QPSK (Link-22) & PSK8 (unid) bursts

Since some days on 7907.0 KHz/USB, starting in the morning, it's possible to hear long sessions of 2400Bd burst signals which use different modulations and ways. Signal "A" in Figure 1 consists of 4-segment bursts, each segment lasting about 420 ms.

Fig. 1

Modulation used is PSK8 at the rate of 2400Bd. The demodulated bitstream has a period length of 18 bits (6 PSK8 symbols, Figure 2) that can be reduced to 3 bits or even 2 bits if the "1s" column is removed.

Fig. 2 - demodulated bitstream of a PSK8 burst

Signal "B" in Figure 3 is the same as the above but in this case two station are involved, as it's easy to figure out looking at the different strengths of the bursts and their fading patterns. The "2-stations" mode starts randomly after a while but w/out a sort of schedule: in my opinion the time-slot paradigma (or Time Division Multiple Access mode, TDMA) is used (1).

Fig. 3

Signal "C" (Figure 4) use QPSK modulation instead (again 2400Bd) and 550 ms bursts with a "duty cycle" of 50%. 

Fig. 4

The demodulated bitstreams have a period length of 540 bits (270 PSK4 symbols, Figure 5) with a clearly visible framing consisting of 8 sections "Data-MiniProbe" of different durations. The 270-symbol frames and the durations of the eight "Data-MP" sections are the same of the STANAG-4539 TDMA waveform WF2 (see Table I), thus the recording "C" is definitely a Link-22 transmission (2).

Table I

Fig. 5

All my direction finding tries (TDoA algorithm with 5 receivers!) point to an area near Nuremberg (Nürnberg), Germany. Probably it's the USAG (U.S. Army Garrison) Ansbach base which is located in northern Bavaria, approximately 40 kilometers southwest of Nuremberg [1].

Fig. 6 - Direction Finding tries

For what concerns the PSK8 bursts, bitstreams and TDMA mode make me think about a Tactical Data Link (TDL), even if the analyzed waveforms do not match the standards Link-11 or Link-22 (atleast the ones I know). Anyway, given the lack of other information, it cannot be ruled out that it could be telemetry signals.

Monitoring has been made thanks to KiwiSDRs of OE3AKB (Landersdorf, AUSTRIA) e OZ1BFM (Vejby, Denmark) [2][3].

https://disk.yandex.com/d/b04EpZUQIO5GIw

(1) In TDMA mode each user is allowed to transmit only within specified time intervals named as "Time Slots" so that different users transmit in differents time slots.

(2) #2.3.2 Media Code Frame structure, Annex D to STANAG-4539 

[1] https://installations.militaryonesource.mil/.../ansbach-united-states-army-garrison
[2] http://oe3akb.ddns.net:8073/
[3] http://oz1bfm.proxy.kiwisdr.com:8073/
 

ISR Navy PSK8/2400Bd (datalink protocol)

Just some notes about the datalink protocol used by Israeli Navy (IDF) and their proprietary PSK8/2400Bd modem.
The datalink protocol transfers data using "Tx-Frames" formats consisting of 6, 12 and 18 fixed length packets of 55 bytes (440 bits) for a total room of 330, 660, and 990 bytes per Tx-Frame. The choice of the Tx-Frame to use (TF6, TF12, TF18) depends on the size of the data to be transmitted, taking into account the minimum possible waste of bytes; indeed, if the size of data is of a shorter length, a sequence of null bytes (of value zero) is appended to the data so as to extend it to the legth of the chosen Tx-Frame (Figs 1,2). Thus, a generic Tx-Frame may be seen as a n-position array, in which n is a multiple of 6 and each position can accommodate a single 55-byte packet: 

- TF6 accomodates six 55-byte packets
- TF12 accomodates twelve 55-byte packets
- TF18 accomodates eighteen 55-byte packets

probably also a TF24 exists, but so far I have not seen a such format during my monitorings.

