UK DHFCS 16289.5 kHz Follow-up: DRS GA-205 TDM Evidence and 1536-bit Frame Analysis

Following up on the initial analysis of the UK Defence High Frequency Communications Service (DHFCS) transmissions on 16289.5 kHz [1] (observed in both 800 Bd / 800 Hz FSK and STANAG-4285 modes), further analysis of extended raw bitstream captures has provided concrete evidence regarding the deployment of the Leonardo DRS GA-205 Time Division Multiplexer (or a fully compatible framing engine) and additional structural characteristics. The 1536-bit period bitstreams were obtained by demodulating some STANAG-4285 recordings from my personal repository. 

1. DRS GA-205 Synchronization character
All examined bitstreams share the exact same 16-bit synchronization sequence — referred to as the "Synchronization character" — specified as 9C16 (hex) in the DRS GA-205 TDM datasheet for Frame Type 1 (Figure 1) which is user-programmable depending on the selected operational profile. In this context, DRS refers to Leonardo DRS (formerly DRS Technologies), a major defense contractor specializing in tactical military communications, naval digital networks, and signal processing hardware. Specifically, the DRS GA-205 is a 12-channel Time Division Multiplexer (TDM) widely deployed across NATO and Allied naval assets [2].

Figure 1: Excerpt from the DRS GA-205 datasheet showing the synchronization character specifications

In binary format, the hexadecimal value 0x9C16 corresponds to the 16-bit sequence 1001110010011100 (MSB Most Significant Bit first). When transmitted over the air in standard LSB-first (Least Significant Bit first) bit order, it translates to 0011100100111001. According to the manufacturer's specifications, this synchronization sequence is user-programmable per frame type (e.g., 9C16 for Frame 1 or 9D16 for Frame 2). Figure 2 illustrates an example of this alignment within the demodulated bitstream.

Figure 2: Alignment of the 1536-bit periodic stream showing the vertical synchronization column matching the DRS GA-205 Frame 1 sync character (9C16 / LSB 0011100100111001)

1.1 Framing Lock Mechanism
The receiving framer scans the incoming bitstream for the static, known 16-bit sequence (0x9C16). Its sole purpose is to establish word alignment at the start of the frame and determine bit clock timing, operating completely independently of the subsequent frame layout.
The persistence of the identical 9C16 sync character across bitstreams with varying overall internal layouts highlights a fundamental design principle of the DRS GA-205 architecture: the decoupling of Bit/Frame Alignment from Payload Demultiplexing. While the static 16-bit sync word ensures immediate physical-layer framing lock across all transmissions, the underlying TDM engine adapts the 1536-bit frame structure and sub-field distribution to match the active user port allocations.

2. 1536-bit bitstreams
Although these 1536-bit period bitstreams rely on the exact same 9C16 sync character for primary frame alignment, their internal structures may differ significantly. For instance, certain layouts do not lend themselves to straightforward structural description or tabular breakdown, as illustrated by the complex bitstreams shown in Figure 3. 

Figure 3: Examples of 1536-bit period bitstreams exhibiting highly complex or irregular sub-framing structures despite sharing the identical 9C16 primary synchronization sequence.

Conversely, other bitstreams — such as the one shown in Figure 4 — feature a highly regular structure that can easily be mapped and detailed using simple tables (Table I).

Figure 4:  Bitmap representation of a highly regular 1536-bit STANAG-4285 bitstream divided into 21 sub-blocks, highlighting alternating 48-bit payload fields (D) and static 16-bit filler/separator fields (F)

Table I: Structural breakdown of the 1536-bit frame layout shown in Figure 4

The bitstream shown in Figure 4 can be directly compared with the one analyzed in the previous post [1], reproduced in Figure 5 along with its structural breakdown (Table II) for convenience.

Figure 5: Asymmetric 1536-bit STANAG-4285 frame layout from the previous post [1], divided into 7 main sub-blocks with variable field lengths (F1,​D1-F5,​D5​).

Table II: Detailed structural breakdown of the 1536-bit frame layout shown in Figure 5

2.1 Channel Interleaving vs. Hardware Ports

A potential point of confusion when analyzing these bitstreams is the presence of up to 21 distinct sub-blocks (or "pseudo-channels") within a single 1536-bit frame, as in the bitstream of Figure 4, given that the DRS GA-205 is physically a 12-channel TDM.
The 12 channels of GA-205 correspond to the 12 physical input ports, which are not transmitted as 12 monolithic blocks. When user ports are configured for different baud rates (e.g., mixing 75 Bd and 300 Bd channels), higher-speed channels are assigned multiple timeslots within the same 1536-bit macro-frame, naturally resulting in a sub-block count higher than the number of physical input ports.

To multiplex them into a single continuous stream, the TDM engine samples higher-speed ports multiple times per frame cycle while sampling lower-speed ports only once. Consequently, the 21 sub-blocks visible in the bitstream bitmap do not represent individual hardware ports, but rather the cyclical sampling sequence (interleaving ratio) of the TDM frame. Each sub-block carries its respective slice of user payload (D) alongside necessary framing, control, and pulse-stuffing overhead (F).
Conversely, Figure 5 displays only 7 main sub-blocks. This lower count indicates either that only a subset of the 12 hardware channels was active, or that multiple low-speed user ports were aggregated within shared timeslots.
Without access to the specific TDM preset configuration used in these captures, drawing definitive conclusions about the exact channel mapping remains challenging. In operational scenarios, these layout variations are recognized either via pre-configured operational profiles (where sender and receiver share a pre-set TDM channel mask) or via in-band framing status bits transmitted immediately following the very first sync header. Once the receiving framer locks onto 9C16, it applies the designated slicing mask to route each sub-field to its respective low-speed channel processor. It should be noted that, at least across the recordings currently in my repository, no identical layouts were found but rather streams that are merely "architecturally" similar.

3. Parallel fields (counters)
Direct text decoding of the parallel fields shown in Figure 6 (one 8-bit and two 7-bit fields) reveals that they do not function as dynamic numeric counters, but rather as deterministic ASCII test/idle pattern generators.

