Airplanes.live

How ADS-B works: what aircraft broadcast, and how anyone can hear it

There is no clever hack behind flight tracking. Aircraft announce where they are, in the clear, to nobody in particular, and a cheap radio dongle can listen.

· Airplanes.live · about 8 minutes

Ask most people how a flight tracking website knows where aeroplanes are and they will guess at something furtive: a leaked radar feed, a scraped airline system, an agency that failed to lock a door. The truth is duller and much more interesting: the aircraft are broadcasting it themselves, continuously, to anyone who cares to listen, and they have been for years because the international air traffic system decided that was a good idea.

The system is called ADS-B, and once you understand what the four letters stand for you understand almost everything about what a tracker can and cannot show you.

Four letters, one of which does all the work

Automatic. The aircraft transmits without being asked. Classic secondary radar works by interrogation: a ground station sends a pulse, the transponder replies. ADS-B skips the question. The transponder simply talks, on a schedule, forever.

Dependent. This is the load-bearing word. The aircraft does not measure its own position by any independent means. It asks its navigation system, which is almost always GNSS, and repeats the answer. The broadcast is only ever as good as the satellite fix behind it. Everything strange you will ever see on a flight tracker traces back to this word.

Surveillance. The purpose is knowing where aircraft are: for controllers on the ground, and for other aircraft with receivers.

Broadcast. No addressee, no handshake, no encryption. The message goes out omnidirectionally to whoever is in range. Air traffic control is the intended audience; it is not the only possible one, and nothing in the design pretends otherwise.

Two related terms follow from that. ADS-B Out is the transmitting half, the equipment that broadcasts the aircraft's own position. ADS-B In is the receiving half, which lets an aircraft see others. Regulators mandate Out; In is optional and much less common.

Two radio links, and why that explains a missing aircraft

ADS-B rides on two different links, and knowing which one an aircraft uses explains a lot of otherwise baffling gaps in coverage.

1090 MHz Extended Squitter ("1090ES") is the worldwide link. It reuses the same frequency and the same Mode S message format that secondary surveillance radar already used, extended to 112-bit messages that carry position and other state. Airliners use it. Anything operating internationally uses it. When people talk about ADS-B without qualification, this is what they mean, and it is what a hobby receiver is almost always listening to.

978 MHz UAT (the Universal Access Transceiver) exists only in the United States, and only below 18,000 ft. It was designed for general aviation, and it does something 1090ES does not: it carries traffic up to the aircraft as well as down, delivering free weather products and traffic information to equipped cockpits.

The practical consequence is unglamorous but important. A receiver tuned to 1090 MHz cannot hear a UAT-equipped light aircraft at all. If you are watching a small US airfield and the pattern traffic seems oddly empty, the dual link is frequently the reason: those aircraft are broadcasting perfectly well, on a frequency your antenna is not listening to.

What is actually in a message

An ADS-B transmission is short and there is no room for prose. Different message types carry different fields, transmitted at different rates:

FieldWhat it isRoughly how often
ICAO 24-bit address A unique identifier burned into the airframe's transponder, written as six hex digits. Address blocks are allocated to countries, so the code itself indicates the state of registry. In every message
Airborne position Latitude, longitude and altitude. About twice a second
Velocity Groundspeed, track, and vertical rate. About twice a second
Identification The eight-character flight ID the crew typed in (the callsign) plus a coarse aircraft category. Every few seconds
Quality indicators NIC, NACp, SIL and friends: the aircraft's own statement of how much it trusts its position. Periodically

Two of those deserve a closer look, because they are where trackers most often confuse people.

The altitude is not the height above the ground

The altitude in a position message is normally pressure altitude: what the aircraft's air data system reads with its altimeter set to the standard datum of 1013.25 hPa (29.92 inHg). It is not height above the terrain, and on a day when the local pressure is well away from standard it is not the altitude the crew is flying to either. At high level this is exactly what everyone wants, because flight levels are defined that way and every aircraft in the system shares the same reference. Down low, it is why a tracker can show an aircraft on approach at an altitude that does not match what the crew sees. Some equipment also broadcasts a separate geometric (GNSS) altitude; the two rarely agree exactly, and neither is wrong.

Position arrives in two halves

Latitude and longitude are not sent as plain coordinates. ADS-B uses Compact Position Reporting, which squeezes a position into far fewer bits by encoding it relative to a grid, and alternates between two different grids: the "even" and "odd" frames. A receiver that has just started up needs one of each, close together in time, before it can resolve an unambiguous global position. This is why an aircraft appearing at the edge of coverage sometimes shows up as a bare identifier for a few seconds before a position snaps into place. Nothing is broken; the decoder is waiting for the other half of the pair.