Fig. 1 - TF6 type TX-Frames (7 bursts)

 

Fig. 2 - TF12 type TX-Frames (7 bursts)

The first packet of a Tx-Frame contains a 56-bit/7-byte synchronization sequence (please note the curious progression):

10001111010011111100111100101111101011110110111110000000 (0xF1F2F3F4F5F601)

Fig. 3

Each Tx-Frame is transmitted using a single burst waveform, therefore a transmission is made up of as many bursts as the number of the data messages to be sent. All the types of Tx-Frames can coexist within the same transmission (Figure 4): since null value bytes filling is used, this could mean that fragmentation is not foreseen, i.e. if the size of the data to be sent is greater than the TF(n) then TF(n+1) it's used. 

Fig. 4 - three types of Tx-Frames used in a same transmission

The protocol does not appear to be an ARQ sysem but rather a FEC broadcast with the add of redundancy; for example, sometimes is possible to see that multiple copy of the same datagrams are sent within the same transmission (Figure 5). Obviously, the receiver shall discard the repeated Tx-Frames.

Fig. 5 - a six bursts transmission bearing  3-times repeated Tx-Frames

Burst Waveform
The HF modem generates a burst waveform consisting of two signal formats: parallel and serial, that's why the designation "hybrid/mixed" modem. The initial part of the waveforms consists of 4 or 7 tones where the 3rd and 4th respectively indicate the 1800-Hz of the audio subcarrier being modulated. Tones are likely used in the receive modem for the detection of the signal present, correction of doppler and identification of the beginning of the preamble (Figure 6).

Fig. 6 - initial tones

The segment following the 4/7 tones is modulated at the rate of 75 Bd using a parallel QPSK waveform (Figure 7); although the bursts may have different lengths, it has always the same duration. The analysis of a single channel' bitstream shows a well-defined 96-bit/82-byte framing with an initial sync sequence: this segment is probably a "preamble" aimed to provide synchronization and parameters related to the following data segment (autobaud waveform?).

Fig. 7 - analysis of a single QPSK/75Bd channel

The following segment has the same ACF (66.6ms) and parameters (PSK8 2400 Bd) of a MIL 188-110A serial modem, although a specific MS-110A demodulator doesn't not recognize the waveform as such. The 160-symbol ACF pattern indicates a data rate from 150 up to 1200 bps (1). This is the data segment of the burst waveform.

Fig. 8 - analysis of the serial segment

In order to prove that the QPSK parallel segment is actually a preamble, and not about the data, I randomly cut off a portion of that segment obtaining a "reduced burst": resulting bitstreams remain unaffected by the shorter duration of the segment (Figure 9).

Fig. 9

In my opinion, extra bytes (such as : CRC string, number of packets in the Tx-Frame, position of the packet within the Tx-Frame, first/last packet,...) are appended to each data packet during the formation of the burst waveform: these extra bytes are omitted in the bitstreams.

 

(1) In case of MS-110A low data rates (from 150 up to 1200 bps) the data frames are structured as a 40-symbol pattern: each frame consisting of a data block consisting of 20 data symbols, followed by a probe consisting of 20 symbols of known data. The expected ACF value is then 16.67 ms, but the actual one is 66.67 ms ie four times greather (Figure 5). The reason is that four groups of the pairs data + probe  count 160 symbols (4×40) and they are just "in sync" with the scrambler length (160 symbols) causing the strong 66.67 ms ACF spikes.

unid PSK8 waveform

Unid PSK8 2400Bd serial waveform heard on 6987.0 KHz/USB, data transfers appear to occur in ARQ mode (Figure 1).

Fig. 1

The larger signal' segments have strong 66.66ms ACF spikes that make a 160-symbol framing consisting of 32 known symbols (mini-probe?) followed by 128 symbols of data. 

Fig. 2 - 66.66ms ACF and relative 160-symbol frame

The analysis of the frame' symbols (Figure 3) reveals that the mini-probes consist of a 16-symbol sequence which is repeated two times.

Fig. 3 - analysis of the frame symbols

Short segments too, maybe ACKs or some other negotiation messages, are PSK8 modulated and have a period of 768-bit/256-symbol length: at glance, it looks like a Walsh Orthogonal modulation mode (Figure 4).

 

Fig. 4

 

https://disk.yandex.com/d/fNYT-NOu7CPfbw