Tunisian MFA HF Link: 128-bit AES Encryption and a Modified MS-110A Waveform

This post provides a breakdown of an HF diplomatic link between Tunisian MFA nodes using a modified MS-110A waveform. Based on audio subcarriers and bitstream measurements, the post analyzes the complete message-frame structure: from the initial 4-tone preamble and framing overhead to the COMSEC preamble protecting the AES payload.

A transmission session was logged at 16285.0 kHz USB on July 29, starting from 0855 UTC, and recorded thanks to linkz' remote KiwiSDR[1]. The exchange began with a standard 3-way link setup using the 141A (2G ALE) waveform, followed by 15 data bursts using MS-110A at 1200 bps (Short Interleave), and concluded with a formal link termination (Figure 1). The traffic was identified as belonging to the Tunisian Ministry of Foreign Affairs (MFA). Given that all bursts are of equal duration (~3500 ms), the session does not appear to employ an ARQ mechanism, which would typically involve data packets interspersed with short return ACKs.

Fig. 1: Spectrogram of the complete transmission.

Looking at the MS-141A ALE exchanges, the link setup follows the usual 3-way handshake:

TO [STAT155] TIS [STAT16]
TO [STAT16] TIS [STAT155]
TO [STAT155] TIS [STAT16]

where the used ALE addresses stand for:

STAT16: MFA Tunisian Embassy in Riyadh (caller node)
STAT155: MFA HQ in Tunis (called node)

The identification of the above callsigns is derived from verified loggings within the utility monitoring community such as UDXF[2].

In the vast majority of operational cases, the caller node (STAT16 in this sample) is also the station that switches to a traffic waveform first. The only exception occurs if the initial ALE call is an "Orderwire" type (1) or a reverse traffic request, where, for instance, STAT16 calls STAT155 essentially saying: "I am ready to receive your traffic". As in most cases, the link termination is signaled by the caller node (2):

TO [STAT155] TWS [STAT16]

1. Waveforms Analysis

The transmission operates in a simplex "turn-taking" structure. Each pair of bursts (excluding burst #13, which is standalone) functions as a bidirectional message exchange between the two nodes (Figure 2). 

Fig. 2: Simplex turn-taking sequence diagram illustrating the bidirectional burst exchange between STAT16 (Riyadh) and STAT155 (Tunis).

 

This is supported by the differing fading profiles observed within each pair, indicating that the two bursts in a pair travel along different propagation paths and therefore originate from different transmitting sites (nodes). As shown in Figure 3, the longer path for STAT16 introduces multipath propagation, resulting in frequency-selective fading. In contrast, the path for STAT155 is much shorter and exhibits negligible fading (flat channel), with the signal arriving stable and without significative attenuation.

Fig. 3: Spectral signatures and geographic paths of STAT16 and STAT155

Furthermore, the distinction between the two nodes was confirmed by measuring the audio subcarrier frequency in the pairs of MS-110A bursts against the nominal 1800 Hz frequency (Figure 4):

- 1787 Hz (-13 Hz offset) identifies the caller (STAT16, which switches to MS-110A first)
- 1770 Hz (-30 Hz offset) identifies the called station (STAT155)

Fig. 4: Subcarrier frequency comparison

It is worth noting that while the MS-110A standard specifies a clock accuracy of ±1 Hz for the generation of the 1800 Hz subcarrier (§ 5.3.2.3.9), the observed frequency offsets are slightly higher (−13 Hz and −30 Hz). This discrepancy is primarily attributed to overall transceiver local oscillator (LO) drift, frequency calibration tolerances, and ionospheric Doppler shifts. Despite these deviations, demodulation proceeds correctly as modern MS-110A DSP implementations employ carrier-tracking loops capable of acquiring and compensating for subcarrier offsets well within this range.

As shown in Figure 5, each burst begins with four initial unmodulated tones lasting ~80 ms with asymmetric spacings (700 Hz, 500 Hz, and 900 Hz), a variant of the MS-110A modem typically associated with tactical telecommunication systems (3) which is not specified in the standard MIL-STD-188-110A. These four tones form an "all-in-one" synchronization burst that serves to identify the network signature (700/500/900 Hz pattern) and acts as a channel probe and CW sync probe.

Fig. 5: 4-tone preamble preceding the burst, with asymmetric frequency spacings.

To better understand the physical characteristics of an MS-110A transmission at 1200 bps, it is worth looking at the relationship between the symbol rate, channel coding, and actual throughput. Over the air, the modem always transmits at a fixed symbol rate using 8-PSK, resulting in a physical channel capacity of:
2400 baud × 3 bits/symbol = 7200 bit/s
Out of the 7200 bit/s physically radiated, the required user data rate in this capture is 1200 bit/s. Therefore, the total channel overhead (accounting for FEC, framing, and preamble/sync bits) is:
(7200 - 1200) / 7200 = 83.33%

2400 baud × 3 bits/symbol (8-PSK) = 7200 bit/s physical channel capacity

This means that only 16.67% of the theoretical over-the-air capacity is dedicated to useful data coming from upper-layer protocols (4). Alternatively, if efficiency is evaluated simply against the 2400 baud symbol slots (rather than the full 3 bits/symbol capacity of 8-PSK), the useful rate of 1200 bps corresponds to exactly half the symbol rate — highlighting a symbol throughput efficiency of 50%.

2. Data Link Bitstreams Analysis

To allow a thorough analysis of the payloads originating from the Data Link layer, each burst was demodulated individually, yielding 15 distinct bitstreams (Figure 6). The most immediate observation — though expected — is that all bitstreams have an identical length of 436 bytes or 3488 bits.

Fig. 6: Demodulated binary files from the session.

Furthermore, the frame structure is identical across all bitstreams — exhibiting a uniform format (regardless of reception polarity):

[Frame Sync]→[IVs]→[01... Reversals]→[Payload/Data]→[EOM]→[01... Reversals]

Data Link frame layout with COMSEC preamble and encrypted payload (not in scale).

In greater detail:

- Frame Sync: 64 bits (8 bytes), 0001100001000001110001011110010110111011010010010111110101011001
- Initialization Vector (IV): 128 bits (16 bytes), repeated 5 times (640 bits total)
- Reversals: 64 bits of alternating sequence (0101...)
- Encrypted MSG Payload: Ciphertext message
- EOM/Postamble: 64-bit followed by reversals (0101...), totaling 2000 bits*

(*) the 2000-bit value assigned to the final "EOM & Reversals" block in the calculations above is derived directly from the bitstream analysis of the frame's closing sequence (see Figure 7).

 

Fig. 7: Bitstream view of the post-payload section, highlighting the 2000-bit block containing the EOM marker and trailing reversals.

