29 June 2015

Unid OFDM 16-tone 75 Bd, 110 Hz (MS 188-110A App.A modified?)

I had this signal via Twente SDR on USB 14301.8 (cf)  on 28/06/15 (1710z) just in the well-known 20 mt reserved band, an that's a bit odd.
The waveform is an OFDM 16-tone PSK, 75 Bd and 110 Hz shift, sent in burst mode. It is very similar to the obsoleted Standard NATO MIL 188-110A Appendix A without the doppler tone @ 605 Hz and in not-continuous mode.
OFDM parameters
There is a Chinese variant of the MIL 188-110A 16 channels: it could be this case, but I could not find info or logs about it. The burst mode could lead to something like a selcall waveform but the ~720mS spaced "pips" looks like a TDMA.
Hope to get more info and/or more records.

A short recording can be downloaded from here:

27 June 2015

Unid FSK-8 + PSK-2 1200 Bd (prob. AX-25)

Recordered this morning on 19304.0 USB (central frequency 19305.0) starting from 0937z until 1020z (s/off). The trasmission  heard consists of a series of short messages in PSK-2 1200 Bd (as well as some short bursts) along with 9-tones intervals. Sometimes a PSK-2 100 Bd preamble is sent. 

9-tones and PSK-2 1200 Bd insertions
PSK-2 1200 Bd, carrier ~1060 Hz
the 9 tones, top and bottom @ 7dB higher

PSK-2 100 Bd preamble
The transmission ended with a short CW/Morse message, decoded as "RFM U NIL SK 73" (more likely the '73' stands for greetings, as in HAM world).

The same waveform has been reported in radioscanner.ru:
and it is still un-identified.

Unid FSK 50/500

This signal was heard on 14568.0 (cf) around 1410z, 25 Jun. It's a sync FSK 2-carriers with shift = 500 Hz and baudrate = 50 Baud. ACF160ms with odd 2 bits stop and apparently no start bit.

25 June 2015

SERDOLIK sync marker (idling)

24/06/15 16047.0 --- Russian Gov 0918 Serdolik sync marker

The sync marker sequence is sent alone or after a Serdolik Selcall as shown below

Serdolik Selcall and Sync Marker (courtesy of KarapuZ)
Serdolik, as several time reported in this blog, is a complex system used by Russian Gov/Diplo and designed to connect embassies and diplomatic missions. The link below is a little story of this system:
Thanks to KarapuZ for the link and the Sedolik Selcall waveform.

20 June 2015


18/06/15 10146.0 HB9AK Winlink Mail Server 0700  Winmor-500

The WINMOR (WINlink Message Over Radio) protocol is intended to be used for sending messages and binary data error free over a HF radio link. It is a Selective Repeat Automatic Retry reQuest (SRARQ) protocol where the Information Receiving Station (IRS) acknowledges receipt of the data to the Information Sending Station (ISS). Normally during a connection session the IRS and ISS exchange roles multiple times. The protocol is designed to handle the type conditions normally encountered in amateur radio transmission. WINMOR is not optimized for keyboarding or chat mode applications though this may be possible.

The WINMOR protocol uses basic OFDM (Orthogonal Frequency Division Multiplexing) modulation and a number of modulation modes and error correction schemes to adapt to changing channel conditions.
There is currently 2 operating bandwidths of 500 and 1600 Hz (@ 26 db below peak power output:
  • 500 Hz BW 2 carriers 46.875 Baud 4FSK or 93.75 baud PSK
  • 1600 Hz BW 8 carriers 46.875 Baud 4FSK or 93.75 baud PSK
Pic. 1a - WINMOR-500 data frames
Pic. 1b - 4FSK grid

