Every airliner over Colorado Springs announces its identity, altitude, position, and velocity several times a second on 1090 MHz, and a PlutoSDR at a window can hear them. The figure is today’s receiver, L18-adsb-rx.grc, playing a simulated recording of four aircraft near USAFA. Each spike in the left plot is one message, 120 µs long; the right plot zooms in on one of them; and the table at the bottom fills in as gr-adsb, GNU Radio’s ADS-B module, decodes each message.

After a first look on the air, the topics and their order follow the 2025 slides: what ADS-B is, its pulses, a generator that builds them, the message, and the tools that decode it. We build the generator in GNU Radio, decode it with gr-adsb’s blocks, then point the receiver at the sky.

Automatic Dependent Surveillance–Broadcast (ADS-B) lets an aircraft tell everyone around it where it is. “Automatic” means no one has to ask, “dependent” means the position comes from the aircraft’s own GPS, and “broadcast” means anyone can listen: air traffic control, other aircraft, and us.

It grew out of Mode S (Mode Select), the transponder system that answers a secondary radar’s interrogation on 1030 MHz with a reply on 1090 MHz. Mode S defines many message formats, and ADS-B adds one more: an extended squitter, a 112-bit message the transponder sends without being asked. Its Downlink Format (DF) number is 17; DF 18 is the same message from a device that is not a transponder, such as a ground vehicle. In the US, small aircraft below 18,000 ft may instead use UAT on 978 MHz, a different waveform that this lesson does not cover. The 1090 MHz Riddle, by Junzi Sun, is the reference the slides use for every detail of the message.

The first look uses the same flowgraph as the rest of the lesson, with the PlutoSDR in place of the recording:

1. Open L18-adsb-rx.grc, select the SigMF Source and the Throttle, and press D to disable both. Select the gray PlutoSDR Source and AGC and press E to enable them. The Pluto’s URI is ip:192.168.2.1, its center frequency is the variable fc, 1090e6, and it samples at 2 MS/s. The AGC scales the signal so the strongest recent pulses reach a power near 1, whatever the gain and the distance, so the plots and the Framer threshold keep their meaning.

2. Put the Pluto’s antenna on its RX port and the Pluto at a window, and run the flowgraph.

3. Watch the 20 ms plot. ADS-B is not a steady carrier: it is short spikes of power, scattered in time, more of them when aircraft are close. Each one is a message.

4. Watch the Aircraft label. Each aircraft appears once gr-adsb has decoded a message from it, and its position appears once it has decoded an even and an odd position message, as the ME frame explains.

If nothing appears in a few minutes, raise the Pluto RX gain slider and try another window. On the SDR, at the end of the lesson, sets the gain and the Framer threshold.

ADS-B turns the carrier on and off, which is amplitude modulation, and the bit lives in where the 0.5 µs pulse sits within its 1 µs: a 1 puts the pulse in the first half and a 0 in the second. That is pulse-position modulation (PPM), and it sends 1 million bits a second. Every bit holds exactly one pulse, so a receiver decides each bit by comparing the two halves, and it never needs to know how strong the aircraft is.

Each message starts with an 8 µs preamble of four pulses, at 0, 1.0, 3.5, and 4.5 µs, which no run of data bits can imitate. The 112 bits follow, so a whole message lasts 120 µs. At 2 MS/s every half bit is one sample, which we call a chip: the preamble is 16 chips and the message 224.

The slides build their test signal in steps: PPM, then AM on a carrier, then noise. L18-adsb-tx.grc does the same in GNU Radio. The ADS-B Out block is an Embedded Python Block, the kind the L11 lesson built, and it writes the chips of every message for four simulated aircraft near USAFA. Float To Complex and a Multiply put those chips on a carrier 75 kHz from the center, the Noise Source adds noise, and a SigMF Sink writes 0.5 s to L18-adsb-sim.sigmf-data with its sample rate and the 1090 MHz center frequency in L18-adsb-sim.sigmf-meta, whose description says Simulated.