 

As noted above, the total frame length accounts for exactly 3488 bits. Breaking down the bit distribution across the frame:

64 (Sync) + 640 (IVs) + 64 (Preamble REVs) + [MSG] + 2000 (EOM & REVs) = 3488 bits
Solving for the actual encrypted payload [MSG]:
[MSG]=3488−(64+640+64+2000)=720 bits (90 bytes)

Consequently, the Data Link layer frame efficiency for this transmission is:
(720:3488)​×100 ≈ 20,64%

Frame efficiency = 720 / 3488 × 100 ≈ 20.64%

    

This 20.64% frame efficiency means that nearly 80% of the Data Link layer space is consumed by overhead (synchronization, repeated IVs, and postambles) to ensure robust reception. Consequently, only 90 bytes out of each 436-byte burst carry actual encrypted user payload.

The following figures provide the visual bitstream analysis that substantiates the numerical values used above to define the specific frame structure.
Figure 8 shows the first 128 bits of all bitstreams and highlights the initial 64-bit frame sync:

Fig. 8: Bitstream alignment showing the 64-bit frame sync header.

 

Figure 9 relates to a single bitstream after the removal of the initial frame sync. The figure shows the 128-bit Initialization Vector repeated 5 times:

Fig. 9: Fivefold repetition of the 128-bit IV following initial frame sync removal.

Figure 10 shows 128-bit segments of all bitstreams after the removal of frame syncs and Initialization Vectors, highlighting the 64-bit reversal sequences that precede the MSG payloads:

 

Fig. 10: Bitstream alignment showing the 64-bit reversal sequences after frame syncs and IVs stripping.

 

Figure 11 shows 128-bit segments from all bitstreams, highlighting the End of Message (EOM) sequence followed by reversals:

Fig. 11: Bitstream view of the EOM sequence and trailing reversals.

One might speculate that the initial 64-bit sync sequence preceding the Initialization Vectors (Figure 8) serves as a cryptodevice synchronization header — similar to what is observed in KG-84/KIV-7 encrypted transmissions (5). However, this remains a tentative hypothesis with no definitive confirmation at present.
Furthermore, it is plausible that the 64-bit sequence of reversals "0101" immediately following the Initialization Vectors (Figure 10) acts as a buffering or timing window, granting the cryptodevice sufficient time to process and load the IVs into the key generator before the encrypted payload stream begins.

Regarding the payload itself, the 128-bit Initialization Vector strongly points to the use of AES (Advanced Encryption Standard). Since the encrypted payload length (90 bytes / 720 bits) is not a multiple of the 128-bit (16-byte) block size, it is reasonable to hypothesize that AES is implemented in a stream cipher mode (such as AES-CTR or AES-OFB) or utilizes ciphertext stealing, thereby eliminating the need for block padding[3].
As a side note, the Tunisian Navy also utilizes MS-110A waveform, but strictly in its standard-compliant form i.e., without the initial 4-tone preamble discussed earlier. Furthermore, while the Navy relies on the L3Harris Citadel suite to secure its communications[4], the Ministry of Foreign Affairs, as seen above, employs a distinct approach to protect its message traffic.

Figure 12 presents the output of the Octave[5] script check_encryption.m as an additional statistical verification of the payload encryption. Given the earlier identification of the 128-bit Initialization Vectors, the presence of encryption is already taken for granted(!): running this script serves primarily as a proof-of-concept to demonstrate and validate its execution on real-world data. The script was generated with the assistance of Claude AI[6] and is available for download at the bottom of this post for anyone interested in testing it.

Fig. 12: Output of the Octave script check_encryption.m confirming encrypted payload statistics.

I have previously observed these same characteristics — frame structure, 128-bit IVs, and modified MS-110A waveform — in transmissions from the Royal Navy of Oman, Croatian Military, and the Swiss Emergency Network[7]. This suggests that neither the waveform nor the encryption device are custom-built for a single user, but are rather off-the-shelf solutions available on the commercial market.

Despite previous studies on these kinds of transmissions, this post offers a more detailed and comprehensive analysis, made possible by access to a complete 15-burst session.

Downloads

---

📄⬇️ For a quick technical reference, you can download a concise Fact Sheet: https://disk.yandex.com/i/nXoBWW1cclhixQ

🧮⬇️ Download Octave script check_encryption.m:  https://disk.yandex.com/i/aOq8QUFe6w2mqQ

📡⬇️ Download signal recording: https://disk.yandex.com/d/arsiZ8bRhwvv8Q

Notes

---

1. An Orderwire call in military and diplomatic HF radio systems (such as MIL-STD-188-141 ALE) is a special signaling message used for channel management, control, or raw text exchanges between operators, rather than for transmitting standard payload data. Instead of negotiating a link to open a traffic channel for user data, an Orderwire transmission carries specific embedded instructions—such as frequency channel tests, status commands, radio control messages, or operator-to-operator short text notes.

2. In MIL-STD-188-141A (2G-ALE) terminology, TIS (This Is) is used in the preamble/header to identify the transmitting station during link establishment, whereas TWS (This Was) is transmitted at the end of a session to signal explicit link termination (teardown).
3. Israeli Navy hybrid MS-110A modems also feature a four-tone preamble, but with symmetrical tone spacing.
4. In the OSI model and HF data transmission stacks, what the physical layer (the modem) considers "useful data" is precisely the payload delivered by upper layers (such as STANAG 5066, PPP, or other application/DTE protocols).
5. Additionally, the KG-84/KIV-7 device also uses 128-bit Initialization Vectors (transmitted as two 64-bit strings) preceded by a 64-bit sync sequence header.

References

---

[1] http://linkz.ddns.net:8074/?f=16285.00usbz9
[2] Utility DXers Forum (UDXF) home page: https://www.udxf.nl/
[3] General overview and theory of AES https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
[4] https://i56578-swl.blogspot.com/2025/07/tunisian-navy-using-l3harris-citadel.html
[5] GNU Octave official site https://octave.org
[6] Claude (AI) https://claude.ai/login
[7] https://i56578-swl.blogspot.com/2021/11/again-about-crypto-devices-with-5x-128.html

CIS-Navy FSK 50Bd/700 Flash Messages

This post presents a technical analysis of an HF radio intercept recorded on July 22. The analysis focuses on the structure of a 50 Baud FSK signal transmitted by the CIS Navy, highlighting both standard transmission characteristics and distinctive operational features, such as the use of a specific frequency shift (700 Hz) and the inclusion of a Morse-FSK preamble indicative of high-priority message traffic.

A very interesting FSK 50 Bd / 700 Hz signal was intercepted on 16199.75 kHz (cf) on July 22. The signal transmits almost continuous "01" reversals, occasionally interrupted by a Morse-FSK preamble prior to an encrypted payload. The preamble likely serves as a signaling sequence indicating the priority/precedence level of the upcoming transmission. As shown in Figure 1, the payload of the recorded transmission consists of two concatenated messages framed by short reversal segments before returning to continuous reversals. In ordinary or low-priority traffic, the payload directly follows the reversals (without a preamble), consists of multiple concatenated messages and can last for some minutes.