I recently heard (18 June, Pic. 1) the WINMOR 500 Hz bandwidth mode around 0700z on 10146.0 KHz (center frequency). As said, the 500 Hz bandwidth mode use 3 modes PSK:
- 4PSK TCM, 8PSK TCM, 16PSK TCM  - 2 Carriers at 1406.25 Hz and 1593.75 Hz
and one 4FSK mode:
- 2 groups of 1 of 4 Carriers. (2 carriers active simultaneously)
  Group 1: 1312.5, 1358.375, 1406.25 and 1453.125 Hz
  Group 2: 1546.875, 1593.75, 1640.625 and 1687.5 Hz

A WINMOR frame is composed of a Pilot ("leader" of the frame) and Data. The Pilot is used to enable rapid identification of a transmission, to DSP tune the receiving station accurately, to establish symbol and frame sync and to indicate the frame type:
Data frames:
- Two carrier 8PSK (Pic. 2)
- Two carrier 4FSK (Pic. 3)  
Control frames:
- Connect ReQuest frame: 2 Car 4FSK
- Coded Control Frame: 2 Car 4FSK (Pic. 3,4,5)
- Ack: 2 Car 4FSK FEC (Pic. 4)

- ID frame: 2 Car 4FSK (Pic. 5)

Pic.2 - 16QAM data frame
Pic.3 - 4FSK data frame and control frames

Pic. 4 - control frame and ACK frame
Pic. 5 - control frame and ID frame

17 June 2015

Harris RF-5800 'Selective Call', MSK 2000Bd/1000

('Systeme3000-ALE' equivocation)

We recently had the opportunity to get and study the Harris Selective Call waveform (we name it as Harris-ALE but it's not its official name!): it's an MSK modulation at 2000 Baud speed, followed by short MFSK-8 125 Baud in non-standard MS-188-141A (ALE), acf is 50 ms (100 bit). We focused on the initial 3 seconds segment in order to define modulation mode and other features in order to help to clarify the above misunderstanding (see later).

At first glance it looks like a serial-tone signal: carrier frequency 1600 Hz and OQPSK modulation at 2000 Bd speed (pic. 1). As reported in this article by Sergey Makarov (SergUA6) http://signals.radioscanner.ru/info/item281/ "it is not easy to tell apart between QPSK and MSK since they are tightly connected".

Pic. 1- Harris Selective Call and its phase-plane
By measuring the main parameters of the signal we had (pic.2):

baudrate (Br) = 2000 Bd

bandwidth (Bw) ~ 3000 Hz

shift (Sh) = 1000 Hz

Pic. 2
That said, and according to what reported here http://signals.radioscanner.ru/info/item68/ we are pretty sure that the Harris Selective Call is not an OQPSK but rather an MSK 2000/1000 waveform, 2000Baud speed and 1000Hz shifted. As it is clearly visible in pic.2, are verified those relationships that are specific to MKS signals, i.e.: Bw = 1.5 Br and Sh = Br/2 as shown in the cited article (pic.3):

Pic. 3 - MSK relationships (from radioscanner.ru)

Moreover, into the Harris signal, there is another clue that points to MSK. As you can see in the picture 4, there is a long state staying in one frequency, if should it be PSK, the frequency should come back to carrier and stay there till a new phase change. 
Pic. 4

 The shape of the eye diagram (pic. 5) also points in this direction (MSK with BT = 0.3):

Pic. 5
The Harris signal has an ACF value of 50 mSec (100 bit) and it is characterized by the presence of what looks like a signature, something like a 'business card':

As said, this is a safe-origin signal since it was recordered some years ago during Harris RF-5800 acceptance tests: at that time it was supposed to be standard in Falcon-II series radios. Harris equipment is wide spread in NATO countries, but this mode, although available, seems to be not much used.

With these points in mind, we asked ourselves the question that we indicated at the beginning: the so-called Thales “Systeme3000-ALE” (reported also in a post on this blog) has a waveform that is very similar to the Harris-ALE' one, also aurally they just sound in the same way. Browsing the web, there are logs by listeners reporting both the signals: altought the Thales waveform be almost 99.99% OQPSK, may be the case that these two signals could be confused each other ?