The aircraft send ten or more times as often as real ones do, so the half second holds about 75 messages. Nothing transmits: the last block is a file sink. A second flowgraph, L18-adsb-tx-pluto.grc, sends the same aircraft from a PlutoSDR at 915 MHz into a cable through the 30 dB attenuator instead, never at 1090 MHz; On the SDR uses it.

The slides’ fourth objective is to develop a PPM modulation block, and the code above is the heart of ours: the preamble’s 16 chips, then two chips for each of the 112 bits. Around it, the block builds each message from the aircraft list at the top of its code, using the encodings the next frames describe, and computes the 24 parity bits from the first 88. It then places each message at a random time, so messages from different aircraft sometimes overlap, as they do in the sky.

Double-click the block in GRC and choose Open in Editor to see all of it. The list AIRCRAFT holds each aircraft’s address, callsign, position, altitude, speed, and heading; add a fifth aircraft there, run the generator, and the receiver shows it.

The slides’ example, 8D4840D6202CC371C32CE0576098, comes from Sun’s book. Its first byte, 8D, is DF 17 and CA 5; the aircraft’s address is 4840D6; and its ME field decodes to the callsign KLM1023. The parity bits are computed from the first 88 with a fixed 25-bit generator, and the receiver repeats that calculation: if a single bit arrived wrong, the result disagrees and the message is dropped. gr-adsb’s Decoder does this for us.

The first 5 bits of the ME field are its type code, which says how to read the other 51. An identification message carries the callsign as eight 6-bit characters. An airborne position message carries the altitude in 25 ft steps and a compressed latitude and longitude. A velocity message carries the east and north speeds, from which the decoder finds ground speed and track, and the climb rate. Sun’s book lists every type code; these three are the ones gr-adsb’s table shows.

Position takes a little care. To fit in 34 bits, it is sent in Compact Position Reporting (CPR), which gives the position within one of many zones but not which zone. Aircraft alternate two zone sizes, called even and odd, and a receiver either pairs an even and an odd message or uses a reference position it already knows within 180 nautical miles. gr-adsb pairs them: once it holds an even and an odd message from the same aircraft, received within 30 s of each other, it works out the zone and the position, wherever the receiver is. That is why an aircraft’s position appears a moment after its callsign.

The receiver is short, because PPM needs only the size of each sample, not its phase. The SigMF Source plays the recording and the Throttle paces it at 2 MS/s; for live signals, the PlutoSDR Source and the AGC replace both. An Add mixes in noise from the Added noise slider. Complex to Mag^2 gives each sample’s power, \(I^2 + Q^2\), which is the pulse train; gr-adsb’s examples use power rather than magnitude, so we do too.

Two QT GUI Time Sinks show it. The left one runs freely over 20 ms, so each message is a spike. The right one is triggered: it waits until the power crosses 0.3, then freezes 60 µs starting just before that point, so we see the preamble’s four pulses and the first bits of one message. The three gr-adsb blocks, under ADS-B in GRC’s block list, decode it; radioconda installs them as the package gnuradio-adsb.

Each gr-adsb block does one step. The ADS-B Framer watches for power above its Detection Threshold, set by the Framer threshold slider. At each pulse it checks the next 16 chips against the preamble: chips 0, 2, 7, and 9 must be more than half as strong as the first pulse and the others weaker. A match gets a tag that marks the start of a burst. The ADS-B Demod reads the 112 chip pairs after each tag, calls a bit a 1 when the first chip of its pair is larger, and sends the bits on as a message. The ADS-B Decoder checks the parity and drops a message that fails; its Error Correction is set to None, so it does not try to repair one. It then reads the extended-squitter fields (DF 17, and DF 18 from devices that are not transponders) and keeps a list of aircraft.