Fig. 1: the intercepted signal

As confirmed by fellow monitor cryptomaster, the intercepted signal belongs to the family of 50 Bd FSK waveforms used by the CIS Navy with various shift values such as 75, 200, 250, 500, and even 1000 Hz [1] likely generated by the T-600 system, while maintaining the same message format. This is the first time I have observed a CIS Navy 50 Bd FSK modulation with a 700 Hz shift, which is another remarkable aspect of this sample.

Fig. 2: FSK parameters

Transmitting a Morse coded preamble typically indicates an incoming message of high priority. In Russian military radio doctrine, top-priority traffic (equivalent to FLASH or MONOLITH) is preceded by repeated letter sequences to alert operators and trigger automated equipment (1). In this instance, the preamble consists of the string 'UUUUU XXX XXX'. This sequence likely functions as a two-stage marker: 'UUUUU' for initial synchronization/attention, followed by 'XXX XXX' to signal an incoming long or high-precedence message prior to switching to FSK data modulation. Notably, while these markers are unconfirmed by official Russian Navy sources, they are well-established through decades of independent SIGINT monitoring. A similar preamble was previously documented in CIS Navy 50 Bd/75 transmissions on 18.1 kHz (submarine communications) [2].

Fig. 3: the Morse-FSK preamble

The two messages in this sample are identical, likely to improve system reliability through message redundancy.
Below is the bitstream analysis of the intercepted sample (700 Hz shift), demonstrating the above—namely, that both the message's format and the symbol rate of 50 Bd are shared across CIS Navy FSK waveforms, even when using different shift values.

The 'standard' format of CIS Navy 50 Bd FSK messages usually consists of:

 ⦁ 42-bit initial sequence / Unique Word (usually 100001010010111110000101001101011010101101)
 ⦁ 70-bit Initialization Vector, repeated twice)
 ⦁ 7-bit word ciphered payload arranged in a 4:3 ratio with parity check
 ⦁ five 7-bit "0001000" words as End of Message (EOM)

(the 0/1 values of the sequences above depend on the reception polarity)

(not in scale)

42-bit sync sequence
It is worth noting that the transition from idle to traffic condition is signaled by a break in the bit reversal structure, where a '1' is inserted instead of a '0' when the system transitions to traffic i.e., ending in '01011' rather than '01010', as shown in Figure 4. Using intentional protocol deviations for signaling is a common practice across many standards, such as Ethernet LAN protocols (2).
The initial 42-bit sync sequence also represents a "violation" of the 4:3 ratio (see below), ensuring reliable synchronization.

Fig. 4: 42-bit initial sequence sent after reversals

70-bit Initialization Vector
Figure 5 displays the identical pair of messages aligned in 70-bit blocks, emphasizing the probable Initialization Vector (IV) sequences, repeated twice, prior to the encrypted payload.

Fig. 5: 70-bit sequence, repeated twice

4:3 ratio with parity check
The payload data consists of 5-bit characters encoded into a 7-bit sequence with a fixed 4:3 ratio of '1's to '0's (or vice versa, depending on reception polarity). Naturally, the constant presence of four '1's per character also provides parity-based error detection. 

Fig. 6: 4:3 ratio and parity check

End of Message (EOM)

The End-of-Message (EOM) sequence in Figure 7 consists of five identical 7-bit words "0001000", again violating the constant bit ratio of the payload section. This figure also clearly demonstrates that the two messages are identical. 

Fig. 7: the EOM sequence

It appears that the format of the CIS-Navy 50Bd transmissions revolves around the number "7": an initial 42-bit synchronization sequence (6x7), 70-bit Initialization Vectors (10x7), and a payload structured into 7-bit words. In fact, it can be argued that the entire message (sync sequence, IVs, payload, EOM)  is fundamentally structured into 7-bit words.

Attempts to geolocate the transmitter site proved challenging, likely due to the nature of the signal and potential multi-hop propagation. Nonetheless, as shown in Figure 8, the KiwiSDR receivers used for Time Difference of Arrival (TDoA) measurements point to an area southwest of Moscow (likely the RDL site?), though this cannot be established with a high degree of certainty (3).

Fig. 8: direction finding attempts (TDoA)

All recordings thanks to linkz's KiwiSDR [3].

Downloads

---

📄⬇️ For a quick technical reference, you can download a concise Fact Sheet summarizing the full frame architecture and other features here.
📡⬇️ Download signal recording: https://disk.yandex.com/d/4uBK5oJYGYtMVg

Notes

---

1. In NATO military communications (as ACP-126 standard), FLASH precedence is represented by the letter indicator Z (Prosign). To alert operators and trigger automated terminal alarms, the precedence sequence is repeated at the start of the transmission (e.g., ZCZC ZZZZ), followed by a Z time-stamp designator and the text header FLASH FLASH FLASH. In strategic/command contexts, it functions similarly to Russian high-priority or MONOLITH-type alerts.
2. In traditional 10 Mbps Ethernet networks (10BASE-T), data is transmitted using Manchester encoding. Transmission begins with a 7-byte preamble consisting of alternating 1s and 0s (10101010...), used to synchronize the receiver's clock. Immediately following this is the SFD (Start Frame Delimiter) value, where the alternating sequence breaks with two consecutive 1 bits (10101011). This break in the alternating rhythm signals the network chip: "Attention: the preamble has ended; the very next bit marks the actual start of the Ethernet packet" (IEEE 802.3 Standard, Clause 3).
3. Rather than a single fixed mast, HF transmissions under the call sign RDL are routed through naval communications hubs primarily tied to naval headquarters/command nodes in Central Russia such as the Moscow military region hub. Just for example, Naro-Fominsk area hosts major command posts and communications infrastructure for the Russian Armed Forces, including high-power HF transmitter facilities and receiver centers used for strategic naval command broadcasts and central military district communications.

References

---

[1] http://i56578-swl.blogspot.com/2016/12/unid-fsk-50bd1000-prob-cis-navy.html
[2] http://i56578-swl.blogspot.com/2020/08/cis-navy-vlf-50bd75-fsk-t600-75hz.html
[3] http://linkz.ddns.net:8075/?f=16198.00usbz9

Voice Coordination & FSK 300Bd/500 Tactical Bursts (Russian Navy)

This is not the first time I have had the opportunity to study the 300Bd/500Hz FSK waveform (of Russian/CIS origin), which I have encountered in different configurations — for instance, with 255/366-bit framing, or with reversal preambles transmitted at 150 baud [1]. This time, the opportunity was provided by my friend Mario, who kindly sent me some recordings of his intercepts, captured via KiwiSDRs located in Japan (Nagano and Hokkaido). The intercepts were recorded on June 23rd, between 0848 and 0944 UTC. These are almost certainly Russian Navy voice and data transmissions, likely between the Russian Pacific Fleet HQ in Vladivostok or the Sovetskaya Gavan Naval Station (a submarine base) and a vessel. The traffic consists of voice coordination followed by tactical data bursts using FSK 300Bd/500Hz modulation on a negotiated frequency (Figure 1).

