29 June 2015

Unid OFDM 16-tone 75 Bd, 110 Hz (MS 188-110A App.A modified?)


I had this signal via Twente SDR on USB 14301.8 (cf)  on 28/06/15 (1710z) just in the well-known 20 mt reserved band, an that's a bit odd.
The waveform is an OFDM 16-tone PSK, 75 Bd and 110 Hz shift, sent in burst mode. It is very similar to the obsoleted Standard NATO MIL 188-110A Appendix A without the doppler tone @ 605 Hz and in not-continuous mode.
 
OFDM parameters
There is a Chinese variant of the MIL 188-110A 16 channels: it could be this case, but I could not find info or logs about it. The burst mode could lead to something like a selcall waveform but the ~720mS spaced "pips" looks like a TDMA.
Hope to get more info and/or more records.

A short recording can be downloaded from here:

27 June 2015

Unid FSK-8 + PSK-2 1200 Bd (prob. AX-25)


Recordered this morning on 19304.0 USB (central frequency 19305.0) starting from 0937z until 1020z (s/off). The trasmission  heard consists of a series of short messages in PSK-2 1200 Bd (as well as some short bursts) along with 9-tones intervals. Sometimes a PSK-2 100 Bd preamble is sent. 

9-tones and PSK-2 1200 Bd insertions
PSK-2 1200 Bd, carrier ~1060 Hz
the 9 tones, top and bottom @ 7dB higher

PSK-2 100 Bd preamble
The transmission ended with a short CW/Morse message, decoded as "RFM U NIL SK 73" (more likely the '73' stands for greetings, as in HAM world).

 
The same waveform has been reported in radioscanner.ru:
http://www.radioscanner.ru/forum/index.php?action=search&loc=1&forum=21&topic=36750&page=1179863
and it is still un-identified.

Unid FSK 50/500



This signal was heard on 14568.0 (cf) around 1410z, 25 Jun. It's a sync FSK 2-carriers with shift = 500 Hz and baudrate = 50 Baud. ACF160ms with odd 2 bits stop and apparently no start bit.







25 June 2015

SERDOLIK sync marker (idling)

24/06/15 16047.0 --- Russian Gov 0918 Serdolik sync marker




The sync marker sequence is sent alone or after a Serdolik Selcall as shown below

Serdolik Selcall and Sync Marker (courtesy of KarapuZ)
Serdolik, as several time reported in this blog, is a complex system used by Russian Gov/Diplo and designed to connect embassies and diplomatic missions. The link below is a little story of this system:
http://www.sozvezdie.su/museum/sura__posolskaya_svyaz_dlya_sssr/ 
Thanks to KarapuZ for the link and the Sedolik Selcall waveform.

20 June 2015

WINMOR-500

18/06/15 10146.0 HB9AK Winlink Mail Server 0700  Winmor-500

The WINMOR (WINlink Message Over Radio) protocol is intended to be used for sending messages and binary data error free over a HF radio link. It is a Selective Repeat Automatic Retry reQuest (SRARQ) protocol where the Information Receiving Station (IRS) acknowledges receipt of the data to the Information Sending Station (ISS). Normally during a connection session the IRS and ISS exchange roles multiple times. The protocol is designed to handle the type conditions normally encountered in amateur radio transmission. WINMOR is not optimized for keyboarding or chat mode applications though this may be possible.

The WINMOR protocol uses basic OFDM (Orthogonal Frequency Division Multiplexing) modulation and a number of modulation modes and error correction schemes to adapt to changing channel conditions.
There is currently 2 operating bandwidths of 500 and 1600 Hz (@ 26 db below peak power output:
  • 500 Hz BW 2 carriers 46.875 Baud 4FSK or 93.75 baud PSK
  • 1600 Hz BW 8 carriers 46.875 Baud 4FSK or 93.75 baud PSK
Pic. 1a - WINMOR-500 data frames
Pic. 1b - 4FSK grid

I recently heard (18 June, Pic. 1) the WINMOR 500 Hz bandwidth mode around 0700z on 10146.0 KHz (center frequency). As said, the 500 Hz bandwidth mode use 3 modes PSK:
- 4PSK TCM, 8PSK TCM, 16PSK TCM  - 2 Carriers at 1406.25 Hz and 1593.75 Hz
and one 4FSK mode:
- 2 groups of 1 of 4 Carriers. (2 carriers active simultaneously)
  Group 1: 1312.5, 1358.375, 1406.25 and 1453.125 Hz
  Group 2: 1546.875, 1593.75, 1640.625 and 1687.5 Hz

 
A WINMOR frame is composed of a Pilot ("leader" of the frame) and Data. The Pilot is used to enable rapid identification of a transmission, to DSP tune the receiving station accurately, to establish symbol and frame sync and to indicate the frame type:
Data frames:
- Two carrier 8PSK (Pic. 2)
- Two carrier 4FSK (Pic. 3)  
Control frames:
- Connect ReQuest frame: 2 Car 4FSK
- Coded Control Frame: 2 Car 4FSK (Pic. 3,4,5)
- Ack: 2 Car 4FSK FEC (Pic. 4)

