180 degrees of latitude would resolve only 1.4 km. The position is better than that because of compact position reporting: the 17 bits give the position within a zone to a few metres, not which zone, and the aircraft alternates between two zone grids, even and odd. A receiver that has heard one of each resolves the zone unambiguously and then tracks from single messages. More precision from the same bits, bought with time.

Dissect the real message from the top of this page. 8D4840D6202CC371C32CE0576098 is 28 hexadecimal digits, 112 bits. The first two digits, 8D, are 1000 1101 in binary; the first five bits, 10001, are 17, so this is ADS-B from a transponder, and the next three, 101, give capability 5. The next six digits, 4840D6, are the ICAO address, which the allocation tables place in the Netherlands. The next digit pair, 20, begins with 00100, type code 4, an identification message, and decoding the following 6-bit characters gives the call sign KLM1023. The final six digits, 576098, are the parity. With a spreadsheet or a few lines of code you can do the whole decode, and being able to look at a line of hex and say "a KLM aircraft announcing flight 1023" is the goal of this lesson.

The parity deserves the most thought. Over a busy airport, transmissions from different aircraft overlap at a receiver constantly, and individual pulses are lost to noise; a decoder will inevitably assemble wrong bits sometimes. The last 24 bits are a cyclic redundancy check: the 88 message bits are treated as one long binary number and divided, in an arithmetic where subtraction is exclusive-or, by a fixed 25-bit generator polynomial; the remainder is the CRC. The receiver repeats the division on the bits it decoded. Any single flipped bit, any two, and any burst of errors up to 24 bits long changes the remainder, and the message is rejected. Try a 4-bit CRC on an 8-bit message by hand to see the mechanism, then, if you program, implement the real CRC-24 and verify that the example message passes and that flipping any one bit makes it fail. This is error detection as every modern system does it, in a context where a missed error could put a phantom aircraft on a controller's screen.

Lesson 4

Range: the curve of the Earth and the inverse square law

How far away can a receiver hear an aircraft? Two different limits apply, and they are worth keeping separate. The first is geometric. At 1090 MHz radio does not bend around the Earth; it travels in straight lines, so a receiver hears only aircraft above its horizon, those from which a straight line to the antenna clears the ground. Derive the horizon distance. An antenna at height h above a sphere of radius R sees a horizon where its line of sight is tangent to the sphere; the tangent and the two radii form a right angle at the tangent point, so d^2 + R^2 = (R + h)^2, which gives d^2 = 2Rh + h^2, and since h is negligible against R, d = sqrt(2Rh). With R = 6 371 km and h in metres, d (km) = 3.57 sqrt(h). The atmosphere bends radio slightly downward because its refractive index falls with height; the standard correction treats the Earth as having four-thirds its true radius, replacing 3.57 by 4.12. The full line of sight from an antenna at h1 to an aircraft at h2 is the sum of the two horizon distances:

Plot d against h2 for your own antenna height. The curve is steep at first and then flattens, and it explains the shape of every receiver's coverage: 400 km and more for cruising traffic, a few tens of kilometres for aircraft on approach, nothing on the ground except at the airport next door. It explains why height is the most important property of a receiver, and why a hill, a building, or the aircraft's own wing as it banks away can cut a track instantly.

The second limit is energy. A transponder radiates a few hundred watts, roughly uniformly in all horizontal directions. At distance d that power is spread over a sphere of area 4 pi d^2, so the power intercepted by an antenna of fixed effective area falls as 1 / d^2: the inverse square law, which you should derive from the area of the sphere rather than memorise. Twice as far, a quarter of the power; ten times, a hundredth. Engineers express the loss in decibels, where 10 dB is a factor of ten in power and 3 dB a factor of two, because decibels turn multiplication across many orders of magnitude into addition. The free-space path loss between two simple antennas is:

That number is worth pausing on: a receiver on a roof is detecting a signal 10^14.5 times weaker than the one that left the aircraft, a millionth of a millionth of a watt. A good hobby receiver decodes down to about -100 dBm, so there is 9 dB in hand at 400 km. In other words the energetic limit and the geometric horizon for a cruising airliner fall in the same place, and that is by design: transponder power and receiver standards were specified so that an aircraft is audible to its horizon and not much further, which stops the channel being flooded by traffic from the next country.

Two refinements. Doppler: an aircraft approaching at 250 m/s shifts the received frequency by f v / c = 1.09 x 10^9 x 250 / 3 x 10^8 = 908 Hz, under one part per million, which a receiver never notices; compare the sound of the same aircraft, where v / c is 250 / 343 and the pitch drops by most of an octave as it passes. And time of flight: 400 km at c is 1.33 ms, so the broadcast position is already 1.33 ms old on arrival, during which the aircraft has moved 33 cm; negligible for a map, decisive for multilateration, which lives on exactly these microseconds.