Fig. 1: Voice link setup on 8439 kHz (top) followed by FSK 300Bd/500Hz data bursts on 9100 kHz (bottom)

The voice comm intercept occurred on 8439 kHz, which is probably a primary calling/hailing frequency. In a naval net, a major shore station or flagship (the NCS, Net Control Station) monitors this frequency continuously, acting as a guard station for the net. Subordinate mobile units check in briefly on this primary frequency just long enough to establish initial contact. Because the primary frequency must remain clear for other assets to report in, the calling unit requests a shift to a discrete tactical channel to send the follow-on data traffic.
Below, the text transcript and corresponding translation of the voice communication. 

Russian (original)	English (translation)
Волнобой, я Грейдер. Волнобой, я Грейдер. Волнобой, я Грейдер. Как слышно? Прием.	Volnoboy, this is Greyder. Volnoboy, this is Greyder. Volnoboy, this is Greyder. How do you read? Over.
Волнобой, я Грейдер. Волнобой, я Грейдер. Следи. Вызови меня на червячке девять-один-ноль-ноль, девять-один-ноль-ноль. Как понял?	Volnoboy, this is Greyder. Volnoboy, this is Greyder. Keep listening. QSY to vernier* nine-one-zero-zero, nine-one-zero-zero. How copy?
Я Грейдер. Прием.	This is Greyder. Over.

*"Vernier" (червячок, lit. "little worm") — Russian radio slang for the fine-tuning dial, here indicating the secondary frequency.

Callsign: Volnoboy (Волнобой - "Breakwater") — Called Station, likely Net Control Station (NCS).The callsign evokes a fixed, protective structure, consistent with a shore-based command facility or a flagship unit acting as the control node.
Callsign: Greyder (Грейдер - "Grader") — Calling Station / Initiator. The callsign references mobile equipment, suggesting a an auxiliary/support vessel or a subordinate combatant establishing a tactical link.

In Soviet/Russian doctrine, callsigns are not fully arbitrary but follow category-based semantic conventions, "heavy/permanent/protective" nouns for fixed command stations or flagship units, and "mobile/task-oriented" nouns for subordinate tactical units. This reinforces the assessment of Volnoboy as NCS and Greyder as the mobile calling unit.

If my guess is correct (!), i.e. Volnoboy is the ashore NCS, there is an ideological and technological divergence between NATO and the Russian Navies:
1. The NATO Paradigm: Continuous Broadcasts (FAB). NATO utilizes the BRASS (Broadcast, Ship-Shore and Maritime Rear Link System) architecture. Shore-based Net Control Stations broadcast continuously and use FAB (Frequency Availability Broadcast) to tell the fleet exactly which frequencies are currently free for ship-shore comms. The Philosophy: Maximum protection for the ship. By listening passively to the broadcast, ships maintain total EMCON (Emission Control). The ship only transmits a brief burst to establish the link on the best available frequency. The fixed shore station takes 100% of the RF exposure.
2. The Russian Paradigm: Tactical Shadowing ("The Worm"). The intercept between Greyder and Volnoboy shows the exact opposite workflow. The Russian Navy relies heavily on "skedy" (rigidly scheduled radio appointments) and paper matrixes. Stations meet on a known primary calling frequency simply to confirm mutual contact and readability. The mobile unit (Greyder) immediately directs the shore station (Volnoboy) to transition to a secondary tactical channel ("the little worm 9100").

Shortly after the voice link setup on 8439 kHz, tactical data bursts utilizing FSK 300Bd/500Hz modulation were intercepted on the negotiated secondary frequency of 9100 kHz. Because no voice response from Volnoboy was detected (1), this data traffic is assessed with high confidence as originating from Greyder. This fits the classic profile of a mobile naval asset transitioning from a public voice channel to an FSK burst transmission on a tactical shadow frequency to pass encrypted operational traffic.

Figures 2, 3 show the main parameters and the 80 ms period of the FSK bursts.

 

Fig. 2 : main FSK parameters (300 Bd/500Hz)

Fig. 3: 80 ms period

The demodulated bitstream shows a 24-bit period (corresponding to the 80 ms duration visible in the bitmap in Figure 3), the last of which is the phasing bit (the final column of "0s"). The data are preceded by a 240-bit sequence generated by the polynomial x^12+x^10+x^9+x^3+1.

Fig. 4: demodulated bitstream

After removing the preamble/sync sequence and inverting the 9th column of the stream, a clear H(24,16) coding was found, ie 16-bit data followed by a 8-bit CRC. Coding is performed using the following Hamming parity check (8,24) matrix:

1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0   1 0 0 0 0 0 0 0
0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0   0 1 0 0 0 0 0 0
0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 0   0 0 1 0 0 0 0 0
0 0 0 1 0 1 1 0 0 1 0 1 1 1 1 1   0 0 0 1 0 0 0 0
0 0 1 1 1 0 0 1 1 1 0 1 0 1 1 1   0 0 0 0 1 0 0 0
1 0 1 0 1 1 1 0 0 0 0 1 0 0 1 1   0 0 0 0 0 1 0 0
0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1   0 0 0 0 0 0 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0   0 0 0 0 0 0 0 1

As demonstrated in Figure 5, the received CRC (left) matches the computed CRC (right). The latter is obtained by applying the (8,16) check sub-matrix shown above to the 16-bit data portion of the demodulated bitstream.

Fig. 5: received CRC (left) vs computed CRC (right)

Coding verification is carried out by comparing each line of encoded data with every row of the check sub-matrix: for each row #n, the number of vertical matches between the "ones" in the encoded line and the "ones" in that row is counted. If the count is even, CRC bit #n will be "0"; if the count is odd, CRC bit #n will be "1".

Example: CRC computation for the first row of the encoded data:

DATA                               CRC
1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1    1 0 1 1 0 0 1 0
1 1 1 0 0 0 0 0 1 0 1 0 1 1 0 1    1 0 1 1 0 1 1 0
0 0 1 0 0 0 1 1 0 0 0 1 0 0 0 0    1 0 0 0 1 1 1 0
0 1 1 1 1 1 0 1 0 0 1 0 1 1 0 0    0 1 0 0 1 1 1 0
1 1 0 0 1 0 1 1 1 1 0 1 1 1 0 1    0 1 1 0 1 1 0 0
1 0 1 1 1 0 1 0 1 0 0 0 1 0 0 1    0 1 0 0 1 1 1 0
0 0 1 0 0 0 0 1 0 1 1 1 0 1 0 0    0 1 0 1 1 0 1 0
1 0 1 0 1 1 1 1 1 1 0 0 0 0 0 0    1 1 0 1 1 1 1 0
1 1 0 1 1 0 1 1 1 1 0 1 1 0 1 1    1 1 1 1 0 0 0 0
0 0 1 0 1 0 0 0 1 0 1 0 0 0 0 1    1 0 0 1 0 1 0 0
1 1 0 0 1 1 1 0 0 0 0 1 0 0 0 0    1 1 1 1 0 1 1 0
0 0 0 1 1 1 0 0 0 1 0 1 1 0 0 0    0 1 0 1 0 1 1 0

