Harris wideband operations, WHARQ and WBALE waveforms (2)

Recently we had the chance to monitor and record the wideband transmissions on 7.9 MHz thanks to the use of four fairly close together KiwiSDRs [1] (we think transmitters use low power and NVIS) and this allowed us to have a better understanding of the whole scenario.
The data waveforms occupy a bandwidth from 3 to 24 KHz (grouped together under the title, courtesy of radiofrecuencias.es) and use an adaptive ARQ pattern with modulations from PSK-8 up to QAM-64. As said, most probably they are part of the Harris WHARQ development: a proprietary wideband HF waveforms family, already discussed here and largely discussed by my friends ANgazu, Malak and Rapidbit in radiofrecuencias forum [2]. The burst waveforms are the WBALE PDUs, i.e. the Harris design choices for the implementation of 188-141D extensions for 3GWB mode [3]. 
 

Fig. 1 - spectrogram of a WHARQ waveform (credits to ANgazu)

WHARQ waveforms have a preamble/header followed by slots of miniprobe and data, 8 slots make a frame (or 8 frames grouped into a super-frame). Header modulation is always PSK-8 and it's followed by a "double" miniprobe. The duration of the header relies on the speed of the waveform (baud rate) and not depends on the used modulation. Frame is made up by 8 slots (data + miniprobe) consisting of 8 different miniprobes for each frame. ACF varies depending on modulation and baudrate. For further details on WHARQ I suggest to read the relevant posts and analysis in radiofrecuencias forum, here I focused on the WBALE bursts.

A quite clear WBALE/WHARQ scenario is visible in the IQ recording below in Figure 2:

Fig.2

The upper bursts are 3G STANAG-4538 BW5 and BW6: BW5 is used for Fast Link Setup (FLSU) and BW6 used as acknowledgemts PDUs. Lokking at these samples, in my guess it seems that BW6 ACK is used with 3 KHz WHARQ waveforms and a proper WHARQ ACK burst is used with wider waveforms. 

Harris approach for 3GWB is based on a simple enhancement to the Fast Link Setup protocol defined in STANAG 4538. The primary modification is the use of an additional 3 kHz bandwidth burst handshake (WBALE HS in Fig. 3) which exchanges profiles of the two linking radios' locally measured interference environments and negotiates a waveform bandwidth, offset from the specified channel frequency, and modulation and coding selection suitable for reliable high-performance communications.

Fig. 3 - Harris WBALE (not in scale!)

The WBALE handshakes are clearly visible in Fig. 4, it's worth noting the change of the traffic waveform after bandwidth negotiation:

Fig. 4 - WBALE handshakes

WBALE PDUs are very similar to BW5 FLSU PDUs so I analyzed them using a 3G demodulator: the following are therefore my hypothesis that need further confirmations.

 

Fig. 5 - WBALE waveform

The PDUs have a duration of 525ms and consist of 1216 PSK8 (2400Bd on-air) symbols: 256 PSK8 symbols (768 bits) for the preamble which is followed by 960 PSK8 symbols (2880 bits) for the ALE payload. I don't know, though it's likely, if the preamble is preceded by one or more short TLC blocks (they might be ignored by demodulator). Since Harris WBALE it's 3G based, i.e. network participiants are synched, I do not think to "variable" length PDUs to best fit the scanning lists: there is no need since the peers are already linked by the previous BW5 FLSU handshakes (this means that WBALE bursts are not "caller" PDUs!).

1216 symbols @ 2400Bd are well suited to the duration of 525 ms

After a raw PSK-8 demodulation the payloads show a 3-bit structure (Fig. 6) and are possibly modulated using a Walsh function: it's difficult to establish the actual length of the payload since FEC coding and Walsh format info missing (by the way, payloads could be descrambled using the polynomial x^4+x^3+x+1 to obtain a 12-bit stream... but it's just a speculation!).  

Fig. 6 - payload 3-bit structure after raw psk8 demodulation

[1] thanks to the owners of the KiwiSDRs
http://eemedia.mynetgear.com:8073/
http://n4ttn.ham-radio-op.net:8073/
http://rx.jimlill.com:8073/
http://38.86.67.206:8078/

[2] http://radiofrecuencias.es/viewtopic.php?f=11&t=1204&hilit=wharq 
[3] http://i56578-swl.blogspot.com/2018/04/3gwb-3g-ale-extensions-for-wideband.html