CIS-11 (TORG 10/11)

CIS-11 (also designated as TORG 10/11) is a synchronous, duplex ARQ system requiring separate forward and return links. It's used mainly for aeronautical weather reports in CIS, thus transmissions normally take place in M2 alphabet (Cyrillic third-shift ITA-2). Modulation used is FSK2, usually 100Bd and 500Hz shift with 11-bit period (figure 1).

Fig. 11

Its characteristic 11-bit format consists of the 5 bits of the ITA-2 alphabet d4-d0 (but in reversed bit order: d0-d4), 2 system state bits s0 and s1 and 4 parity bits p0-p4: the checksum is calculated by modulo-2 addition from all 7 other bits (d4-d0 + s0-s1) as: 

p0 = d1 + d3 + d4 + s0
p1 = d0 + d2 + d4
p2 = d0 + d1 + d3 + s1
p3 = d0 + d2 + d3 + s0 + s1

Fig. 2

I wrote a simple Octave script (CIS11_detect.m) just to check CIS-11 streams and extract the 5-bit data in case of  successful result:

## usage: CIS11_detect(fn,e)
## input:  fn ... filename containing a string of 0's and 1's (no space between)
##         e  ... 0 doesn't exctract data
##            ... 1 extracts M2 data
## output: m  ... CIS-11 parity bits success [0..1]
##         a  ... aligned bit frames: parity bits in a(8:14), in case m > 0.9
##         fn_M2-data.txt
##                ASCII file with the exctracted data, in case m > 0.9 and e = 1

CIS11_detect is downloadable from:

https://yadi.sk/d/FXe96jvqNZoreQ

(you will need the GNU Octave package [1] to run the script).

I checked two transmissions and results are shown in Figs. 3,4; note the values of the system state bits (the two solid columns) in the two streams.

Fig. 3

Fig. 4

The system state bits signal the link state and traffic information, below a possible relationship just based on the (few) analyzed recordings:

00   - idle or Request
01   - ?
10   - Cyrillic
11   - Latin

transition to Cyrillic traffic is signaled by 00000 10

transition to Latin traffic is signalled by 11111 11

CIS-11 uses also two "idle signals", according to ITU-R F.342-2 [2]): idle signal α "01101 00 1100" is used when no data to transmit is available and mantains sync between transmitting and receive modems; idle signal β "10101 00 0001" is the ARQ request character. It's to note that:

- both the idle signals have the system state bits set to 00
- if shifted(!) the idle signal β is CIS-11 compliant (look at start bit offset in Fig.5)
- idle signal α is a LFSR x^3+x^2+1 sequence, the 7-bit sequence is used in d0-d4,s0-s1 bits
- idle signal β can be scrambled using the LFSR x^5+x^4+1

Fig. 5

https://yadi.sk/d/D-BbuOwZwVHykQ

[1] https://www.gnu.org/software/octave/

[2] https://www.itu.int/rec/R-REC-F.342-2-197007-W/en

CIS-81-81 (81-81, Moroz) T-206

update
A friend of mine sent me an interesting comment about the 6 and 12 bit formats used in CIS-81-81 mode, likely they refer to a former version of 81-81 and clear-text transmissions:

6-bit format (40.5 Bd): idle and traffic

12-bit format (81 Bd), two cahannels "a" and "b", bit-interleaved:

a) Channel a and b idle
b) Channel a traffic
c) Channel b traffic
d) Channel a and b traffic

(bits 2 and 5 are sent in inverted polarity).

July, 21 
Since in the last few weeks I have encountered mostly FSK2 signals (mostly from the East), I decided to take a slightly deeper look at "old" FSK2 modes such as CIS-81-81 and CIS-11 (the latter in a next post).
CIS-81-81, also designated as 81-81 (1) , T206-M 3M1 device, is the dual channel version of CIS-40.5 mode, hence the designation 81-81; "Moroz" ("FROST" in English) is just an old nickname for the mode [1]. Most likely, when operating in two channels the data are transmitted using time division multiplexing. Both 40.5 and 81 are quite "old" systems, most likely also in use by some ex USSR republic. Speculation is that this older 81-81 system, as defined above, is no longer in use and that the newer 81-81 system is most likely to be derived from CIS-14 or CIS-27 system (81-29 designation?) [2]. Some old reports from WUN logs indicate different users of these systems [2].

Shift           Common User
-------------------------------
125             Navy   
500             Railway Authority
200,250,500,    Military
1000,1500

So far, I have at my disposal CIS-81 samples in two different shift patterns:

81Bd 250

Fig. 1

It's the 81-81 most interesting waveform since its demodulated stream exhibits a 24-bit pattern due to the  length of the idle signal which consists of 12 mark and 12 space bits (notice that CIS-40.5 250 uses 12-bit idle signal consisting of 6 mark and 6 space bits). The sequence generated by x^11+x^9+1 (PRBS11)  is used to scramble to the following data block or symply as "test" message; then the idle signal is repeated in opposite polarity (Fig. 3). Traffic in the channels is encrypted. It's worth noting that the polynomial and the idle signal "format" are the same in the 250Hz shift patterns of CIS 40.5 and 81 Baud.