CHECK SUB-MATRIX
1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0
0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0
0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 0
0 0 0 1 0 1 1 0 0 1 0 1 1 1 1 1
0 0 1 1 1 0 0 1 1 1 0 1 0 1 1 1
1 0 1 0 1 1 1 0 0 0 0 1 0 0 1 1
0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 check sub-matrix row #1
7 matches (odd), CRC bit #1 value: 1

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 check sub-matrix row #2
6 matches (even), CRC bit #2 value: 0

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 check sub-matrix row #3
7 matches (odd), CRC bit #3 value: 1

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 check sub-matrix row #4
7 matches (odd), CRC bit #4 value: 1

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 0 1 1 1 0 0 1 1 1 0 1 0 1 1 1 check sub-matrix row #5
6 matches (even), CRC bit #5 value: 0

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
1 0 1 0 1 1 1 0 0 0 0 1 0 0 1 1 check sub-matrix row #6
8 matches (even), CRC bit #6 value: 0

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1 check sub-matrix row #7
7 matches (odd), CRC bit #7 value: 1

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 check sub-matrix row #8
no matches (zero is even), CRC bit #8 value: 0

By the way, I used a short Octave script to compute the CRC string.

This intercept illustrates a type of Russian Fleet HF procedure: a brief voice hail on 8439 kHz to establish contact and negotiate a shift frequency, followed by short FSK 300Bd/500Hz data bursts on 9100 kHz carrying the operational traffic. The callsign roles and QSY direction are consistent with a doctrine that differs structurally from the NATO FAB/BRASS model, with the mobile unit dictating the shift and the shore station absorbing the RF exposure.
Thanks to Mario for sharing the KiwiSDR recordings that made this analysis possible.

https://disk.yandex.com/d/mgLcnpLJOLGS9Q

(1) Greyder asked the question and Volnoboy answered it. Greyder heard the response and moved to 9100 kHz to transmit its data traffic, but most likely the HF skip zone completely hid Volnoboy's voice from the KiwiSDR in Japan. The Japanese receiver was likely sitting in a dead zone where Volnoboy's signal skipped over the antenna, while Greyder's signal — transmitted from a different position — had a more favorable propagation path.

[2]  http://i56578-swl.blogspot.com/search/label/FSK%20300Bd%2F500

CIS 20Bd/7000 Wide FSK

In the world of HF, spectral efficiency is usually the gold standard. Modern digital modes strive to pack as much data as possible into narrow bandwidths. However, when monitoring tactical networks originating from the CIS (Commonwealth of Independent States) region, we may encounter a signal that flips this paradigm entirely: the 20Bd/7000 Wide FSK waveform. Operating at a "glacial" 20 Baud but utilizing a massive 7000 Hz frequency shift, this waveform intentionally sacrifices spectral real estate.
On a standard SDR waterfall display, the CIS 20Bd/7000 is highly distinctive yet easily misidentified by automated classification algorithms. Instead of a single coherent data stream, it appears as two completely detached Continuous Wave (CW) carriers separated by a 7 kHz void (Figure 1).
I recently heard this waveform on 25th June at about 2235 UTC on 6945.0 kHz (CF) using the remote AirSpy SDR receiver managed by EA1FAQ in Spain, whom I wish to thank. 

Fig. 1: CIS 20Bd/7000 Wide FSK

Technical Specifications & RF Fingerprint (Figure 2):
Modulation: Frequency Shift Keying (FSK / F1B), Lower tone: 6941.5 kHz, Upper tone: 6948.5 kHz, Center freq: 6945.0 kHz
Symbol Rate: 20 Baud (Symbol duration: 50 ms)
Shift (Δf): 7000 Hz (±3500 Hz from center)
Modulation Index β = fm/​Δf ​= 20/7000 ​= 350
Primary Users: Russian / CIS Military and Diplomatic Networks

Fig. 2: main FSK technical parameters (shift & speed)

Apart from the center frequency noted here (6945.0 kHz), this same transmission can be observed on various other frequencies around 7 MHz, acting as an intruder and causing interference within the corresponding amateur radio band, as regularly documented by the IARU Monitoring System (IARUMS). Specifically, I observed a "twin" transmission at 9966.5 kHz. While it is difficult to establish whether both originate from the same transmitter site, their signal strengths on the waterfall display are nearly identical, suggesting they might be emitted from antennas with different take-off angles.

An intriguing aspect captured in Figure 3 is the simultaneous ±1500 Hz offset from the center frequency of both transmissions, with the signals returning to their baseline values within a few minutes.

Fig. 3 : simultaneous ±1500 Hz offset from the center frequencies

Such a deterministic and simultaneous shift points to two likely scenarios. The first is that this offset is pre-programmed by design, requiring the receiving modem to have prior knowledge of the transition to maintain carrier lock and ensure uninterrupted demodulation. Alternatively, if no prior agreement exists, the receiving system must employ an aggressive Automatic Frequency Control (AFC) or a wide DSP tracking loop capable of instantly detecting the energy shift and re-synchronizing within milliseconds.

By appropriately filtering the signal, it can be easily demodulated using the Signals Analyzer (SA) FSK demodulator. The resulting bitstream—at least in this sample—features a continuously repeating 255-bit pattern (typical of an 8-bit LFSR, 2^8 −1), as shown in Figure 4. However, the pattern does not appear to be generated by a polynomial.

Fig. 4: 255-bit period demodulated bitstream

To confirm this finding, I retrieved two additional recordings of this signal from separate YouTube channels. In both samples, the demodulated bitstreams exhibited the exact same characteristic (a 255-bit pattern length). However, analyzing further recordings could help to better characterize the payload.

Fig. 5: comparison of 3 demodulated bitstreams

Why Spend 7 kHz on 20 Baud?
This signal is engineered for high-availability survivability in contested environments. Using a massive 7000 Hz shift in HF FSK modulation deliberately trades away channel space to achieve near-indestructible reliability. Here is the breakdown of why it is used:

- Beating Ionospheric Fading. The ionosphere often creates narrow "dead zones" in the spectrum. By separating the two signaling tones by 7 kHz, it is statistically impossible for a single ionospheric drop-out to wipe out both frequencies at the same time. If one tone dies, the other gets through.

- Crushing Electronic Jamming. Spreading a slow data rate across such a massive frequency gap creates a huge modulation index. To block the signal, an adversary has to dilute their jamming power across a wide 7 kHz swath, making the jamming highly ineffective.

- Immunity to Doppler Drift. In unstable conditions (like polar regions or solar storms), frequencies can drift by tens of Hertz. For narrow shifts, this blends the tones together; for a 7,000 Hz shift, a 50 Hz drift is completely negligible.

