a STANAG-4285 autobaud waveform?

Interesting STANAG-4285 transmission heard on 14000 KHz/USB and sent me by my friend GrandBleu from radiofrecuencias.es (Figure 1)

Fig. 1 - STANAG-4285 segments

The 35 sec segments seem a modified S-4285 waveform since they begin with a block, that I here refer to as "header", and which is not referenced in the standard. The header has a duration of 116ms and is modulated using PSK2, as you may see in Figure 2.

Fig. 2 - PSK2 modulation detected in the initial "header"

I used the SA phase detector and its relative bitmap in order to "browse" the signal and to better indagate the header. Looking at Figure 3 you may see a 13.333ms repeated pattern: well, 13.333ms @ 2400 symbols/sec makes a duration of 32 symbols (31,999) or 32 bits, since the header is PSK2 modulated (ie 1 bit = 1 symbol).

Fig. 3 - 32-bits repeated pattern in the header of the heard S-4285 waveform

Consequently, I tried a PSK2 demodulation of the headers of some segments and after their differential decodings I obtained  bitstreams which exhibit a well-defined structure consisting of initial and final "01"s sequences and characterized by a 32 bits sequence which is six times repeated immediately before of the final "01"s sequence and that exactly matches the pattern seen in the bitmap of Figure 3.

[10100001001111001111100011011110]

Fig. 4 - differential PSK2 decoding of a header

The same 32-bit sequence was found in all the headers I demodulated (just 3 of them are shown in Figure 5), even if it didn't appear in the same order I wrote it: one must consider the characteristcs of the SA's generic (!) PSK-n demodulator .

Fig. 5

I don't think this so-called header is actually a “transmit level control” (TLC) block. Indeed, no information is carried by the TLC since it's a sequence of symbols intended solely for the purpose of establishing the radio TGC (transmit gain control), ALC (automatic level control) and AGC (automatic gain control) before the actual preamble is sent/received. In my opinion this S-4285 waveform feature an “autobaud” facility (1) which is coded in the initial header (perhaps a Walsh coded sequence?). As shown in Figure 5, the autobauding information would consist of 6 frames, each with a duration of 13.3 ms and a length of 32 bits (total length of 192 bits), and precedes the S-4285's usual synchronization preamble.

And let's get to the data blocks. To identify which sub-mode is used I chose from time to time the various options made available by a S-4285 decoder (k500) until I found the option that had 100% confidence and 0 errors: that is, 300bps and zero length interleaving.  As a test, I used a second S-4285 decoder and always got the same result even if the resulting bitstreams didn't seem structured. Although these decoders indicated 100% confidence and 0 errors (corrections), curiously they did not detect/show the 32-bit words used for signaling the Start Of Message (SOM = 0x03873C3C MSB first) and End Of Message (EOM = 0x4B65A5B2 MSB first): could it be sign of a "fake" decoding? Finally, I used a third, more sophisticated, decoder configuring it in "auto-detect" mode: this third test also confirmed the 300bps/N sub-mode but with the reporting of corrections and a resulting bitstream with a 40-bit/5-byte period that has - in my opinion - a bit more sense.
The 40-bit length period is due to the presence of a sequence that is four times repeated near the end of all the decoded segments (Figure 6). Note that the same considerations made above apply to the sequence in question.

[1101101000100111101001111111000111100101]

At first glance it could be an EOM/EOT signal but the bitstream should come from a higher level protocol (datalink layer) i.e. after the removal of the S-4285 overhead and therefore should have a different function.

Fig. 6 - a data blocks bitstream

That datalink protocol (if any ) is at present unknown to me.