Figure 6: Bitmap alignment of the 1536-bit STANAG-4285 bitstream highlighting the position of three parallel sub-fields (cnt-1, cnt-2, cnt-3) within the TDM frame structure.

The decoded text (Figure 7) shows sequential progressions of the printable ASCII character set:

!"#$%&'()*+,-./0123456789:;<=>?\ABCDEFGHIJKLMNOPQRSTUVWXYZ(\)`ABCDEFGHIJKLMNOPQRSTUVWXYZ(~)\
!"#$%&"()*+,-./0123456789:;<=>?`ABCDEFGHIJKLMNOPQRSTUVWXYZ(|)~`ABCDEFGHIJKLMNOPQRSTUVWXYZ(~)

This behavior is characteristic of:
- Channel Integrity (BERT): Enables continuous Bit Error Rate (BER) measurement and frame loss detection across individual TDM sub-channels by stepping through the ASCII sequence at one character per frame.
- Idle Filler Sequence: Maintains symbol clock synchronization and bit transition continuity across the link when user ports are inactive or sending null traffic.

It should be noted that these behaviors, while consistent with the GA-205 architecture, are not necessarily exclusive to it, as similar idle/test patterns and interleaving schemes are common across many military-grade TDM systems.

Figure 7: Decoded ASCII text representation of parallel sub-fields, revealing continuous printable ASCII sequence sweeps used for channel integrity monitoring and alignment.

4. A Second Test Pattern: Baudot/ITA-2 Pangram Sequence
The following analysis is based on a separate demodulated bitstream capture, distinct from the ones used in Figures 1–10 above — a further illustration that, as already noted in Section 2.1, not all captured bitstreams share the same internal sub-block layout.
Reshaping the raw 1536-bit stream into a 12×16 byte matrix (12 rows×16 byte-columns per frame) reveals a striking pattern in column K (the 11th byte of each row) at same intervals, highlighted in Figures 8,9. Across 12 independently captured frames — each clearly identified by the recurring 0x3939 sync character in columns A and B (LSB-first of 0x9C16 sync character) — a total of 129 out of 144 cells (89.6%) in column K share the pattern "XXXXX111" consisting of trailing 3-bit suffix, whereas the leading 5 bits vary dynamically.

Figure 8: Bitstream visualization of the reshaped data frames. The white bounding box on the right highlights the recurring structural pattern observed at fixed byte intervals across multiple independent transmissions.

Figure 9: Part of the Excel matrix alignment (12×16 bytes) of consecutive 1536-bit frames, highlighting the primary sync header and the persistent XXXXX111 pattern in column K (11th byte).

Extracting the variable 5-bit prefix from each of these 129 bytes and decoding it as International Telegraph Alphabet No. 2 (ITA-2 / Baudot-Murray, CCITT-2) produces a clearly recognizable result:

"…THE QUICK BROWN FOX (JUMPS) OVER THE LAZY DOG…" followed by a FIGS-shifted digit run (0–9).

Independent decode of the same demodulated bitstream using dedicated RTTY/Baudot decoding software (5×19 multiplex, positive polarity, correct bit order). The software's raw output (top) closely matches the ITA-2 reading derived manually above (white box, overlaid for comparison), corroborating the "THE QUICK BROWN FOX..." pangram test pattern (Figure 10).

Figure 10: Decode of the same demodulated bitstream using dedicated RTTY/Baudot decoding software

This is the classic pangram test string long used to exercise teleprinter and RTTY equipment, as it contains every letter of the alphabet. Notably, the small gaps observed in the decoded text in Figure 10 (e.g., "QUIC" instead of "QUICK") coincide exactly with the row-1/sync boundary of each frame where the character stream is interrupted — providing independent confirmation of the frame's periodicity.
Taken together with the printable-ASCII BERT/idle sweep documented in Section 3 (from the primary bitstream), this demonstrates that different GA-205 captures can carry structurally distinct low-speed test channels — one bitstream multiplexing a 7/8-bit ASCII test sequence, and another multiplexing a 5-bit Baudot/ITA-2 test sequence. This strongly reinforces the mixed-rate channel interleaving model discussed in Section 2.1.

The byte-matrix reshaping, statistical pattern analysis, and ITA-2/Baudot decoding presented in this section were carried out with the assistance of Claude (Anthropic AI), based on raw demodulated bitstream data provided by the author.

5. 1024-bit bitstreams & GA-205
Bitstream analysis of demodulated 800 Bd / 800 Hz FSK recordings (Figure 11) revealed a 1024-bit frame period that shares the exact same sub-block multiplexing architecture as the 1536-bit STANAG-4285 streams, yet lacks the standard 0x9C16 sync word. Instead, these streams consistently exhibit a 11-bit (LSB) synchronization sequence: 01100001101.

 

Figure 11: Alignment of the 1024-bit FSK periodic stream displaying the 11-bit vertical synchronization sequence (01100001101)

 

As outlined in the manufacturer specifications, and illustrated in the preset screenshot in Figure 12, the DRS GA-205 synchronization character is not hardcoded; it is user-programmable depending on the active operational profile or frame configuration — e.g., Frame Type 1 using 0x9C16 vs. Frame Type 2 using 0x9D16, or even a custom user-defined vector such as 01100001101. Naturally, this configuration must be agreed upon and shared between peers prior to transmission.

 

Figure 12: GA-205 TDM software control interface showing configurable aggregate parameters, sync code options, and individual user port rate allocations

6. Conclusions
To ground these bitstream findings in real-world military infrastructure, we must examine the hardware lineage and strategic deployments behind these transmissions. Specifically, looking at two major industrial partnerships highlights how the Leonardo DRS GA-205 Time Division Multiplexer is integrated across NATO and Allied HF network.

- Australian Defence Force (ADF) & MHFCS (Bellinger Systems):
In Australia, Bellinger Systems (a SYPAQ subsidiary) signed a long-term agreement with Leonardo DRS to procure, integrate, and support the GA-205 modernisation and delivery program. This program includes delivering approximately 100 modernised GA-205 TDM units to the Australian Defence Force to support their Modernised High Frequency Communications System (MHFCS) and transition towards Link 22 tactical data link architectures [3] (1).