- Signal Obfuscation (Stealth). Because it spans a bandwidth wider than a normal 3 kHz HF intercept receiver's window, an operator or automated classifier looking at a standard waterfall display will simply see isolated, alternating CW (Continuous Wave) pulses separated by a massive gap. It effectively hides its identity as a unified, synchronized FSK data stream, making it harder to automatically classify, intercept, or parse unless the intercepting party knows exactly what to look for.

The CIS 20Bd/7000 is a textbook example of Soviet-legacy military engineering surviving into the modern era. It prioritizes absolute link reliability and Electronic Counter-Countermeasures (ECCM) over spectral efficiency, providing a robust, jam-resistant command link that remains a frequent sight on the HF bands for modern SIGINT monitors.

https://disk.yandex.com/d/iwfwZCwjPiNq9Q

DTE-DCE Handshaking and Transmission Management

Following my previous post, a colleague reached out asking for clarification on the real-world, non-simulated operations of Data Terminal Equipment (DTE, typically a host PC) and Data Circuit-terminating Equipment (DCE, the HF modem). This inspired this post, which consolidates and structures the technical information scattered across the web. To ground these concepts in a practical scenario, this analysis focuses on an SDTE — more formally specified in NATO documentation as the SIS-DTE (Subnetwork Interface Service Data Terminal Equipment) — executing the STANAG 5066 stack. For clarity and consistency, this component will be referred to simply as the DTE throughout the remainder of this post.

Operating high-speed data networks over the High Frequency (HF) ionospheric channel presents an exceptional engineering challenge. The channel is inherently non-stationary, susceptible to severe multipath fading, atmospheric noise, and Doppler shifts. To maintain physical-layer synchronization under these hostile conditions, tactical waveforms such as MIL-STD-188-110A and NATO STANAG 4285 decouple the physical modulation speed from the actual user throughput.
Regardless of the data rate selected by upper-layer protocols, the physical over-the-air modulation speed remains strictly locked at 2400 baud (symbols per second). Scaling the data rate down from 2400 bps to a ruggedized 75 bps is achieved not by slowing down the radio's RF emission engine, but by dynamically increasing the density of Forward Error Correction (FEC) codes, interleaver settings, and bit-repetition factors. Managing this asymmetry requires an explicit structural division between session logic and physical timing. This post outlines the interface architecture, the real-world transactional flow, the critical impact of interleaver latency, and the modern IP-based evolution of systems operating between a STANAG 5066 DTE server and a DCE tactical radio modem.

1. Deconstructing the Interface: Baud, Bits, and Protocol Overhead
A frequent point of confusion in tactical data link design is the relationship between the over-the-air symbol rate (baud) and the baseband clock frequency driven across the physical DTE/DCE interface.

1.1. The 8-PSK Modulation Reality
In a standard MIL-STD-188-110A single-tone waveform, the modem operates at 2400 baud using 8-Phase Shift Keying (8-PSK). Because each symbol represents one of eight distinct phase states, it encodes exactly 3 bits of raw information (23=8). This establishes a constant over-the-air aggregate physical line rate of: 2400 baud × 3 bits/symbol = 7200 bps

1.2. Waveform Geometry vs. Coding Overhead
By subtracting the useful user payload from this 7200 bps aggregate line rate, we can isolate the exact volume of protocol overhead. However, this overhead is not strictly composed of Forward Error Correction (FEC). In military standard waveforms, a significant portion of this bandwidth is consumed by waveform geometry—specifically, channel-probing blocks.
The waveform structure alternates strictly between blocks of unknown data symbols and blocks of known pseudo-random training patterns (e.g., 20 data symbols followed by 16 probe symbols). The receiving Digital Signal Processor (DSP) uses these known probes to continuously map and counteract ionospheric fading and multipath distortion.

- At the maximum user rate (2400 bps):
7200 bps (Total Rate)−2400 bps (User Payload)=4800 bps (Overhead)
In this high-clearance scenario, the modem dedicates exactly 66.67% of its total over-the-air bandwidth to the combination of FEC data packing and synchronization probes to stabilize the link.
- At a highly ruggedized sub-rate (150 bps):
7200 bps (Total Rate)−150 bps (User Payload)=7050 bps (Overhead)
When channel conditions deteriorate, the protocol overhead consumes 97.92% of the total bandwidth. This mathematically demonstrates how aggressively the physical layer wraps each individual user bit in an extensive repetition and convolutional coding matrix to survive extreme signal degradation.

1.3. The Shift in Timing Leadership
To prevent buffer underrun or overflow during these speed adjustments, the system splits leadership between two distinct control domains:
- The DTE (STANAG 5066 Server) rules Session Configuration: It evaluates link performance via Automated Repeat Request (ARQ) frame error rates and dictates what data rate and interleaver depth must be utilized via its Dynamic Rate Adaptation (DRA) algorithms.
- The DCE (Modem) rules Physical Timing: Once a rate is selected, the modem operates as the master metronome. 

In a legacy synchronous interface—such as RS-530 or MIL-STD-188-114—the modem physically scales its baseband clock output (TX_CLK) to match the active user bit rate. If STANAG 5066 commands a 150 bps rate, the modem's internal oscillators drop the physical hardware line clock on the data cable to exactly 150 Hz. The DTE functions as a slave to this clock, forcing its internal serial shift registers to march precisely to the physical rhythm driven by the DCE.

2. Legacy Chassis Topology: Separating the Data and Control Planes
Using a legacy, rack-mounted standalone tactical modem—such as the Harris RF-5710A—as an architectural reference, the physical implementation mandates two completely independent cabling pathways to separate synchronous data delivery from runtime reconfiguration.

2.1.The J3 Remote Control Port (The Control Plane)
The J3 interface is an asynchronous serial port (typically configured as standard RS-232). It handles no user payload data. Instead, the STANAG 5066 subnetwork layer uses this link exclusively to transmit out-of-band management commands directly to the modem's central processor. These commands are formatted using either proprietary command architectures or standardized STANAG 5066 Annex E modem control strings.

2.2. The J2 Data Port (The Data Plane)
The J2 interface is a high-speed synchronous serial interface configured for RS-530 or MIL-STD-188-114 balanced signaling. It contains the physical baseband data lines (TX_DATA, RX_DATA), the master hardware clocks driven by the modem (TX_CLK, RX_CLK), and the discrete hardware flow control lines: Request to Send (RTS) and Clear to Send (CTS).

3. The Real-World End-to-End Transaction Flow
When an application connected to a STANAG 5066 server attempts to transmit a data block across an adaptive HF link, the interaction across the J3 control plane and the J2 data plane executes a precise sequence.

 

Step 1: Link Adaptation Assessment
The STANAG 5066 subnetwork layer processes incoming link-quality statistics from the distant receiving station. Noting a drop in the Signal-to-Noise Ratio (SNR), the DTE's Dynamic Rate Adaptation algorithm calculates that the link must drop from 2400 bps to 150 bps with a Long Interleaver setting to penetrate local atmospheric noise.