Back to the initial headers, I remembered having seen something similar a while back while I was analyzing Harris' serial PSK8 waveforms [1] and by demodulating their initial headers I found a correspondence between those headers and the one analyzed here: that is, a sequence of 32 bits of length which is repeated six times between sequences of initial and final "01"s (Figs. 7,8)

Fig.7

Fig.8

From the above it seems that L3Harris (and perhaps not only them) have added the "autobaud" function to some waveforms such as STANAG-4285, obviously it is only my hypothesis which has no direct or indirect confirmation: your comments and other submissions will be as usual welcome and may assist in resolving this matter.

https://drive.google.com/file/d/1WD9gBFzbGnmMdBFITTOYFf5AOTWCij4y/view?usp=sharing

(1) the “autobaud” facility enables the receiver modem to automatically adapt the transmitter’s data rate and interleaver configuration without operator intervention

[1] http://i56578-swl.blogspot.com/2021/11/harris-psk8-2400-bd-digital-voice.htm

Japanese Navy fleet broadcast, a review of the "Japanese Slot Machine" (I)

Japanese Maritime Self-Defence Forces (JMSDF) HF Fleet Broadcast, also known as the "Japanese Slot Machine", heard with data payloads on 8312.50 KHz/USB using a remote KiwiSDR located in Azumino-city, Nagano Japan [1]. This signal has the Enigma designation "xsl" but I honestly don't understand why it was placed among the "mysterious signals" or even among the number stations: probably due to its characteristic idling refrain because it is nothing more than a fleet broadcast as well as the continuous and uninterrupted STANAG-4285 transmissions. 

The waveform is composed of the idle phase and the traffic/data phase. 

The data waveform occupies a 2 KHz bandwidth and use a 1500 Hz sub-carrier which is QPSK modulated at the symbol rate of 1500 Baud (Figure 1). 

Fig. 1 - QPSK parameters of the data waveform

The signal has strong ACF spikes every 93.33 ms (Figure 2) that, at the speed of 1500 Bd, correspond to a frame of 140 dibit symbols in length (frame rate of 10.71 Hz).

Fig. 2 - autocorrelation spikes and relative bitmap (data waveform)

The demodulated bitstream in Figure 3 shows a framing consisting of a probe/sync aimed "preamble" sequence (ps) of 28 known symbols (56 bits) in length followed by 112 unknown symbols representing the transferred data

[10001010001000100000001010100010101010100000100000101000]

Fig. 3 - 140 QPSK symbols (28 + 112) frame structure

Looking at the representation of the QPSK symbols of a frame (Figure 4) you can see that the 28 symbols of the preamble sequence are PSK2 modulated and then mapped to dibit symbols.

Fig. 4 - graphic rapresentation of a 140-symbol frame

The confirmation comes from the examination of the second degree harmonics in Figure 5 where the PSK2 modulation of the subcarrier can be clearly distinguished for a duration of 18.66 ms corresponding to 28 symbols at the keying speed of 1500 Baud. Also note the accentuated PSK transitions in the phase diagram.

Fig. 5 - PSK2 modulations

Data symbols have a flat autocorrelation indicating a (convolutional?) coding other than interleaving and encryption: bit distribution and Shannon entrophy graphs are good clues.

Fig. 6 - bit distribution and Shannon entropy of the data symbols

The idle waveform too is QPSK modulated at a symbol rate of 1500 baud but has a complex framing which to some extent follows the traffic waveform. As in the traffic waveform, the framing consists of repetions of 140 symbols/93.33 ms frames which generate the distinctive audio refrain (Figure 7).

Fig. 7 - idle phase signal

The underlying clicks audible during the idle phase have a frequency of 11.5 Hz and corresponds to the 140-symbol frames (Figure 8).

Fig. 8 - 11.5 Hz ticks

The autocorrelation of the idle signal (Figure 9) shows strong 5973 ms spikes grouping the lower 93.33 ms spikes; since the 1500 Bd keying speed, from a simple calculation the 5973 ms ACF results as a group of 64 frames each of 140 symbols: the 64 frames sequence is here designated as "superframe" and it exactly lasts as the refrain.  