Lesson 5

Antennas and receivers: from a 27-centimetre wave to a dot on a map

An antenna is a conductor in which a passing electromagnetic wave induces an alternating current, and the same device, driven by a current, launches a wave; receiving and transmitting antennas are the same thing run backwards. The induced current is largest at resonance, when the conductor's length lets the current distribution along it fit the wave's oscillation, as a string of the right length resonates with a particular note. A straight conductor's fundamental resonance is at half a wavelength, 13.75 cm at 1090 MHz, with the current greatest at the centre and zero at the ends. The practical ADS-B antenna, on aircraft and on most receivers, is a quarter-wave monopole: a vertical element of 6.9 cm on a conducting ground plane, which mirrors it so that element and image together form the half-wave dipole. On the aircraft the fuselage is the ground plane; a bought 1090 MHz antenna hides the same geometry inside its tube, stacked several times over. A home-made one is detuned by a few millimetres of error and hears a fraction of the sky, which is why the receiver of the project uses a factory-tuned antenna.

A vertical monopole is most sensitive towards the horizon and not at all along its own axis; its sensitivity in three dimensions is a ring doughnut with the antenna through the hole. So your receiver will hear aircraft 300 km away perfectly and lose one passing directly overhead for a few seconds, and you can watch this happen. A collinear antenna, several resonant elements stacked, flattens the doughnut and increases sensitivity at the horizon at the expense of the overhead hole: this is antenna gain, measured in dBi, and it comes from redistributing sensitivity, never from creating it. And from lesson 1, the antenna must be vertical, because the wave is vertically polarised.

Between the antenna and a dot on the map are four stages. A band-pass filter passes 1090 MHz and rejects the far stronger mobile-phone signals a few hundred megahertz away that would otherwise saturate everything after it. A low-noise amplifier at the antenna multiplies the signal a thousandfold before the cable, which at 1090 MHz loses about 3 dB, half the signal, every ten metres; amplify after the cable and you amplify the cable's noise too. A software-defined radio, a 20-euro USB device originally sold as a television tuner, mixes the signal down and samples it two million times a second into a stream of numbers. From here on it is programming: free software scans the samples for the preamble, measures which half of each microsecond slot carries more energy, assembles 112 bits, computes the CRC and, if it passes, decodes the fields. A tracker then pairs even and odd position frames, merges position, velocity and identity by ICAO address, and holds each aircraft's state until messages stop arriving, usually because it has dropped below the horizon.

Draw that chain, with the quantity at each stage: nanovolts at the antenna, microvolts after the amplifier, two million samples a second out of the radio, a few hundred frames a second out of the decoder, one record per aircraft out of the tracker. A dot on a map is the far end of a chain in which every link is an idea from this course: resonance, filtering, amplification, sampling, pattern matching, decoding, error checking, aggregation. The project is to build the chain and test the course against the sky: measure your maximum range against altitude and compare it with the horizon formula; compare the antenna indoors, at a window and on the roof, vertical and horizontal; log a day of traffic and find the busiest hour and the typical cruise altitude; decode raw messages and verify their CRC in your own code. And then ask the questions the system raises and does not answer: the messages are unsigned, so what stops someone broadcasting a phantom aircraft; the aircraft depends on satellites that can be jammed, so what does the controller see when they are; and the data identifies aircraft, which can identify people, so who should be able to follow whom.

Challenges

Work each one out on paper first. The check shows the answer and the reasoning.

1. 1. What is the wavelength of the 1090 MHz signal, and how long is a quarter-wave antenna for it?

   Check

2. 2. How many times faster than sound is the message? An aircraft 30 km away emits both at once; how far has it flown when the sound arrives?

   Check

3. 3. A receiver clock is wrong by 2 microseconds. What range error does that cause, and why does a satellite receiver need four satellites rather than three?

   Check

4. 4. How many aircraft can 24 bits of address identify? How long does a 112-bit message at 1 bit per microsecond last, and the whole transmission with its preamble?

   Check

5. 5. In the message 8D4840D6..., what are the downlink format and capability, and what is the ICAO address?

   Check

6. 6. A receiving antenna is 15 m up. What is the radio horizon to an aircraft at 9 000 m, and to one at 300 m?

   Check

7. 7. Why does doubling the distance quarter the received power? What is the path loss at 200 km, and how does it compare with the 145 dB at 400 km?

   Check

8. 8. Predict what happens to range if the antenna is laid horizontal, and if the receiver is moved from the roof to the ground floor.

   Check

Next

Build it

Everything in these lessons can be checked from a window. The hands-on workshop gives you the shopping list (about 100 to 150 euros, or a Raspberry Pi you already have), the antenna to choose and where to put it, the three commands that install the Dataero feeder, and the measurements that test the formulas against real aircraft: the radio horizon, the inverse square law, the daily rhythm. When your receiver feeds the map, every aircraft it hears is drawn for everyone, with your station's name on it.