Step 2: Out-of-Band Reconfiguration (J3 Interface)
Before asserting any data lines, the STANAG 5066 server constructs a management frame enclosing Annex E configuration strings, e.g.:
[DTE -> J3 Async Input]: Command -> Set Waveform: 110A_SINGLE_TONE; Rate: 150; Interleaver: LONG;

 

The internal controller of the Harris RF-5710A parses the asynchronous packet, reconfigures its internal DSP algorithms, and prepares the physical layer to alter its baseband clock distribution.

Step 3: Interface Clock Realignment (J2 Interface)
The modem immediately scales its physical hardware clock synthesizer engine down. The physical TX_CLK line output on the J2 serial connector drops from a 2400 Hz square wave down to a steady 150 Hz pulse train. The hardware interface is now locked into the correct physical sub-rate window.

Step 4: The Physical Transmission Handshake
With the interface speed stabilized at 150 bps, the synchronous data transfer proceeds:
- DTE Asserts RTS: The STANAG 5066 server drives the physical RTS line on the J2 connector LOW (Active State). This serves as a direct hardware interrupt instructing the modem to key the attached HF radio transmitter.
- The Transmitter Keying and Preamble Phase: The modem keys the radio transmitter. It keeps the physical TX_CLK signal silent and the CTS line de-asserted. During this turnaround window, the modem generates and broadcasts a physical-layer over-the-air synchronization preamble. This known tone pattern allows the distant station’s receiver to achieve phase lock and evaluate interleaver synchronization.
- Modem Asserts CTS: Once the over-the-air preamble transmission concludes, the DCE drops the physical CTS line on the J2 connector LOW. Simultaneously, it activates the 150 Hz synchronous TX_CLK line.
- Synchronous Bit Burst: The STANAG 5066 DTE detects the active CTS boundary. On every rising edge of the incoming 150 Hz clock pulse provided by the modem, the DTE shifts one bit of data onto the TX_DATA wire. The modem samples this data precisely on the subsequent falling edge, funneling it directly into the DSP's FEC packing matrix.

4. The Interleaver Latency Penalty: The Hidden Operational Constraint
A critical operational factor that engineers must account for when deploying STANAG 5066 protocols over sub-rates is interleaver latency.
To protect data from long, continuous bursts of noise (fade duration), the modem utilizes a block or convolutional interleaver matrix. The transmitter rearranges the chronological order of bits over a specific time window before sending them over the air. The worse the channel conditions, the larger the interleaver matrix required.
When dropping to a sub-rate like 150 bps with a Long Interleaver, this matrix introduces severe physical delivery delays:
- The Buffering Constraint: The transmitter's DSP must wait until enough bits have accumulated to completely fill the structural interleaver matrix before it can shuffle them and begin actual over-the-air transmission.
- The Latency Cost: At 150 bps, filling a Long Interleaver matrix introduces a processing latency of 4.8 seconds or more at the transmitter, and another 4.8 seconds for de-interleaving at the receiver.
Consequently, the first bit of the user payload does not emerge from the receiving station's modem until nearly 10 seconds after the DTE begins shifting data. This structural delay dictates that the STANAG 5066 layer must scale its internal Automated Repeat Request (ARQ) frame timers aggressively. If the software's acknowledgment timeout timers are set too short, the DTE will prematurely assume a packet was dropped and retransmit it, clogging the narrow 150 Hz pipeline with duplicate traffic.

5. The Modern Evolution: Transitioning to IP-Based Software Defined Radios
The legacy Harris RF-5710A represents a 'High-Data-Rate, IP-Ready, and Annex-E Compliant' evolution capable of driving the HF channel up to 9600/12800 bps via adaptive QAM, enabling the efficient utilization of modern STANAG 5066 servers featuring Dynamic Rate Adaptation (DRA). It serves as the ultimate historical bridge between old-world balanced cabled engineering and modern consolidated networking architectures.
In contemporary Software Defined Radios (SDRs)—such as the Harris Falcon III series—the separate physical modem and transceiver chassis collapse into a single integrated unit. Physical J2 and J3 serial connectors are completely replaced by a single Ethernet interface running standard IP stacks. This shifts the implementation from hardware-level pinning to software-defined protocol boundaries:
- The Control Plane is virtualized. Instead of serial strings sent over a dedicated RS-232 line, the STANAG 5066 node establishes a TCP/IP or UDP socket connection to a designated management port on the radio, sending configuration packets using modernized subnetwork control protocols (such as the HF Radio Control Protocol / HRCP).
- The Data Plane eliminates physical clock lines (TX_CLK). The Data Plane eliminates physical clock lines (TX_CLK). Baseband streaming bits are packaged into standardized encapsulation networks, such as STANAG 4538 or virtual synchronous serial profiles over IP. The radio's internal software clocks handle the synchronization between incoming IP packets and the underlying DSP modulator frame boundaries.

Despite this transition to IP-routed pipelines, the core architectural logic remains completely unchanged. The STANAG 5066 software node remains the logical king of data rate selection based on link performance, while the radio's internal DSP remains the absolute metronome of physical over-the-air ionospheric synchronization.

Simulating ADF ISB Transmissions: 12-Bit Repetition Coding on the USB Channel

The idea for this post stems from an interesting RAN (Royal Australian Navy) fleet broadcast originating from the MHFCS (Modernised High Frequency Communications System) utilized by the ADF (Australian Defence Force). The captured transmission employs STANAG-4285 at 600 bps/L in ISB (Independent SideBand) mode on 14874.0 kHz (Figure 1), and was successfully recorded thanks to the remote KiwiSDR VK6QS2 located in Augusta, Western Australia.

Data redundancy is a mission-critical asset in military HF communications. To ensure reliable delivery over thousands of miles, this transmission architecture departs from standard handling, utilizing the ISB spectrum to securely distribute the payload. 

Fig. 1: ADF MHFCS in ISB mode

As mentioned, the transmission relies on an asymmetric Independent Sideband (ISB) framework: the Upper Sideband (USB) delivers a redundant 600 bps stream wherein each individual bit is replicated 12 times, while the Lower Sideband (LSB) simultaneously transmits a "standard" signal at an identical 600 bps clock rate. This dual-path configuration mitigates severe ionospheric fading, allowing the receiver to cross-correlate the sidebands and reconstruct the payload without data loss. 

Technical analysis confirms that the LSB stream represents a broadcast encrypted by a KW-46 (or compatible) crypto-device, identified by the m-sequence of the generator polynomial x^31+x^3+1. This sequence is natively employed by the KW-46T transmitter for remote receiver synchronization (KW-46R). In contrast, the USB data structure exhibits 12-bit blocks of uniform logical states, most likely originated by a GA-205 12-channel Time-Division Multiplexer. This sideband similarly secures its payload using KW-46 protocols: as illustrated in Figure 2, by isolating a single multiplexed channel, stripping the remaining 11, and reshaping the data into a 7-bit architecture, the presence of the identical x^31+x^3+1 m-sequence was conclusively verified.