Fig. 9 - autocorrelation spikes and relative bitmap (idle waveform)

The superframe structure is visible in the demodulated bitstream once reshaped to 140 symbols (280 bits) in order to highlight the 64 component frames: it's worth noting the presence of the same 28 symbols preamble sequence seen in the demodulated data bitstream (Figs 10, 3). Since the preambles are repeated in all frames, they are the cause of the underlying clickings mentioned above.

Fig. 10 - idle waveform, superframe structure

After the removal of the preamble sequence, it's easy to see that the remaining 112 symbols of the superframes are formed of four 28-symbols blocks, each block consisting of the same patterns (Figure 11).

Fig. 11

After having isolated a single block I identified eleven patterns (designated here as p01 - p11) which are repeated in various ways within it (Figure 12). 

☆ Please notice that: ☆

1) the "designations" I used here are only mine and are introduced just for convenient reference.

2) the repeated patterns p01-p11 are numbered in the order of their appearance within a frame (the first pattern is the one following the preamble)

3) the choice of which frame in the superframe should be designated as the first one is arbitrary (superframe boundaries may be seen as a fixed-width 64-frame sliding window)

4) I chose the carrier reference phase such that the probe/sync preamble is

[10001010001000100000001010100010101010100000100000101000]

another arbitrary carrier phase reference could be chosen and then the resulting patterns will differ: therefore the values of the patterns in Figure 11 are not to be understood here as "absolute"

Fig. 12 -  repeated patterns

The repeated patterns are indicated in Table I: note that the pattern p01 is composed of 28 symbols of the same phase and therefore generates a single tone as well as the pattern p06 does, being in counter-phase with respect to p01 (180° far).

Table I

 The superframe is then described as in Table II.

Table II

Patterns p02 and p05 seem to play a particular role: in the first 44 frames looks like they are used as "separators" between three frames of same value (redundancy?) while they are used exclusively - and grouped - in the remaining 20 frames. Most likely the long duration of the idle phase provides a strong channel probing and frame/time synchronization for the receive modems. It's worth noting that the duration of the data phase is a multiple of the duration of the idle superframe, e.g. 7 times in the sample shown in Figure 13. 

Fig. 13

A "hybrid" superframe is sometimes transmitted alone or immediately before/after data superframes and consists of a mix of 16 QPSK data inserts and repeating patterns - that's why I called it "hybrid" (Figure 14).

Fig. 14 - hybrid superframe

 Frames 16 and 17 are joined in case two hybrid superframes are transmitted consecutively (Figure 15)

Fig. 15 - two hybrid superframes transmitted consecutively

The demodulated bitstream of a hybrid superframe shows the expected framing: that is, the usual preamble of 28 symbols followed by four blocks, each of 28 symbols (Figure 16).

Fig. 16 - demodulated bitstream of the hybrid superframe

The 28-symbol reshaped bitstream (after removing the preamble sequence) clearly shows the 16 QPSK data inserts separated by the two patterns hp01 and hp02

[11000000001010101011000000001010101011000000001010101011]
[01101010100000000001101010100000000001101010100000000001]

Fig. 17 - 28-symbol reshaped demodulated bitstream of the hybrid superframe

While idle superframes are most likely used for channel probing and frame/time synchronization, the purpose of hybrid superframes is unclear as they also carry coded information.

As said above, the choice of a different carrier phase reference will obviously produce different values of the patterns. So, since that:
- the preamble sequence is PSK2 modulated (Figs 4,5)
- the phase offsets between preamble and patterns symbols shall be preserved
according to the choice of the carrier phase reference and relative mappings we'll get four different preamble sequences and thus four different "sets" of the eleven patterns p01-p11... but the same "formal" scheme as Table II will always be obtained. The same goes for hp01-hp02 patterns of the hybrid superframe.

Table III

The frames structure that is used for the idle and data/traffic waveforms is shown in Figure 18, a possible functional block diagram of the modem is illustrated in Figure 19. When switch S is in positions 2-1 the data phase is selected, positions 2-3 are used for the idle phase, positions 2-4 are used for the hybrid superframes. The presence of the interleaver & Gray decoder block is a my guess.