Fig. 2 - CIS-81-81 250 

Fig.3

81Bd 500

Although the lack of the idle signals (at least in this recording), the demodulated stream is very interesting since it too can be descrambled using  the polynomial x^11+x^9+1 (Fig. 5).

Fig.4

Fig.5

 
T-206 MT "WESNA" (T-206 MT, T-206 2MT, T-206 3M und T-206 3M1)
T-206 is a Soviet teletype and data encryption family devices (not a modem!) used in stationary and mobile operation [3].

Fig. 5 - T206 MT [3]

(1)
The system has it roots in the synchronous, manual Baudot printing telegraph system whcih was used extensively already in Imperial Russia. The telegraph network of Imperial Russia was of course inherited by the Soviet Union, where the political leadership very soon realized that good telecommunications were at the roots of its modernization project. During and after WWII teleprinting was extended to radio links using either A1 or F1 modulation. It was therefore natural to adapt the old Baudot system to radio transmission and reception. As the system was synchronous its frame format needed a means to tell whether the link was active or idle, consequently a status bit was added in front of the five data bits yielding a 6-bit frame. For 2-channel systems this was naturally expanded to 2 x (1+5) = 12 bits. The system would then be transmitted as frame or bit interleaved. These systems used the first version of the International Telegraph Alphabet (ITA 1).

https://yadi.sk/d/WQikSYo77Z6oBA (250Hz shift, #1)
https://yadi.sk/d/bd81CpHyBFDuCQ (250Hz shift, #2) 
https://yadi.sk/d/-Q-4JagM1eeBHw (500Hz shift)                     

[1] https://i56578-swl.blogspot.com/p/russcomms.html

[2] http://xoomer.virgilio.it/.../Digitalsignalsfaq.html Digital Signals FAQ  V5.0 (2001)

[3] http://scz.bplaced.net/t206mt.html
    

CIS-14 FSK 100Bd/2000 (CIS 3x100)

Interesting 100Bd/2000 FSK signal spotted on 16059.5 KHz (CF), most likely a Russian Governative transmission. This signal is not a separate one, actually it must be considered as part of the CIS 3x100 "system" visible on the left in figure 1. Indeed, the main station operates a VFT 3x100bd/1440 signal and works simultaneously three outstations which in turn run the FSK 100Bd/2000 waveform (outstations are usually not far apart in frequency).

Fig. 1

As well as the mainstation (VFT 3x100Bd/1140), outstations too use CIS-14/T-207 (as from the analysis of the demodulated stream in figure 2); all use the same checksum mode [0312].

Fig. 2

A clearer illustration of this "system" is visible in the spectrum of figure 3, the IQ recording of which was provided by my friend KarapuZ [1] who discussed the signal here.

Fig. 3

https://yadi.sk/d/__AKCwIuMGF6gw

[1] https://yadi.sk/d/XeLE8tAX70PAKA (~100 MB) 

demodulating sync F7B mode transmissions using F7B.exe software

F7B signal, apparently a "classic" MFSK-4

My friend cryptomaster coded a program (F7B.exe) for demodulating synchronous F7B, it can be freely used and distributed for the analysis of such signals. Unfortunately, SA program parses these transmissions as classic MFSK-4 but that is not what actually is on-air: indeed,  F7B transmission mode deals with signals consisting of two independent but synchronous channels CH1 CH2 each carrying teletype signals (FSK2 on 2 independent channels).

F7B.exe can be downloaded from here:

http://www.radioscanner.ru/files/download/file21446/f7b_new.rar
https://yadi.sk/d/ZcsslwVpIwTpmg 

Warning: F7B.exe is coded to run under win/32-bit systems so you may encounter a comdlg32.ocx error (component not correctly registered) when try to run it under x64 systems, here is how to resolve comdlg32.ocx missing error:

https://www.swisssalary.ch/.../register-comdlg32.ocx-on-x64-win7

F7B.exe needs as input file the  raw MFSK-4 stream produced by the demodulator of SA and output two ASCII-Bit files CH1.txt and CH2.txt in the same directory of the input file:

Moreover, the Octave script T207_detect.m  has been used for the check of T207/CIS-14 mode [1]: it can be freely downloaded from here (you will need GNU Octave package [2] to run the script):
https://github.com/hcab14/.../T207_detect.m
the Octave script T207_detect_e.m also extracts the two world and bit interleaved channels:

https://yadi.sk/d/zsCD73C9DZpHPQ

I tested the demodulator on the two  F7B modes 100Bd/1000 and 96Bd/500, both actively used by Ukrainian Nets; by the way, two preliminary observations:

1) usually, the two F7B channels CH1 CH2 are T-207 secured according to the CIS-14 mode [1]. Since CIS-14 consists of two independent 5-bit MTK-2 channels (transmitted in 14-bit frames), it turns out that those F7B transmissions may carry up to four independent 5-bit channels (CH1a, CH1b, CH2a, CH2b);

2) both those F7B waveforms have their FSK2 counterparts.