Figure 13: Dimensional specifications comparison between the modernised Bellinger Systems GA-205 (left) and the original DRS Technologies (right).

- UK Defence High Frequency Communications Service (DHFCS / Babcock International):

Within the UK DHFCS infrastructure, primary defense contractors and service partners (such as Babcock International) manage the strategic HF communication sites, ground stations, and ship-to-shore links. In these strategic architectures, the GA-205 TDM serves as the key bridging multiplexer, interfacing legacy low-speed user channels with high-speed HF modems across UK Defence HF networks.

While absolute confirmation would require declassified operational documentation, there is strong circumstantial and technical alignment between the observed sub-block structures and the GA-205’s native support for the U.S. Navy High Speed Fleet Broadcast (HSFB) architecture(2). Designed specifically to aggregate heterogeneous low-speed naval messaging and tactical data streams over a single HF carrier, the HSFB framing profile provides a compelling explanation for the rigid slot allocation and deterministic frame synchronization observed across both STANAG-4285 and FSK transmissions in the DHFCS/MHFCS networks.

Notes

---

1. The dimensional discrepancies between the original DRS datasheet (standard 1U 19-inch rackmount) and Bellinger Systems' product sheet (200×132×620 mm) strongly point to a modernised form-factor evolution. Bellinger re-packaged the GA-205 TDM engine into a modular ATR-style / vertical-rack footprint for the Australian Defence Force's MHFCS project, integrating internal flash-upgradable firmware, higher aggregate data rate handling (up to 38.4 kbps), and built-in Link Local Controller (LLC) support for modern naval communication racks.

2. The U.S. Navy High Speed Fleet Broadcast (HSFB) is a U.S. Navy and NATO hardware architecture for shore-to-ship multi-channel fleet broadcast communications. HSFB replaced older single-channel low-speed (75-baud) broadcast links by aggregating multiple heterogeneous low-bitrate channels into a unified TDM stream over HF/UHF carriers. Native HSFB support within the Leonardo DRS GA-205 multiplexer ensured multi-channel broadcast interoperability across Allied naval communication networks (US Navy, UK DHFCS, and RAN MHFCS).

 

References

---

[1] 800Bd/800Hz (critical) FSK and STANAG-4285 Transmissions http://i56578-swl.blogspot.com/2026/08/800-bd-800-hz-critical-fsk-and-stanag.html
[2] Leonardo DRS, GA-205 Time Division Multiplexer datasheet — cleared for public release under OSR case no. 05-S-0976 (08.25.2007) https://www.leonardodrs.com/wp-content/uploads/2023/08/ga205.pdf
[3] https://www.sypaq.com.au/news/sypaq-subsidiary-bellinger-signs-historic-agreement-with-leonardo-drs/

800 Bd / 800 Hz (critical) FSK and STANAG-4285 Transmissions on 16289.5 kHz (UK DHFCS)

Analysis and TDoA geolocation of an unusual binary FSK transmission recorded on 16.2 MHz, highlighting its modulation properties, bitstream framing, and identification as part of the UK DHFCS network in St. Eval, Cornwall (UK).

A rather unusual FSK transmission was heard on 16289.5 kHz CF (tuning 16288.0 kHz/USB + 1500 Hz offset), which later turned out to be transmitted by the UK Defence High Frequency Communications Service (DHFCS) in St. Eval (see below). Every now and then I tune to 16288 kHz, but — so far —  I have not had the opportunity to catch it again. The transmission (shown in Figure 1) employs an 800Bd/800 Hz FSK modulation. The spectral display clearly shows the two characteristic tone rails, with a measured shift (Δf) of approximately 800.88 Hz.

Figure 1: Spectrum analysis showing FSK modulation at 800 Bd with 800 Hz shift

It is interesting to note that when the symbol rate (Br​=800 Bd) equals the frequency shift (Δf=800 Hz), as in this case, the transmission operates in a critical condition yielding an exact modulation index of h=​Δf/Br​=1.0 (Figure 2). For non-coherent demodulation, this condition represents the non-coherent orthogonality threshold, eliminating inter-symbol interference (ISI) without requiring phase recovery. In a coherent receiver setup, it operates at twice the minimum spacing required for orthogonal reception (h=0.5, typical of Minimum Shift Keying / MSK), providing a wider noise margin and lower Bit Error Rate (BER).

Figure 2: Critical FSK conditions (Br=Shift). Image credit: https://radioscanner.ru/

The autocorrelation function (ACF) yields a primary peak at approximately 1280 ms, which at a symbol rate of 800 bps(1) corresponds precisely to a 1024-bit frame length. This periodic structure is clearly confirmed by the bitmap alignment shown in Figure 3.

Figure 3: Autocorrelation (ACF) analysis and bitmap display

It is worth noting that a similar FSK transmission was heard in November 2025 on several frequencies, running in 800Bd/850 mode — thus with an 850 Hz shift matching the classic 50-75Bd fleet broadcast [1]. Notably, besides sharing the same ACF (1280 ms), period (1024 bits), and frame architecture, both FSK signals originate from the same site.

The structure of the 1024-bit frames is clearly visible in the bitstream resulting from demodulation and subsequent synchronization to a common 11-bit sequence (Figure 4). Structurally, this framing resembles the 1536-bit period previously observed in UK DHFCS transmissions [2] and, as mentioned above, is very similar to that used in the 800Bd/850 FSK transmission.
The layout in Figure 4 highlights six distinct recurring blocks (numbered 1 to 6) plus a final seventh block within the 1024-bit frame structure. As detailed in the lower insets, each of the seven blocks is further subdivided into specific sub-fields. For readability and descriptive purposes, I have arbitrarily labeled the static delimiter fields consisting of all-one bits as 'F' (Framing) and the variable payload sections as 'D' (Data) — for instance, F1–D1, F2–D2, F3–D3, and so on. Note that these designations are purely my working labels.