- ID frame: 2 Car 4FSK (Pic. 5)

Pic.2 - 16QAM data frame
 
Pic.3 - 4FSK data frame and control frames

Pic. 4 - control frame and ACK frame
Pic. 5 - control frame and ID frame

17 June 2015

Harris RF-5800 'Selective Call', MSK 2000Bd/1000

('Systeme3000-ALE' equivocation)
 
(AngazU,I56578)

We recently had the opportunity to get and study the Harris Selective Call waveform (we name it as Harris-ALE but it's not its official name!): it's an MSK modulation at 2000 Baud speed, followed by short MFSK-8 125 Baud in non-standard MS-188-141A (ALE), acf is 50 ms (100 bit). We focused on the initial 3 seconds segment in order to define modulation mode and other features in order to help to clarify the above misunderstanding (see later).

At first glance it looks like a serial-tone signal: carrier frequency 1600 Hz and OQPSK modulation at 2000 Bd speed (pic. 1). As reported in this article by Sergey Makarov (SergUA6) http://signals.radioscanner.ru/info/item281/ "it is not easy to tell apart between QPSK and MSK since they are tightly connected".

Pic. 1- Harris Selective Call and its phase-plane
By measuring the main parameters of the signal we had (pic.2):


baudrate (Br) = 2000 Bd

bandwidth (Bw) ~ 3000 Hz

shift (Sh) = 1000 Hz

Pic. 2
That said, and according to what reported here http://signals.radioscanner.ru/info/item68/ we are pretty sure that the Harris Selective Call is not an OQPSK but rather an MSK 2000/1000 waveform, 2000Baud speed and 1000Hz shifted. As it is clearly visible in pic.2, are verified those relationships that are specific to MKS signals, i.e.: Bw = 1.5 Br and Sh = Br/2 as shown in the cited article (pic.3):

Pic. 3 - MSK relationships (from radioscanner.ru)

  
Moreover, into the Harris signal, there is another clue that points to MSK. As you can see in the picture 4, there is a long state staying in one frequency, if should it be PSK, the frequency should come back to carrier and stay there till a new phase change. 
 
Pic. 4


 The shape of the eye diagram (pic. 5) also points in this direction (MSK with BT = 0.3):

Pic. 5
The Harris signal has an ACF value of 50 mSec (100 bit) and it is characterized by the presence of what looks like a signature, something like a 'business card':

  
As said, this is a safe-origin signal since it was recordered some years ago during Harris RF-5800 acceptance tests: at that time it was supposed to be standard in Falcon-II series radios. Harris equipment is wide spread in NATO countries, but this mode, although available, seems to be not much used.

With these points in mind, we asked ourselves the question that we indicated at the beginning: the so-called Thales “Systeme3000-ALE” (reported also in a post on this blog) has a waveform that is very similar to the Harris-ALE' one, also aurally they just sound in the same way. Browsing the web, there are logs by listeners reporting both the signals: altought the Thales waveform be almost 99.99% OQPSK, may be the case that these two signals could be confused each other ?

9 June 2015

Chinese mixed mode QPSK 2400Bd + MFSK-8 125Bd

As reported in the log of 5 June
05/06/15 16148.5 --- Chinese Mil 2105 USB mix mode: MFSK-8 (125/250) + QPSK 2400Bd
05/06/15 16148.5 D54 Chinese Mil 2103 USB MIL 188-141A clg N50
on 16148.5 USB I heard the callsign D54 calling N50 using the MIL 188-141A protocol, both the callsigns belong to a Chinese Mil network. After a few seconds the M188-141A was followed by an odd bursty waveform sounding like the previous ALE but un-decodable (signal 1 in pic.1).

Pic. 1
Talking with KarapuZ about this signal he told me that is a mixed mode QPSK 2400Bd + MFSK-8 125Bd used by Chinese Military (signal 2 in pic.1) and he provided me a recording of this waveform.
As said above, the MFSK segments are manipulated at 125 Baud and consist of eight tones, 250 Hz spaced, just like the standard MIL 188-141A (pic. 2); trying to decode it you do not get anything although the tones are in the expected position: k500 recognizes it as [AQC mode], but it's clearly wrong, while other deciders prints non-sense ASCII strings.

Pic.2 MFSK-8
Perhaps they do not use this MFSK waveform as an ALE resource since they just use the standard MIL 188-141A, as reported by many listeners and in my logs too.
About the PSK segments it was pretty easy to get its boudrate and carrier (2400Bd and 1800 Hz), unfortunatelly not the same thing for the phase-plane (pic. 3): a better signal could help.

Pic.3
Both the two recordings are downloadable from here:
https://www.dropbox.com/s/bvhodhs85wfekpy/mix%20mode%20chinese.wav?dl=0
https://www.dropbox.com/s/gg5mlbob31i00y9/05-Jun-2015-211122%2016.148500%20MHz.wav?dl=0