25 June 2024

MS-110D App.D (WBHF) transmissions, Collins Aerospace over-the-air testing?

Wideband transmission heard a few days ago on 19829.0 KHz (cf) around 1713Z, the recording was kindly sent to me by my friend linkz who also performed - successfully - the Direction Finding attempts (see below).
As from Figure 1, the signal occupies a 6 KHz bandwidth and is modulated using PSK8 at the symbol rate of 4800 Baud. Given that the subcarrier is about 6000 Hz, and it shall be 3300 Hz (300 + 1/2 BW, as usual), the signal should be -2700 Hz shifted (the tuning frequency should be around 19826.0 KHz/USB). 

Fig. 1 - signal parameters

The ACF value and its framing are quite interesting: as can be seen in Figure 2, the autocorrelation plot shows pronounced spykes at 892.4 ms (4284 symbols/12852 bits) due to the existence of a sort of "superframe" consisting of seven frames marked by less evident spikes. The latter have a value of 127.5 ms (612 symbols/1836 bits) consisting of 544 symbols of unknown data followed by 68 (known) channel mini-probe symbols.

Fig. 2 - 127.5 ms & 849.4 ms ACFs

From the above results (bandwidth, modulation and framing) the signal belongs to MIL-STD 110D Appendix D (WBHF, WideBandHF), more precisely the Waveform Number 7: this appendix is a non-mandatory part of MIL-STD-188-110C; however, when data is to be communicated in single contiguous HF radio bandwidths greater than 3 kHz, up to 48 kHz, the waveforms employed shall be in accordance with this appendix. The PSK8 demodulated bitstream is shown in Figure 3.

Fig. 3 - bitstream after PSK8 demodulation

It is worth noting (and verify) some features of this waveform.
As per Table D-XXI the mini-probes consists of a 36 symbol "base sequence" cyclically extended to the required length: in our case, 68 symbols. W/out going into the merits of the mini-probes formation, some resulting mini-probes are shown in Figure 4.


Fig. 4 - 68 symbols mini-probes

In the zoomed bitstream in Figure 5, a characteristic pattern of the mini-probes is seen at intervals of 64 frames: this is because the mini-probes are also utilized to identify the long interleaver block boundary. Indeed, in our case the block length is just 64 frames. The boundary marker is accomplished by tansmitting a cyclically rotated version of the mini-probe (#D.5.2.2).

Fig. 5 - interleaver block boundary

Figure 6 shows the mini-probe marking the long interleaver block boundary: in accordance with Table D-XXI, the mini-probe is formed of the 36 symbols base sequence after 18 cyclic rotations.

Fig. 6
 
As shown in Figure 7, the data block is formed of groups of seven 544 symbol frames (7×544 data symbols) each group consisting of the same data, regardless of the scrambler since the scrambling sequence generator polynomial (x^9 +x^4 +1) is initialized to 00000001 at the start of each data frame (the 511 bits length scrambling sequence is repeated just slightly more than 3 times). The repetitions of these seven groups cause what I designed as "superframe" (see Figure 2) which indeed has a 892.49 ms ACF, corresponding to 7 frames (7×127.5 ms).  Based on the above, it can be said that 127.5 ms is the ACF value of frames and 892.4 is the ACF value of data symbols.
Investigating the nature of these bits does not make much sense since they are actually demodulated "symbols", i.e. data bits after having passed through the modulation chain (FEC encoder, interleaver, Gray decoder, scrambler). The repetitions could suggest a test transmission, but that's just my guess.
 
Fig. 7 - the 7-frame groups that form the data block and that cause the 892.4 ms ACF

As said above, my friend linkz did a great Direction Finding job and pinpointed Oxford Junction (IA) as Tx site location (see Figure 8 below).

Fig. 8 - DF runs (TDoA algorithm), thanks to linkz

The Oxford Junction transmitter site was operated by Rockwell Collins (now part of Collins Aerospace): a paper that they presented at HFIA Meeting in San Diego (February 4, 2010) just confirms the assumption and also shows an aerial photo of the HF station (Figure 9), notice that both EarthExplorer and Google Earth obscured that site.

Fig. 9

Since the Tx location, probably the heard transmissions are WBHF over-the-air test by Collins Aerospace... but that's another guess.

https://disk.yandex.com/d/oj5V4VHl6zb9Gg 

https://www.dropbox.com/scl/fi/4hc6eszz6xvo689b2ah5o/...

20 June 2024

300 bps (FSK & STANAG-4285) fleet broadcast, UK DHFCS

Fig. 1 - 300Bd fleet broadcast on 4505.0 KHz/USB

Uncommon 300 bps fleet broadcast heard on 4505.0 KHz/USB and using both FSK modulation (with a 850 Hz shift) and PSK modulation (STANAG-4285 300 bps/Long). I say here "uncommon" given that:
- usually (NATO) fleet broadcasts use FSK 50-75 bps or 600 bps, as per the standards STANAG-4481 & STANAG-4285;
- unlike the 50-75 bps, this FSK waveform uses a 1700 Hz offset from the suppressed carrier;
anyway, frequency offset and speed are still S-4481 compliant (1)(2)

Fig. 2 - FSK 300Bd/850 fleet broadcast

Both the broadcasts are secured by KW-46 encryption (or other emulating device such as the programmable KIV-7M) given the presence of the M-sequences generated by the polynomial x^31 + x^3 +1 (KW-46T uses that sequence to synch the KW-46R receive devices). Note in Figure 2 that the number of "positives" depends on the number of the analyzed bits.