Figure 4: The 1024-bit frame structure aligned to the chosen sequence

Table 1 summarizes the bit-length distribution across the six primary blocks. As shown, each block consists of alternating framing fields (F1, F2, F3, composed of all-one sequences) and data fields (D1, D2, D3). TABLE I highlights a clear, repeating structural pattern:

[F1] → [D1] → [F2] → [D2] → [F3] → [D3]

* Framing bit lengths: While most delimiter fields are fixed at 5 bits, a single 6-bit delimiter shifts diagonally across the frame structure following a cyclical pattern (F3 in blocks 1 & 4, F2 in blocks 2 & 5, and F1 in blocks 3 & 6, as indicated by the shaded cells).
*  Data bit lengths: The first two data sub-fields (D1 and D2) consistently contain 16 bits per block, whereas D3 carries 37 bits in blocks 1, 2, 4, and 5, expanding to 38 bits in blocks 3 and 6 (just when the 6-bit delimiter is in F1 fields) to compensate for the framing arrangement.

In total, these six blocks account for 512 bits (half of the full 1024-bit frame structure), evenly divided into 96 bits of framing overhead (static '1s') and 416 bits of variable data payload.

Table I: Bit allocation and field breakdown across Blocks 1–6. Shaded cells denote the 6-bit delimiter fields

As detailed in Table II, and according to the chosen synchronization, Block 7 acts as a tail or termination sub-frame. Unlike the standard 6-field blocks, Block 7 consists of only four sub-fields—F4 (5 bits), D4 (16 bits), F5 (5 bits), and D5 (11 bits) — resulting in a reduced length of 37 bits. Here, the fixed 5-bit delimiters (F4, F5) frame a standard 16-bit data register (D4), while the shortened 11-bit data field (D5) likely serves to pad the frame to its exact required total length of 512 bits.

Table II: Structure of the terminal sub-frame (Block 7), showing a reduced 37-bit total allocation across four fields

At a later stage, the same frequency was observed hosting a STANAG-4285 transmission (operating at a 1200 bps data rate). Comparing the two distinct captures revealed that despite the transition in physical modulation (FSK vs PSK), both waveforms carry an identical framing structure. Similar to what was observed with the 800Bd/850 FSK transmission, the STANAG-4285 signal appeared briefly before disappearing.
Once demodulated, the STANAG-4285 transmission reveals a 1536-bit period, structurally identical to the 1024-bit bitstream identified in the FSK transmissions — differing by exactly 512 bits.The layout in Figure 5 illustrates the 1536-bit frame structure. As with the FSK signal, the bitstream resulting from demodulation was synchronized to a common sequence (specifically, a common 16-bit sequence at the start of the frame). 

Despite the expanded period, it preserves the exact same sub-framing architecture identified in the 1024-bit FSK signal. The right portion of the frame features six recurring standard blocks (numbered 1 to 6) followed by the terminal seventh block. As shown in the lower insets, the working labels 'F' (Framing) and 'D' (Data) apply identically here: Blocks 1 through 6 follow the F1–D1, F2–D2, F3–D3 sequence, while Block 7 retains the shortened F4–D4, F5–D5 structure. The key distinction lies in the overall frame length, where an expanded 1024-bit framed segment is paired with the initial unstructured section, accommodating the higher bit rate of the PSK (STANAG-4285) signal.

The structural identity between the 800 Bd / 850 Hz FSK signal and the 1200 bps STANAG-4285 signal demonstrates that the framing scheme operates at a higher Data Link / TDM layer, independently of the underlying Physical layer.

 

Figure 5: 1536-bit bitstream of the STANAG-4285 transmission, aligned to the chosen sequence

Unlike the FSK transmission, the field lengths within the 1536-bit STANAG-4285 bitstream exhibit a remarkably strict byte-aligned regularity. As shown in Table III, all static delimiters (F1–F5) are fixed at exactly 8 bits (1 byte), while the data fields (D1–D3) in Blocks 1 through 6 are uniformly sized at 56 bits (7 bytes) each, resulting in perfectly symmetric 192-bit sub-frames. Similarly, the terminal Block 7 consists entirely of byte multiples — F4 (8 bits), D4 (24 bits / 3 bytes), F5 (8 bits), and D5 (16 bits / 2 bytes) — totaling 56 bits. This rigid, byte-oriented structure strongly suggests that the framing hardware operates on standard 8-bit word boundaries when processing higher-throughput PSK streams.

Table III: Field layout and bit-length distribution for Blocks 1–7 of the 1536-bit STANAG-4285 bitstream

While the frame lengths differ to match the respective physical layer throughputs — 1024 bits for the FSK waveform versus 1536 bits for the 1200 bps STANAG-4285 transmission — the internal frame architecture remains structurally equivalent.
 
As shown in Figure 6, the left section of the STANAG-4285 1536-bit bitstream contains three parallel 7-bit counters, which yield 128 possible states (0-127) before resetting. Note that the highlighted field reads "1001100" — equivalent to 76 in decimal — whereas the bit editor displays "line 77". This apparent discrepancy arises because the initial state is "0000000" (0), which the editor counts as line 1 (meaning the values from 0 to 76 encompass 77 discrete lines). While the exact function of the three parallel 7-bit counters (cnt1–cnt3) cannot be definitively confirmed, their synchronized 128-state cycle suggests they may be used for frame numbering, sequence tracking, or TDM sub-channel control. These interpretations remain unverified hypotheses based solely on bitstream pattern analysis.

 

Figure 6: Detail of the left section of the STANAG-4285 bitstream showing three parallel 7-bit counters

Another similarity worth highlighting is observed in the initial regions of the bitstreams, immediately following the used synchronization sequence (Figure 7). As shown in the comparative analysis, both waveforms exhibit a structurally identical pattern before transitioning into the main section.
These initial segments could serve as a frame header or control region, potentially containing protocol signaling flags, operational mode indicators, or a Frame Check Sequence / CRC (Cyclic Redundancy Check) to ensure header integrity, alongside a short stabilization pattern for receiver synchronization. It must be emphasized, however, that all the above functional interpretations remain strictly my own speculative hypotheses, derived solely from visual bitstream observation.