With its Print Level set to Verbose, the Decoder prints every field of every message in the GRC console, for example Callsign: KLM1023; on the air the console fills quickly, so read the table. The console’s Heading is measured counterclockwise from east, and the Aircraft Table turns it into a compass track, the number a flight tracker shows. The Decoder’s Brief setting draws a live table in a terminal window instead, which GRC’s console cannot show. Our Aircraft Table block decodes nothing; it shows what the Decoder sends it. The Messages label counts the bursts the Demod found and the messages the Decoder decoded into an identity, a position, or a velocity, and both start over when a slider moves.

The figure raises the added noise to 0.15. The floor of the 20 ms plot climbs until only the two strongest aircraft stand clearly above it. The weaker two still send, but a noise peak now beats a pulse in some chip pair of almost every message, the parity fails, and they drop out of the table. Even the strong two decode less often: the Framer’s threshold, 0.01, is now below the noise, so the Framer sees pulses everywhere and finds fewer real preambles.

Now raise the Framer threshold to 0.1, above most of the noise and below the strong pulses. The two strong aircraft then decode about twenty times as often, and the weak two stay gone, because their pulses no longer stand above the threshold. A real receiver sees the same thing with distance. A nearby aircraft decodes cleanly, a distant one decodes only now and then, and one past the horizon not at all.

The slides list three tools, and one of them, gr-adsb, by Matt Hostetter, is what we use: an out-of-tree GNU Radio module that radioconda packages as gnuradio-adsb. On the recording it lists all four aircraft with the callsigns, altitudes, speeds, tracks, and positions in the generator’s AIRCRAFT list. gr-air-modes, by Nick Foster, is the other GNU Radio module for Mode S; its modes_rx program decodes from a radio and can feed a map, and we name it here so you know it when you see it. Optional: outside GNU Radio, dump1090 and SDRangel, the slides’ other two tools, decode ADS-B, and SDR Flex or GQRX with an RTL-SDR gives the same first look as the Pluto.

Live aircraft. With the PlutoSDR Source and AGC enabled and fc at 1090e6, start the Pluto RX gain near 50 dB. The AGC brings the strongest pulses near a power of 1. Read the noise floor on the 20 ms plot and set the Framer threshold above it and below the spikes; if the Messages label counts bursts but few decode, the threshold is too low, and if weak aircraft never appear, it is too high. Live traffic needs a trigger level of its own: lower the right-hand time sink’s trigger level, in its settings, until it freezes on preambles and not on noise. A quarter wavelength at 1090 MHz is about 6.9 cm, so a small antenna works, and a window facing the approach to Colorado Springs or Denver works best.

Your own aircraft. We never transmit on 1090 MHz. L18-adsb-tx-pluto.grc sends the generator’s aircraft from a PlutoSDR at 915 MHz instead, into a cable from the Pluto’s TX port through the 30 dB attenuator to a Pluto’s RX port: its own, or a second Pluto’s. Or, if I say so, it goes over the air at 915 MHz at low power. Run it, set fc in L18-adsb-rx.grc to 915e6, and run the receiver with its PlutoSDR Source and AGC enabled; the generator’s aircraft fill the table at the default settings. With two Plutos on one laptop, give each flowgraph its Pluto’s usb: URI, as Lesson 17 does. On one Pluto, the transmitter and receiver share one sample-rate clock, so keep both at 2 MS/s, start the transmitter first, and expect a brief glitch when the receiver starts. Never set TX attenuation below 30 dB or change the slider’s range.

Anyone may receive ADS-B. Transmitting it is another matter: 1090 MHz carries the replies that air traffic control and collision-avoidance systems depend on, and nothing in a message proves who sent it, which is why false targets are a research topic (the Magazu AFIT thesis linked below).

Today we built ADS-B messages as pulses, received them as power with a triggered plot, and decoded them with gr-adsb, whose blocks find the preamble, compare chip pairs, and check the parity. Lesson 19 turns to AIS, which does the same job for ships on VHF, with FM in place of pulses and a CRC in place of Mode S parity.

The L18–L19 Lab follows Lesson 19. You build an ADS-B receiver on the PlutoSDR yourself with gr-adsb, decode the aircraft overhead and compare them with a public flight tracker, then build an AIS receiver and decode a recording of ships.