Fig. 2 - KW-46 encryption in both FSK & S-4285 transmissions

Direction Finding (TDoA algorithm) pinpoints the Tx site of Crimond, former RNAS Rattray, belonging to UK DHFCS (Defense High Frequency Communications Service) which is  operated by Babcock International Group [1].

Fig. 3 - direction findings

I noticed that some (old) logs report the frequency of 5405.2 KHz for the operation of DHFCS STANAG-4285: the value I indicate here (4505.0 KHz) is currently the correct one and seems a "new" slot, although also used by E11. The 300 bps transmissions were on the air for a few days only, perhaps for testing purposes of some on-board (old) equipment or other needs.
Monitoring thanks to the Weston KiwiSDR (UK).

https://disk.yandex.com/d/6BmT7ItamKbPqA

https://www.dropbox.com/scl/fi/ht3hiv2fg74lpqqt8kyt0/300Bd_bcast.zip...

(1) Annex C to STANG-4481 "2. [...] It is recognised that equipment uses different offsets from the suppressed or reinserted carrier (i.e. 1700 and 2000 Hz) in order to achieve the mark and space frequencies. This will not cause an interoperability problem as long as the single channel wideshift of ± 425 Hz is used. 

(2) Annex C to STANG-4481 "5. [...] The minimum user data rate will be 75 bits per second (bps). Higher speeds, including 150 bps, 300 bps or higher may be implemented when necessary".

[1] ttps://en.wikipedia.org/wiki/Defence_High_Frequency_Communications_Service  

13 June 2024

async GFSK 300Bd/200 bursts (unid)

Some days ago my friend cryptomaster sent me an unid FSK transmission heard for several consecutive days at the frequency of 5114.0 kHz USB. Main waveform parameters are a keying speed of 300 Bd and a shift of 200 Hz: clearly a GFSK modulation (Figure 1).

Fig. 1 - GFSK modulation

The signal is not continuous as it consists of GFSK "bursts" lasting approximately 632ms separated by the transmission of only the higher frequency, the whole has a duration of approximately 1093 ms (Figure 2).

Fig. 2

Consequently, as can be seen from the bitmap in Figure 3, the signal has a period of 1093.83 ms (328 bits) which, in my opinion, is due to the particular formation of the signal and not to the structure of the transported data.

Fig. 3 - bitmap of the signal period

Each data segment is 8N1 framed and since its lasting of about 632ms, consists of 190 bits (speed is 300 Bd). Note that it seems that every data segment starts and ends with the same "sequences".

Fig. 4

Fig. 5

After removing the start/stop bits, the analysis of the code did not reveal anything structured or known.

https://www.dropbox.com/scl/fi/75221eu8tww6tbpbkk8tp/2024-06-04T07_48_10Z_5114.00_usb.wav?rlkey=rkpasut70np1qyuzfm74v9b2t&st=9w0ogj1k&dl=0

4 June 2024

does wideband Akula use a FBMC-SS waveform?

The idea for this post came to me while talking with my friend ANgazu (from radiofrecuencias.es) about an emerging Spread Spectrum (SS) technique that uses MultiCarrier waveforms (MC-SS). The question that came up was whether the so-called "wideband" Akula (15 × 500Bd DBPSK) used this type of spread spectrum technique, specifically a Filter Bank based multicarrier waveform (FBMC-SS).

I demodulated the 15 channels and found that they carry the same information carried by the following "usual" FSK 500Bd/1000 transmission (Figs. 1,2,3).

Fig. 1 - channels 1-6

Fig. 2 - channels 7-12
Fig. 3 - channels 13-15 and FSK segment

Channel separation is 2 Khz, quite enough to allow a easy detection and filtering of the subcarriers, for a total bandwidth of 30 KHz (Figure 4).  As one can see, wideband Akula's spectrum is very different from other  multicarrier waveforms like OFDM or mPSK (if only for the used bandwidth).

Fig. 4 - wideband Akula and its spettral occupancy

Two popular spread spectrum systems in usage today are frequency-hopping spread spectrum (FH-SS) and direct-sequence spread spectrum (DS-SS). The basic idea of the multicarrier spread spectrum (MC-SS) is to transmit redundant information on multiple subcarriers with a slight phase variation on each one. The Filter Bank MultiCarrier Spread Spectrum (FBMC-SS) waveform, as its name implies, makes use of a filter bank to develop a spread spectrum technique. With this waveform, data symbols  are spread across a number of non-overlapping adjacent subcarriers unlike in DS-SS, where spreading is performed across time, as it happens using Walsh Direct Sequence Spread Spectrum (Walsh DS-SS). The carriers are positioned in a way that the receiver can isolate a single channel by means of selective filtering without interchannel interference. One unique feature of this FBMC-SS construction is that it can easily mask portions of the band that are corrupted by interference or jamming intended by a foe: indeed, a narrow band interference stays well isolated and does not affect more than a few subcarriers (it is no coincidence that I heard wideband Akula using a remote SpyServer receiver located in Ukraine).
 
I don't have the tools to say for sure that they use a FBMC-SS waveform, but there are some elements that lead to this conclusion. In the links below you can download, in addition to the signal and the channel demodulations, interesting documentation about FBMC-SS so that people more skilled than me can comment or deny our hypothesis.