Figure 7: Visual comparison of the initial bitstream regions following the used sync sequence in FSK (top) and STANAG-4285 (bottom)

For the sake of completeness, a statistical test on the use of encryption within the data fields was performed (Figure 8), although — in truth — it was not strictly necessary.

Figure 8: Statistical randomness and encryption test on the data fields

Attempts to locate the geographic emission site point decisively to the St. Eval site in Cornwall (Figure 9)(2). Direction finding was performed using three independent TDoA (Time Difference of Arrival) runs using different KiwiSDR receiver clusters to validate spatial convergence.

Figure 9: Geolocation analysis combining KiwiSDR TDoA results with DHFCS infrastructure maps

The following figures provide an aerial view of the St. Eval site (Figure 10) and a ground-level view (Figure 11); images are credited to Google Earth. The white-circled signs visible in Figure 11 are warnings posted by the UK Ministry of Defence (MOD):

Left circle (main entrance/fence):
Upper sign (white):
MOD St Eval
Lower sign (red/white):
MOD PROPERTY KEEP OUT NO ACCESS OR TIPPING

Right circle (side fence):
Warning sign (red/yellow):
MOD Property Keep Out Multi hazard area Danger of death

 

Figure 10: Aerial view of the former RAF St Eval airfield, currently housing the DHFCS transmitter site (Image credit: Google Earth)

Figure 11: Ground-level view of the St. Eval site entrance. Highlighted are the UK Ministry of Defence (MOD) warning signs (Image credit: Google Earth)

I have referenced the likely use of a Time-Division Multiplexer (TDM). This hypothesis stems from the observation that 1536-bit bitstreams — featuring a layout similar to those analyzed here — have been observed in transmissions from both the UK DHFCS and the Australian Modernised High Frequency Communications System (MHFCS) [3]. Although the reported transmissions not employing FSK modes, these systems utilized various other modulation schemes, such as MIL-STD-188-110A (MS-110A) and STANAG-4285. Furthermore, reliable sources confirm that the MHFCS specifically employs the DRS GA-205 multiplexer(3).

The fact that 16289.5 kHz is monitored periodically without observing a constant presence — nor any activity on the frequencies previously used for the 800 Bd / 850 Hz FSK transmission — suggests that this is not an active operational service (such as standard STANAG 4481/4285 broadcasts on allocated frequencies). Rather, it seems that they are conducting targeted waveform tests, activated only during specific time windows to evaluate different shift parameters.
 

Furthermore, the analysis demonstrates that the DHFCS system employs a scalable Data Link framing protocol, capable of adapting to different physical layer standards operating on the exact same frequency.

Downloads & Technical Materials

---

📄⬇️ For a quick technical reference, you can download a concise sheet: https://disk.yandex.com/i/fe0IMS3UW8xr9Q

🧮⬇️ Download Octave script check_encryption.m:  https://disk.yandex.com/i/aOq8QUFe6w2mqQ

📡⬇️ Download signal recording: https://disk.yandex.com/d/fMIqmmzOSwKK2Q

Notes

---

1. In a binary FSK modulation (FSK-2), the baud rate (Bd), or symbols rate, value is exactly equal to the speed in bits per second (bps). Since in FSK-2 each signal transition (1 baud), or one symbol, corresponds to the transmission of exactly 1 bit of data, the mathematical relationship is: Bit Rate (bps)=Baud Rate (Bd)×log2​(M) where M is the number of possible states/tones. For a conventional FSK modulation (M=2): Bit Rate=Baud Rate×log2​(2)=Baud Rate×1 Consequently, for an 800 Bd signal, the signal frequency shifts 800 times per second, carrying exactly 800 bps.

2. DHFCS St. Eval is a strategic military high-frequency radio transmitter site located at the former RAF St Eval airfield in Cornwall, England. Part of the UK South region network, it acts as a key transmission facility for the UK Defence High Frequency Communications Service (DHFCS), providing long-range communication for military aircraft and ships. Operated under contract by Babcock International.
3. GA-205 is a 12-channel Time Division Multiplexer (TDM) that provides full-duplex and half-duplex transmission and reception of data at selectable user port rates up to 9600 bps. The system accommodates user data that do not share common timing sources and provides for isochronous, bit stuff, synchronous and asynchronous operation.

References

---

[1] https://i56578- swl.blogspot.com/2025/11/unid-fsk-800bd850.html
[2] http://i56578- swl.blogspot.com/search/label/1536-bit%20TDM
[3] http://i56578- swl.blogspot.com/2019/07/110a-2400bps-modem-carrying-1536-bit.html

Tunisian MFA HF Link: 128-bit AES Encryption and a Modified MS-110A Waveform

This post provides a breakdown of an HF diplomatic link between Tunisian MFA nodes using a modified MS-110A waveform. Based on audio subcarriers and bitstream measurements, the post analyzes the complete message-frame structure: from the initial 4-tone preamble and framing overhead to the COMSEC preamble protecting the AES payload.

A transmission session was logged at 16285.0 kHz USB on July 29, starting from 0855 UTC, and recorded thanks to linkz' remote KiwiSDR[1]. The exchange began with a standard 3-way link setup using the 141A (2G ALE) waveform, followed by 15 data bursts using MS-110A at 1200 bps (Short Interleave), and concluded with a formal link termination (Figure 1). The traffic was identified as belonging to the Tunisian Ministry of Foreign Affairs (MFA). Given that all bursts are of equal duration (~3500 ms), the session does not appear to employ an ARQ mechanism, which would typically involve data packets interspersed with short return ACKs.

Fig. 1: Spectrogram of the complete transmission.

Looking at the MS-141A ALE exchanges, the link setup follows the usual 3-way handshake:

TO [STAT155] TIS [STAT16]
TO [STAT16] TIS [STAT155]
TO [STAT155] TIS [STAT16]

where the used ALE addresses stand for:

STAT16: MFA Tunisian Embassy in Riyadh (caller node)
STAT155: MFA HQ in Tunis (called node)

The identification of the above callsigns is derived from verified loggings within the utility monitoring community such as UDXF[2].

