Deep WALE (4G-ALE) Async call

Thanks to my friend and collegue ANgazu, I was able to analyze some WALE (4G-ALE, 188-141D App.G) asynchronous calls transmissions which reveal some aspects that are not entirely clear or even a bit discording with the relevant standard, at least according my analysis and the docs at my disposal. Perhaps it is some specific implementation or maybe tests, as a lot of 4G-ALE & wideband activity has been recently monitored in the 6.9 - 7 MHz portion. 

Fig. 1

As in the "Fast" WALE async call [1], the LSU Request PDU must be preceded by a scanning call (the so-called "capture probe") which is designed to capture asynchronously scanning receiver(s) so that they will stop scanning to receive the final LSU Request. The capture probe consists of repeated blocks of 96 known PSK8 symbols that permit rapid detection of the call, and therefore very short scanning dwell times. As in 2G and 3G ALE, the duration of the WALE scanning call dependes on the number of channels in the scan set and is as follows:
Tcapture ≥ Dmin(N+2)
where Dmin is the asynchronous-mode minimum dwell time (200 ms as default setting) and N is the number of channels. However, conversely of 2G and 3G ALE, the scanning call portion of the async WALE call is unaddressed: that is, the addresses of the stations are not sent during the capture probe (1).

Fig. 2 -  Deep WALE async call

In the sample being analyzed, after demodulation the 6000 ms capture probe consists of 150 blocks which corresponds to a scan set of 28 channels and confirms the use of the minimum dwell time (6000=200*30).

Fig. 3

As per 188-141D App.G, the capture probe is followed by a 240 ms acquisition preamble, followed in its turn by one (or more) coded and interleaved WALE Request PDU. The WALE LSU protocol use a fixed 96-bit length PDU for both Fast and Deep waveforms with a correction coding consists of a constraint length 9 (CL-9), half rate convolutional code producing a 192-bit coded block to be interleaved (ie, for each bit input to the encoder, two bits are taken from the encoder).
Using the Deep WALE waveform, the coded and interleaved PDU bits are sent four at a time. Each set of four bits (a “quad-bit”) is used to select one of the 16-element Walsh sequences, the selected 16-element Walsh sequence is then repeated 4 times to yield a 64-element Walsh sequence. Each 64-element channel symbol is scrambled using 64 8PSK symbols of a scrambling sequence generated using a 159-bit shift register with a single tap after bit 31 which run without re-initialization for all PDUs in a transmission (the shift register is initializated only at the beginning of a the Deep ALE transmission) (2).
Therefore a (coded and interleaved) 192-bit WALE PDU resolves in 48 "quad-bit" sets each consisting of 64-element Walsh sequence, for a total of 48 * 64 = 3072 PSK8 symbols, and has a duration of 1280 ms (Known Symbols segments are not sent in Deep WALE PDUs, so Walsh coded data symbols are sent continuously after the initial preamble).

 

The lack of mini-probe shapes in the PDU portion and its 1630 ms duration (figure 2) allow to Id a Deep WALE modulation. Unfortunately, the autocorrelation of the signal is not of much help. Given that the scrambling shift register x^159+x^31+1:

• is iterated 16 times between the generation of each scrambling symbol
• run without re-initialization(!) for all PDUs in a transmission
• has a max sequence length of 2^159 -1
• is used to scramble a small number of PDUs (if not only one)

it will be impossible to get repetitions in the portion of the WALE PDU but - obviously - only the strong 40 ms spikes due to the 96-symbol blocks of the capture probe (figure 4).

Fig. 4 - ACF values of the scanning call and WALE pdu portions

However, it should be noted that the 1630 ms duration of the Deep WALE PDU does not match the expected 1520 ms one (240 preamble + 1280 data): thus, there is somewhere an "extra" duration of 110 ms. In this regard, figure 6 shows a short segment "S" where, although the lack of the 1800 Hz carrier (or not detected/detectable by SA), the signal is still actually keyed at 2400 symbols/sec; also notice that in place of the carrier rather fairly solid "diagonal traces" show up. 

Fig. 6

Looking at the time durations in figure 7, the segment "S" lasts ~350 ms and "positionally" it coincides with the preamble preceding the Request PDU data: here it's the reason of the extra 110 ms duration, ie an "extended" 350 ms (240+110) preamble which consists of 840 PSK8 symbols that - anyway - does not resolve into an integer number of Walsh modulated symbols! (188-141D #G.5.1.7.1 specifies a 18 Walsh modulated symbols preamble).

Fig. 7

Such discrepancies between the actual on-air signals and the relevant standard have already been highlighted in the Fast WALE PDUs, at least in the ones that I had the chance to analyze [2]. It must be noted that the recent releases of 188-110D and 188-141D extend the max bandwidth to 48 KHz therefore 110C/141C compliant waveforms are in some way a bit "obsoleted" as well as HF modems such as Harris RF-5800 (WBALE & WHARQ waveforms), RapidM RM10 and others. What do I mean? My point is that probably we are dealing with a proprietary implementation/enhancement of the latest WBHF standards (ALE and traffic waveforms): given the quite long monitoring available (more than 30 GB of recordings to review), further analysis and investigations will follow in next posts.

https://disk.yandex.com/d/oBD93dy4dY3BeA 

(1) In 2G and 3G-ALE the address of the called station is contained in the scanning call, thus all stations that are not included in the call are free to resume scanning. The 4G-ALE scanning call consists of repeated blocks of known symbols so that a station must wait for the final Request PDU  to find out if it's the recipient of the call:

That choice of unaddressed scanning calls has interesting consequences:

• all scanning stations are captured and held until the WALE Request PDU (which contains the address) is received. This is a drawback, but the short dwell time (200 ms) results in short scanning calls, so this is mitigated;

• because it does not contain station addresses, the capture probe of the async call is not encrypted.

 

(2) the same (159,31) scrambling polynomial and Walsh sequences are used in MIL-STD 188-110C for the Waveform ID-0

[1] https://i56578-swl.blogspot.com/2021/02/4g-ale-async-two-way-point-to-point.html
[2] https://i56578-swl.blogspot.com/2021/01/4g-ale-fast-wale-188-141d-and-wbhf.html