I also tested F7B.exe on the Rockwell TE-204, a "special" time-frequency diversity FSK4 mode most commonly used by Allied Air Forces as an air-to-ground messaging system as well as in ground and naval applications.

100Bd/1000 F7B

Fig. 1 - 100Bd/1000 F7B

100Bd/1000 F7B transmissions occupies about 3000Hz bandwidth with the four tones at -1500, -500, +500, +1500 Hz respect to the center frequency. As said above, 100Bd/1000 F7B transmissions may carry up to four independent 5-bit channels. In this regard, it's worth noting in figure 2 that - at least in this sample - the two F7B channels adopt different CIS-14 checksums: mode 20 (0312) in channel CH1 and mode 3 (3120) in channel CH2: who knows, maybe the two F7B channels carry the same data but with different checksums just to increase the redundancy of the system. Note that CIS-14 100Bd/1000  (the FSK2 counterpart) uses the checksum mode 20.

Fig. 2 - two 100Bd/1000 F7B channels, each transporting two CIS-14 channels (CH1a, CH1b, CH2a, CH2b)

96Bd/500 F7B

Fig. 3 - 96Bd/500 F7B

96Bd/500 F7B transmissions occupies about 1500Hz bandwidth with the four tones at -750, -250, +250, + 750 Hz respect to the center frequency. The same earlier conclusion applies: that is since CIS-14 consists of two independent channels,  96Bd/500 F7B transmissions too may carry up to four independent 5-bit channels.

I don't know if it's a mere coincidence, anyway it's interesting to note in figures 4,5 that only one channel transports data, as well as the CIS-14 96Bd/500 (the FSK2 counterpart) does: i.e., either 96Bd/500 F7B either 96Bd/500 FSK2 use only one of their two "available" channels.  Both the waveforms use the CIS-14 checksum mode 20.

Fig. 4 - two 96Bd/500 F7B channels, only one of the two available CIS-14 channels is used

Fig. 5 - CIS-14 96Bd/500 FSK2 channels, only one of the two available 5-bit channels is used

In this transmission the two channels use different EOT signaling sequences (figure 6)

Fig. 5

Rockwell TE-204 FSK4
Although TE-204 does not definitely use the F7B mode, I decided to check it since regards two FSK2 channels. Indeed, TE-204 transmits the "mark" on 935 Hz for 6.67 msec period followed by a replicated 6.67 msec "mark" at 1815 Hz. Similarly, the "space" is transmitted at 1375 Hz for 6.67 msec followed by a replicated 6.67 msec "space" at 2255 Hz (figure 6). This "mode" provides an in-band frequency  and time diversity function  (thus the speed is the half of the measured one). As for above, from the perspective of the  data-transfer, the modem works as a 75Bd/880Hz FSK2 modem.

Fig. 6

Well, decoding separately the two FSK2 channels (935-1375, 1815-2255) we get obviously two time-shifted similar streams (figure 7)

Fig. 7 - the two TE-204 demodulated FSK2 streams

Demodulating it as if it were an F7B signal we get "01" sequences in channel CH1 and  (expected) duplicated data in channel CH2 (figure 8)

Fig. 8

https://yadi.sk/d/f0U80pRg3F58iA  (F7B signals)

[1] https://i56578-swl.blogspot.com/.../redefining-t-207-checksums.html
[2] https://www.gnu.org/software/octave/

STANAG-4481F from NSY, back to normal op

(for background read all the post of this topic) 

After a period during which the signals showed a strange behavior consisting of a 3-bit period (which in some way "simulated" a 50Bd speed), it seems that the transmissions from NSY Niscemi have back to normal 75Bd operations. So far, I checked almost all the channels except 8145.0 and 8204.5 KHz (and 13229.0 Khz but from NAU Isabela).

Fig. 1 -  6732 KHz from NSY Niscemi in different dates

There is however a peculiarity that is noteworthy: according to my logs and analysis NSY is the only station that uses KW-46 encryption - instead of KG-84 - with the 4481F 75Bd waveform(!), the other stations that use that encryption all adopt the 50Bd waveform. This fact modifies the content of a previous post according to the following diagrams (although provisional).

Fig. 2 - 6732 KHz streams from NSY Niscemi in different dates

Fig. 3

https://yadi.sk/d/02FOSxK157CsYw

50Bd/300 async 5N1.5 FSK (likely Serbian-Mil)

6374.8 KHz (cf) async 50Bd/300 FSK using 5N1.5 framing, after demodulation:
UFBV UFBV UFBV de FNCS FNCS FNCS
E9U9 E9U9 E9U9 de FNCS FNCS FNCS
Z64G Z64G Z64G de FNCS FNCS FNCS
Friends from UDXF group suggest Serbian Army as the user.

https://yadi.sk/d/SblPr4eOCLpR4Q