In the vast majority of operational cases, the caller node (STAT16 in this sample) is also the station that switches to a traffic waveform first. The only exception occurs if the initial ALE call is an "Orderwire" type (1) or a reverse traffic request, where, for instance, STAT16 calls STAT155 essentially saying: "I am ready to receive your traffic". As in most cases, the link termination is signaled by the caller node (2):

TO [STAT155] TWS [STAT16]

1. Waveforms Analysis

The transmission operates in a simplex "turn-taking" structure. Each pair of bursts (excluding burst #13, which is standalone) functions as a bidirectional message exchange between the two nodes (Figure 2). 

Fig. 2: Simplex turn-taking sequence diagram illustrating the bidirectional burst exchange between STAT16 (Riyadh) and STAT155 (Tunis).

 

This is supported by the differing fading profiles observed within each pair, indicating that the two bursts in a pair travel along different propagation paths and therefore originate from different transmitting sites (nodes). As shown in Figure 3, the longer path for STAT16 introduces multipath propagation, resulting in frequency-selective fading. In contrast, the path for STAT155 is much shorter and exhibits negligible fading (flat channel), with the signal arriving stable and without significative attenuation.

Fig. 3: Spectral signatures and geographic paths of STAT16 and STAT155

Furthermore, the distinction between the two nodes was confirmed by measuring the audio subcarrier frequency in the pairs of MS-110A bursts against the nominal 1800 Hz frequency (Figure 4):

- 1787 Hz (-13 Hz offset) identifies the caller (STAT16, which switches to MS-110A first)
- 1770 Hz (-30 Hz offset) identifies the called station (STAT155)

Fig. 4: Subcarrier frequency comparison

It is worth noting that while the MS-110A standard specifies a clock accuracy of ±1 Hz for the generation of the 1800 Hz subcarrier (§ 5.3.2.3.9), the observed frequency offsets are slightly higher (−13 Hz and −30 Hz). This discrepancy is primarily attributed to overall transceiver local oscillator (LO) drift, frequency calibration tolerances, and ionospheric Doppler shifts. Despite these deviations, demodulation proceeds correctly as modern MS-110A DSP implementations employ carrier-tracking loops capable of acquiring and compensating for subcarrier offsets well within this range.

As shown in Figure 5, each burst begins with four initial unmodulated tones lasting ~80 ms with asymmetric spacings (700 Hz, 500 Hz, and 900 Hz), a variant of the MS-110A modem typically associated with tactical telecommunication systems (3) which is not specified in the standard MIL-STD-188-110A. These four tones form an "all-in-one" synchronization burst that serves to identify the network signature (700/500/900 Hz pattern) and acts as a channel probe and CW sync probe.

Fig. 5: 4-tone preamble preceding the burst, with asymmetric frequency spacings.

To better understand the physical characteristics of an MS-110A transmission at 1200 bps, it is worth looking at the relationship between the symbol rate, channel coding, and actual throughput. Over the air, the modem always transmits at a fixed symbol rate using 8-PSK, resulting in a physical channel capacity of:
2400 baud × 3 bits/symbol = 7200 bit/s
Out of the 7200 bit/s physically radiated, the required user data rate in this capture is 1200 bit/s. Therefore, the total channel overhead (accounting for FEC, framing, and preamble/sync bits) is:
(7200 - 1200) / 7200 = 83.33%

2400 baud × 3 bits/symbol (8-PSK) = 7200 bit/s physical channel capacity

This means that only 16.67% of the theoretical over-the-air capacity is dedicated to useful data coming from upper-layer protocols (4). Alternatively, if efficiency is evaluated simply against the 2400 baud symbol slots (rather than the full 3 bits/symbol capacity of 8-PSK), the useful rate of 1200 bps corresponds to exactly half the symbol rate — highlighting a symbol throughput efficiency of 50%.

2. Data Link Bitstreams Analysis

To allow a thorough analysis of the payloads originating from the Data Link layer, each burst was demodulated individually, yielding 15 distinct bitstreams (Figure 6). The most immediate observation — though expected — is that all bitstreams have an identical length of 436 bytes or 3488 bits.

Fig. 6: Demodulated binary files from the session.

Furthermore, the frame structure is identical across all bitstreams — exhibiting a uniform format (regardless of reception polarity):

[Frame Sync]→[IVs]→[01... Reversals]→[Payload/Data]→[EOM]→[01... Reversals]

Data Link frame layout with COMSEC preamble and encrypted payload (not in scale).

In greater detail:

- Frame Sync: 64 bits (8 bytes), 0001100001000001110001011110010110111011010010010111110101011001
- Initialization Vector (IV): 128 bits (16 bytes), repeated 5 times (640 bits total)
- Reversals: 64 bits of alternating sequence (0101...)
- Encrypted MSG Payload: Ciphertext message
- EOM/Postamble: 64-bit followed by reversals (0101...), totaling 2000 bits*

(*) the 2000-bit value assigned to the final "EOM & Reversals" block in the calculations above is derived directly from the bitstream analysis of the frame's closing sequence (see Figure 7).

 

Fig. 7: Bitstream view of the post-payload section, highlighting the 2000-bit block containing the EOM marker and trailing reversals.

 

As noted above, the total frame length accounts for exactly 3488 bits. Breaking down the bit distribution across the frame:

64 (Sync) + 640 (IVs) + 64 (Preamble REVs) + [MSG] + 2000 (EOM & REVs) = 3488 bits
Solving for the actual encrypted payload [MSG]:
[MSG]=3488−(64+640+64+2000)=720 bits (90 bytes)

Consequently, the Data Link layer frame efficiency for this transmission is:
(720:3488)​×100 ≈ 20,64%

Frame efficiency = 720 / 3488 × 100 ≈ 20.64%

    

This 20.64% frame efficiency means that nearly 80% of the Data Link layer space is consumed by overhead (synchronization, repeated IVs, and postambles) to ensure robust reception. Consequently, only 90 bytes out of each 436-byte burst carry actual encrypted user payload.

The following figures provide the visual bitstream analysis that substantiates the numerical values used above to define the specific frame structure.
Figure 8 shows the first 128 bits of all bitstreams and highlights the initial 64-bit frame sync:

Fig. 8: Bitstream alignment showing the 64-bit frame sync header.