How far can you hear?

1090 MHz is line of sight. Not "mostly line of sight". The signal does not meaningfully bend around terrain or over the horizon, so range is a geometry problem rather than a power problem.

A useful approximation for radio horizon in nautical miles is 1.23 × √(height in feet), applied to both ends and added together. An airliner at 35,000 ft gets about 230 nm from its side of the equation alone. A receiver antenna 30 ft up adds about seven more. That is why a single well-sited receiver can plot traffic hundreds of miles away, and also why the same receiver sees nothing at all from a helicopter three miles away behind a hill.

It also explains the shape of coverage maps. Reception is a cone opening upward: excellent at altitude, poor low down, and terminated abruptly by any terrain or building in the way. Antenna height and a clear horizon beat almost any other improvement you can make.

The receiving end

A ground station for this is embarrassingly cheap. The usual recipe is an antenna cut for 1090 MHz, ideally outdoors and as high as possible; a filter and low-noise amplifier to keep nearby transmitters from swamping the front end; a software-defined radio dongle; and a small computer running an open-source decoder. The decoder demodulates the pulses, checks each message's error-detecting code, assembles positions from the even/odd pairs, and emits a stream of aircraft states.

From there, a feeder forwards that stream to a network. Aggregate a few thousand of them and you have wide-area coverage assembled entirely out of private rooftops. That is what the community-run airplanes.live network is, and it is where the aircraft data in this app comes from. It is received from the air rather than licensed from an agency feed, which turns out to matter a great deal for what ends up on the map.

MLAT: finding aircraft that don't say where they are

Not everything with a transponder broadcasts a position. Plenty of aircraft carry Mode S but not ADS-B Out: they transmit their 24-bit address and altitude in reply to interrogations, and nothing else. Older Mode A/C transponders are less helpful still: a squawk code and an altitude, with no unique address at all, and no way for a passive listener to tell one aircraft's replies from another's.

For the Mode S case there is a workaround: multilateration. If four or more receivers with tightly synchronised clocks hear the same transmission, the differences in arrival time between them define a set of surfaces that intersect at the transmitter. Solve for the intersection and you have a position the aircraft never sent.

MLAT is genuinely clever and genuinely fragile. It needs enough receivers in range simultaneously, and it needs them spread out. Several receivers clustered in one town give a poor solution no matter how many there are. Coverage is therefore patchy, tracks are noisier than ADS-B tracks, and it works best over dense feeder communities. When you see an aircraft plotted with visibly jumpier positions than its neighbours, MLAT is a fair guess.

Who has to carry it

In the United States, ADS-B Out has been required since 1 January 2020 in most controlled airspace. Broadly, that is the airspace where a Mode C transponder was already required. Europe has an equivalent mandate covering larger and faster aircraft. Between them, essentially all airline and business traffic is equipped.

Plenty of aircraft are not covered by any of it. Gliders, balloons, aircraft without electrical systems, and older light aircraft operating outside controlled airspace can legally fly with no ADS-B at all, and a great many do. This is the single most common reason an aircraft is not on the map, well ahead of anything to do with privacy or filtering.

What can go wrong

Return to that second letter. ADS-B is dependent: it repeats what the aircraft's navigation system believes, and it has no way to check. Where GNSS is jammed, aircraft lose their fix and their broadcast accuracy figures collapse. Where GNSS is spoofed, they broadcast a confident, precise, entirely wrong position. Every tracker in the world dutifully draws it.

The saving grace is those quality indicators. Because aircraft publish their own accuracy estimate alongside the position, a network can tell the difference between "here is where I am" and "here is where I am, and I no longer believe it". Aggregated over thousands of aircraft, that turns into a map of where the satellites are being interfered with, which is a whole subject of its own.

Lesser failure modes are everywhere too: messages lost to interference from the thousands of other transmissions sharing 1090 MHz, crews typing the wrong flight ID, transponders reporting an address that does not match the registry. None of it is verified by anyone. A flight tracker is a very good view of public radio traffic, and it is exactly nothing more than that. That is why it must never be used for navigation, separation, or any other purpose where being wrong matters.

The short version

Aircraft transmit their own GNSS position, twice a second, unencrypted, on a frequency anyone can receive. A rooftop antenna and a cheap dongle turn that into a data stream; a few thousand of them turn it into a worldwide map. There is no secret access involved. The only real questions are how good your antenna is and, once the data is in hand, whether anyone decided to throw part of it away before showing it to you.

Watch it happen live

Airplanes.live is a free live aircraft tracker for iPhone and iPad, built on the same volunteer receiver network described above.

Download Airplanes.live on the App Store