Fig. 18 - Frame structure for "Slot Machine" idle and traffic/data waveforms

Fig. 19 - "Slot Machine" (possible) functional block diagram

 

Direction Finding tries (TDoA algorithm) pinpoint the Ichihara transmitting station as the source of the signal [2]. 

Fig. 20 - direction finding results

The Ichihara transmitting station occupies an extensive area next to a golf course in Ichihara City. It has a microwave tower with four dishes, a large HF inverted conical array, strung between six tall masts, a mast with HF and VHF vertically polarised inverted conical monopoles, two HF rhombic antennas, two large horizontal HF/VHF log-periodic antennas, and a large horizontal curtain antenna [3].

Fig. 21 - Ichihara transmitting station (by google earth image)

Fig. 22 - Ichihara transmitting station antennas (by google street view)

A question still remains unanswered: why did JMSDF engineers design such a complex, though easily recognizable, idle waveform?

https://disk.yandex.com/d/suGK1GjRDEuX6Q
https://disk.yandex.com/d/qd4Cjj-YptLepg (Ichihara, file KML)

[1] http://jf0fumkiwi.ddns.net:8073/
[2] https://www.mod.go.jp/en/presiding/law/sdf.html
[3] https://www.jstor.org/stable/j.ctt13wwvvt.12

Akula always reserves surprises...

A few days ago a friend of mine sent me some recordings of a serie of FSK bursts which had the same keying speed and shift (500Bd/1000Hz) as the "Akula" waveform but which differed due to the lack of the sync and preamble sequences as well as the IVs, as shown in Figure 1.

Fig. 1

The demodulation of these bursts, however, reserved a surprise: although the sync and preamble groups were missing, the EOM + EOT groups (101111 100010 100010 101111 011110) were exactly the same as Akula (see Figure 2).

Fig. 2 - some of the demodulated bitstreams

There and then I gave up and thought of a common EOM + EOT sequences perhaps also used in other CIS waveforms, until this morning I accidentally came across an Akula traffic on 8284.0 KHz (cf)... and I found a burst with the same characteristics, i.e. without the usual sync-preamble-IVs groups, among other "complete" bursts (1): say a kind of  Akula "data-only" burst (Figure 3). I had ever seen it before. 

Fig. 3 - a so-called Akula "data-only" burst

 

Could it be the same "physical" (possibly faulty) modem? Difficult to say. My friend's recordings date back to April 30th (three days ago) and made using a remote KiwiSDR in Azumino-city, Nagano Japan and therefore probably a vessel on-going in the Pacific Ocean; my recordings were made using an AirSpy server located in Tofta, Goland Is. Sweden and with an excellent SNR value: a clue of a vessel on-going in nearby waters. And yes, one could object that the propagation takes strange paths, and that's ok, but assuming the same area of origin of the signal (and thus the same vessel/modem), my listening would be quite unlikely given the time and the used frequency (Figure 4).

Fig. 4 - VOACAP chart

 

Among other things, the durations of the Akula transmissions recorded in Japan are unusual compared to those we are used to seeing, i.e. just short transmissions consisting of a few bursts likely to avoid triangulation by the "foe".

The question remains: faulty modems? a mode of Akula messaging that I don't know or have never met? or just mere coincidences or wrong receiver settings (ie AGC)?
Further successful registrations will (hopefully) help...

https://disk.yandex.com/d/ff_qZIkTWOwJyw

 

(1) As said, the other bursts of my recorded transmission have the Akula well-known format (1), ie:
- sync group (6 code words: 4x100101 + 2x110001) followed by 6-bit "0"s separator
- preamble group (7 code words arranged as: 4x1st code word + 3x2nd code word)
- data
- End-Of-Message group + EOT group (five code words: 101111 100010 100010 101111 011110)