 

Figure 9 relates to a single bitstream after the removal of the initial frame sync. The figure shows the 128-bit Initialization Vector repeated 5 times:

Fig. 9: Fivefold repetition of the 128-bit IV following initial frame sync removal.

Figure 10 shows 128-bit segments of all bitstreams after the removal of frame syncs and Initialization Vectors, highlighting the 64-bit reversal sequences that precede the MSG payloads:

 

Fig. 10: Bitstream alignment showing the 64-bit reversal sequences after frame syncs and IVs stripping.

 

Figure 11 shows 128-bit segments from all bitstreams, highlighting the End of Message (EOM) sequence followed by reversals:

Fig. 11: Bitstream view of the EOM sequence and trailing reversals.

One might speculate that the initial 64-bit sync sequence preceding the Initialization Vectors (Figure 8) serves as a cryptodevice synchronization header — similar to what is observed in KG-84/KIV-7 encrypted transmissions (5). However, this remains a tentative hypothesis with no definitive confirmation at present.
Furthermore, it is plausible that the 64-bit sequence of reversals "0101" immediately following the Initialization Vectors (Figure 10) acts as a buffering or timing window, granting the cryptodevice sufficient time to process and load the IVs into the key generator before the encrypted payload stream begins.

Regarding the payload itself, the 128-bit Initialization Vector strongly points to the use of AES (Advanced Encryption Standard). Since the encrypted payload length (90 bytes / 720 bits) is not a multiple of the 128-bit (16-byte) block size, it is reasonable to hypothesize that AES is implemented in a stream cipher mode (such as AES-CTR or AES-OFB) or utilizes ciphertext stealing, thereby eliminating the need for block padding[3].
As a side note, the Tunisian Navy also utilizes MS-110A waveform, but strictly in its standard-compliant form i.e., without the initial 4-tone preamble discussed earlier. Furthermore, while the Navy relies on the L3Harris Citadel suite to secure its communications[4], the Ministry of Foreign Affairs, as seen above, employs a distinct approach to protect its message traffic.

Figure 12 presents the output of the Octave[5] script check_encryption.m as an additional statistical verification of the payload encryption. Given the earlier identification of the 128-bit Initialization Vectors, the presence of encryption is already taken for granted(!): running this script serves primarily as a proof-of-concept to demonstrate and validate its execution on real-world data. The script was generated with the assistance of Claude AI[6] and is available for download at the bottom of this post for anyone interested in testing it.

Fig. 12: Output of the Octave script check_encryption.m confirming encrypted payload statistics.

I have previously observed these same characteristics — frame structure, 128-bit IVs, and modified MS-110A waveform — in transmissions from the Royal Navy of Oman, Croatian Military, and the Swiss Emergency Network[7]. This suggests that neither the waveform nor the encryption device are custom-built for a single user, but are rather off-the-shelf solutions available on the commercial market.

Despite previous studies on these kinds of transmissions, this post offers a more detailed and comprehensive analysis, made possible by access to a complete 15-burst session.

Downloads

---

📄⬇️ For a quick technical reference, you can download a concise sheet: https://disk.yandex.com/i/nXoBWW1cclhixQ

🧮⬇️ Download Octave script check_encryption.m:  https://disk.yandex.com/i/aOq8QUFe6w2mqQ

📡⬇️ Download signal recording: https://disk.yandex.com/d/arsiZ8bRhwvv8Q

Notes

---

1. An Orderwire call in military and diplomatic HF radio systems (such as MIL-STD-188-141 ALE) is a special signaling message used for channel management, control, or raw text exchanges between operators, rather than for transmitting standard payload data. Instead of negotiating a link to open a traffic channel for user data, an Orderwire transmission carries specific embedded instructions—such as frequency channel tests, status commands, radio control messages, or operator-to-operator short text notes.

2. In MIL-STD-188-141A (2G-ALE) terminology, TIS (This Is) is used in the preamble/header to identify the transmitting station during link establishment, whereas TWS (This Was) is transmitted at the end of a session to signal explicit link termination (teardown).
3. Israeli Navy hybrid MS-110A modems also feature a four-tone preamble, but with symmetrical tone spacing.
4. In the OSI model and HF data transmission stacks, what the physical layer (the modem) considers "useful data" is precisely the payload delivered by upper layers (such as STANAG 5066, PPP, or other application/DTE protocols).
5. Additionally, the KG-84/KIV-7 device also uses 128-bit Initialization Vectors (transmitted as two 64-bit strings) preceded by a 64-bit sync sequence header.

References

---

[1] http://linkz.ddns.net:8074/?f=16285.00usbz9
[2] Utility DXers Forum (UDXF) home page: https://www.udxf.nl/
[3] General overview and theory of AES https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
[4] https://i56578-swl.blogspot.com/2025/07/tunisian-navy-using-l3harris-citadel.html
[5] GNU Octave official site https://octave.org
[6] Claude (AI) https://claude.ai/login
[7] https://i56578-swl.blogspot.com/2021/11/again-about-crypto-devices-with-5x-128.html

CIS-Navy FSK 50Bd/700 Flash Messages

This post presents a technical analysis of an HF radio intercept recorded on July 22. The analysis focuses on the structure of a 50 Baud FSK signal transmitted by the CIS Navy, highlighting both standard transmission characteristics and distinctive operational features, such as the use of a specific frequency shift (700 Hz) and the inclusion of a Morse-FSK preamble indicative of high-priority message traffic.

A very interesting FSK 50 Bd / 700 Hz signal was intercepted on 16199.75 kHz (cf) on July 22. The signal transmits almost continuous "01" reversals, occasionally interrupted by a Morse-FSK preamble prior to an encrypted payload. The preamble likely serves as a signaling sequence indicating the priority/precedence level of the upcoming transmission. As shown in Figure 1, the payload of the recorded transmission consists of two concatenated messages framed by short reversal segments before returning to continuous reversals. In ordinary or low-priority traffic, the payload directly follows the reversals (without a preamble), consists of multiple concatenated messages and can last for some minutes.