Fig. 2 : LSB and USB demodulated bitstreams

In this sample, both STANAG-4285 modems have the exact same clock speed and line rate of 600 bps on the physical serial line (the DTE/DCE interface) (1).  However, the amount of unique, useful information (the actual payload) is highly asymmetric: the USB channel carries a 50 bps information rate (Strategic Command & Control ?) protected by the 12x repetition code, while the LSB channel carries a native 600 bps information rate (Routine Data Traffic & Logistics ?).

The ultimate operational of ISB in this scenario is spectrum optimization.  Instead of requesting two distinct HF frequency allocations from military spectrum management, which would tie up vital radio assets and increase the station's electronic footprint, the user allocates a single suppressed carrier frequency. By utilizing ISB, the transmitter concurrently radiates two separate, parallel operational environments on a single RF assignment. 

A similar ISB paradigm is utilized, for example, by specific Portuguese Navy transmissions operating in STANAG-4285 600 bps/L mode, notably on the 12704.5 kHz Center Frequency (CF), using the HF callsign CTA12 (Figure 3). The bandwidth allocation is split as follows:

LSB Channel: Transmits the plain text Channel Availability and Receipt Broadcast (CARB), also frequently designated as the FAB (Frequency Availability Broadcast)

USB Channel: Carries a secure, encrypted fleet broadcast utilizing a legacy KW-46 cryptographic device.

Fig. 3: Portuguese Navy CT12 working in ISB mode

Concerning the source of the transmission, TDoA geolocation points to the 'Naval Communication Station Harold E. Holt' (NCS HEH), situated 6 km north of Exmouth (Figure 4). COMMSTA HEH is jointly operated by Royal Australian Navy and US Navy personnel. The High Frequency Transmitter (HFT) site houses an array of hardware, much of which is dedicated to point-to-point communication circuits linked to shore facilities and surface vessels operating within the station's operational footprint.

Fig. 4: Direction Finding (TDoA) results

The remainder of this post aims to simulate the generation of the baseband data stream for the USB (Upper Sideband) channel, alongside DTE-DCE timing management, using hardwired digital logic managed by Arduino microcontrollers. Naturally, this is a standalone proof of concept and does not reflect the actual hardware infrastructure utilized by the MHFCS.
To evaluate the generation of the cloned 12-bit redundant stream, the simulation leverages a CD4067 multiplexer (MUX) to closely mirror the hardware-level TDM implementation of the GA-205 12-channel multiplexer used by the Australian Defence Force. I followed the logical block diagram illustrated in Figure 5, implemented using breadboards, TTL and CMOS chips, and two Arduino microcontrollers. Figure 6 shows the components prior to wiring.

Fig. 5: USB channel formation

Fig. 6

A: extender buffer 

Implementing a 1-to-12 output bit extender (also known in electronics as a fan-out replicator or distribution buffer) using TTL logic is a classic and very straightforward project. The crucial factor is the current: a single output pin of a standard chip does not have the electrical strength to drive the 12 inputs of the following multiplexer (MUX) simultaneously while maintaining the correct voltage levels. For this reason, buffers are required. I used the 74LS04 chip, which contains 6 inverters (NOT gates). By routing the signal through two inverters in cascade, the bit is inverted twice, returning to its original state but with all the necessary driving power. Using the common 74LS04 chips we need to employ a 'cascade' logic: one gate acts as a pilot (inverting the signal the first time), and the other gates act as splitters (inverting it a second time, thus restoring the original signal). Given that each chip contains 6 gates, using 3 chips gives us a total of 18 gates: one will serve as the pilot, and 12 will provide the desired outputs.

B: multiplexer

The CD4067B module, a CMOS single-ended 16-channel pre-monted board, is utilized as a synchronous time-division multiplexer (TDM), serving as the critical link that generates the redundant serial stream. Driven by the binary addressing logic of Arduino #1, the CD4067B sequentially samples each input channel. By allocating an identical, deterministic time slot to every channel, the chip enforces the strict synchronous timing required to mimic real-world TDM hardware like the GA-205. The multiplexer acts as the true functional centerpiece of the system that replicates the structural signature observed in the original MHFCS transmission.

C: Arduino #1

The first microcontroller serves as the data source and hardware controller, driven by Arduino 2 clock. It is responsible for generating or forwarding the low-speed baseband bitstream (e.g., 50 bps) and generating the necessary addressing logic to drive the multiplexer. It ensures that the correct channel is actively routed into the system pipeline with precise timing.

D: Arduino #2 

The second microcontroller functions strictly as a downstream monitoring and simulation of the digital front-end of a STANAG-4285 modulator: it processes the incoming bitstream exactly as the STANAG-4285 hardware would see it, capturing the raw, synchronous 12-bit sequences directly from the multiplexer's output. The line tapped by the Arduino RX carries the exact, fully formed digital data that is ready to be applied to the physical input of the modem. This allows for comprehensive loopback testing, signal verification, and diagnostic analysis of the transmission line without needing to connect a physical modem unit.

This architecture functions as a redundant 12-bit serializer achieving high noise immunity and fault tolerance. On top of this hardware-level redundancy, the STANAG-4285 modem will introduce an extra layer of protection against fading and burst noise, thanks to its robust FEC (Forward Error Correction) and configurable interleaver mechanisms.

The fully wired circuit is depicted in Figure 7.

Fig. 7

Figure 8 displays the serial monitors of the two Arduino microcontrollers: the data source (top) and the receiver (bottom). Two "COM4" ports are displayed because the Arduino boards are driven by two separate PCs. Note that a very low clock rate was chosen in the firmware implementation allow easy reading of the serial monitors.

Fig. 8:serial monitors output of the two microcontrollers

A note about Bitrate Expansion vs. Datarate Preservation

The integration of the buffer-extender and the hardware multiplexer within this data pipeline serves a dual purpose: expanding the transmission bitrate while strictly preserving the baseline datarate (the actual information payload). 

Bitrate Expansion (50 bps→600 bps): The system ingests a baseline digital signal at 50 bps and up-rates the transmission frequency by a factor of 12, delivering a 600 bps synchronous stream at the final output. This high-speed clocking is structurally required to match the ingestion constraints of the STANAG-4285 modem. 

Datarate Preservation: While the physical signaling speed increases, the net information throughput remains exactly identical to the 50 bps input. The system does not inject new data or alter the original message content. Instead of increasing information capacity, the remaining bandwidth created by the 12x clock multiplier is entirely dedicated to data redundancy. Each original bit is algorithmically mapped across the 12-bit output frame.

https://disk.yandex.com/d/-9xhLnBZ-7RPKw  Royal Australian Navy, 14874.0 kHz CF

https://disk.yandex.com/d/MyzyM20VOnYTvg Portuguese Navy, 12704.5 kHz CF

(1) In professional HF communications (such as STANAG 4285 or MIL-STD-188-110A), the DCE (Data Circuit-terminating Equipment / Modem) acts as the master of the communications link, while the DTE (Data Terminal Equipment / Data Source) acts as a slave regarding timing and throughput.