Fig. 1: the intercepted signal

As confirmed by fellow monitor cryptomaster, the intercepted signal belongs to the family of 50 Bd FSK waveforms used by the CIS Navy with various shift values such as 75, 200, 250, 500, and even 1000 Hz [1] likely generated by the T-600 system, while maintaining the same message format. This is the first time I have observed a CIS Navy 50 Bd FSK modulation with a 700 Hz shift, which is another remarkable aspect of this sample.

Fig. 2: FSK parameters

Transmitting a Morse coded preamble typically indicates an incoming message of high priority. In Russian military radio doctrine, top-priority traffic (equivalent to FLASH or MONOLITH) is preceded by repeated letter sequences to alert operators and trigger automated equipment (1). In this instance, the preamble consists of the string 'UUUUU XXX XXX'. This sequence likely functions as a two-stage marker: 'UUUUU' for initial synchronization/attention, followed by 'XXX XXX' to signal an incoming long or high-precedence message prior to switching to FSK data modulation. Notably, while these markers are unconfirmed by official Russian Navy sources, they are well-established through decades of independent SIGINT monitoring. A similar preamble was previously documented in CIS Navy 50 Bd/75 transmissions on 18.1 kHz (submarine communications) [2].

Fig. 3: the Morse-FSK preamble

The two messages in this sample are identical, likely to improve system reliability through message redundancy.
Below is the bitstream analysis of the intercepted sample (700 Hz shift), demonstrating the above—namely, that both the message's format and the symbol rate of 50 Bd are shared across CIS Navy FSK waveforms, even when using different shift values.

The 'standard' format of CIS Navy 50 Bd FSK messages usually consists of:

 ⦁ 42-bit initial sequence / Unique Word (usually 100001010010111110000101001101011010101101)
 ⦁ 70-bit Initialization Vector, repeated twice)
 ⦁ 7-bit word ciphered payload arranged in a 4:3 ratio with parity check
 ⦁ five 7-bit "0001000" words as End of Message (EOM)

(the 0/1 values of the sequences above depend on the reception polarity)

(not in scale)

42-bit sync sequence
It is worth noting that the transition from idle to traffic condition is signaled by a break in the bit reversal structure, where a '1' is inserted instead of a '0' when the system transitions to traffic i.e., ending in '01011' rather than '01010', as shown in Figure 4. Using intentional protocol deviations for signaling is a common practice across many standards, such as Ethernet LAN protocols (2).
The initial 42-bit sync sequence also represents a "violation" of the 4:3 ratio (see below), ensuring reliable synchronization.

Fig. 4: 42-bit initial sequence sent after reversals

70-bit Initialization Vector
Figure 5 displays the identical pair of messages aligned in 70-bit blocks, emphasizing the probable Initialization Vector (IV) sequences, repeated twice, prior to the encrypted payload.

Fig. 5: 70-bit sequence, repeated twice

4:3 ratio with parity check
The payload data consists of 5-bit characters encoded into a 7-bit sequence with a fixed 4:3 ratio of '1's to '0's (or vice versa, depending on reception polarity). Naturally, the constant presence of four '1's per character also provides parity-based error detection. 

Fig. 6: 4:3 ratio and parity check

End of Message (EOM)

The End-of-Message (EOM) sequence in Figure 7 consists of five identical 7-bit words "0001000", again violating the constant bit ratio of the payload section. This figure also clearly demonstrates that the two messages are identical. 

Fig. 7: the EOM sequence

It appears that the format of the CIS-Navy 50Bd transmissions revolves around the number "7": an initial 42-bit synchronization sequence (6x7), 70-bit Initialization Vectors (10x7), and a payload structured into 7-bit words. In fact, it can be argued that the entire message (sync sequence, IVs, payload, EOM)  is fundamentally structured into 7-bit words.

Attempts to geolocate the transmitter site proved challenging, likely due to the nature of the signal and potential multi-hop propagation. Nonetheless, as shown in Figure 8, the KiwiSDR receivers used for Time Difference of Arrival (TDoA) measurements point to an area southwest of Moscow (likely the RDL site?), though this cannot be established with a high degree of certainty (3).

Fig. 8: direction finding attempts (TDoA)

All recordings thanks to linkz's KiwiSDR [3].

Downloads

---

📄⬇️ For a quick technical reference, you can download a concise Fact Sheet summarizing the full frame architecture and other features here.
📡⬇️ Download signal recording: https://disk.yandex.com/d/4uBK5oJYGYtMVg

Notes

---

1. In NATO military communications (as ACP-126 standard), FLASH precedence is represented by the letter indicator Z (Prosign). To alert operators and trigger automated terminal alarms, the precedence sequence is repeated at the start of the transmission (e.g., ZCZC ZZZZ), followed by a Z time-stamp designator and the text header FLASH FLASH FLASH. In strategic/command contexts, it functions similarly to Russian high-priority or MONOLITH-type alerts.
2. In traditional 10 Mbps Ethernet networks (10BASE-T), data is transmitted using Manchester encoding. Transmission begins with a 7-byte preamble consisting of alternating 1s and 0s (10101010...), used to synchronize the receiver's clock. Immediately following this is the SFD (Start Frame Delimiter) value, where the alternating sequence breaks with two consecutive 1 bits (10101011). This break in the alternating rhythm signals the network chip: "Attention: the preamble has ended; the very next bit marks the actual start of the Ethernet packet" (IEEE 802.3 Standard, Clause 3).
3. Rather than a single fixed mast, HF transmissions under the call sign RDL are routed through naval communications hubs primarily tied to naval headquarters/command nodes in Central Russia such as the Moscow military region hub. Just for example, Naro-Fominsk area hosts major command posts and communications infrastructure for the Russian Armed Forces, including high-power HF transmitter facilities and receiver centers used for strategic naval command broadcasts and central military district communications.

References

---

[1] http://i56578-swl.blogspot.com/2016/12/unid-fsk-50bd1000-prob-cis-navy.html
[2] http://i56578-swl.blogspot.com/2020/08/cis-navy-vlf-50bd75-fsk-t600-75hz.html
[3] http://linkz.ddns.net:8075/?f=16198.00usbz9