Analysis and TDoA geolocation of an unusual binary FSK transmission recorded on 16.2 MHz, highlighting its modulation properties, bitstream framing, and identification as part of the UK DHFCS network in St. Eval, Cornwall (UK).
A rather unusual FSK transmission was heard on 16289.5 kHz CF (tuning 16288.0 kHz/USB + 1500 Hz offset), which later turned out to be transmitted by the UK Defence High Frequency Communications Service (DHFCS) in St. Eval (see below). Every now and then I tune to 16288 kHz, but — so far — I have not had the opportunity to catch it again. The transmission (shown in Figure 1) employs an 800Bd/800 Hz FSK modulation. The spectral display clearly shows the two characteristic tone rails, with a measured shift (Δf) of approximately 800.88 Hz.
 |
| Figure 1: Spectrum analysis showing FSK modulation at 800 Bd with 800 Hz shift |
It is interesting to note that when the symbol rate (Br=800 Bd) equals the frequency shift (Δf=800 Hz), as in this case, the transmission operates in a critical condition yielding an exact modulation index of h=Δf/Br=1.0 (Figure 2). For non-coherent demodulation, this condition represents the non-coherent orthogonality threshold, eliminating inter-symbol interference (ISI) without requiring phase recovery. In a coherent receiver setup, it operates at twice the minimum spacing required for orthogonal reception (h=0.5, typical of Minimum Shift Keying / MSK), providing a wider noise margin and lower Bit Error Rate (BER).
 |
| Figure 2: Critical FSK conditions (Br=Shift). Image credit: https://radioscanner.ru/ |
The autocorrelation function (ACF) yields a primary peak at approximately 1280 ms, which at a symbol rate of 800 bps(1) corresponds precisely to a 1024-bit frame length. This periodic structure is clearly confirmed by the bitmap alignment shown in Figure 3.
 |
| Figure 3: Autocorrelation (ACF) analysis and bitmap display |
It is worth noting that a similar FSK transmission was heard in November 2025 on several frequencies, running in 800Bd/850 mode — thus with an 850 Hz shift matching the classic 50-75Bd fleet broadcast [1]. Notably, besides sharing the same ACF (1280 ms), period (1024 bits), and frame architecture, both FSK signals originate from the same site.
The structure of the 1024-bit frames is clearly visible in the bitstream resulting from demodulation and subsequent synchronization to a common 10-bit sequence (Figure 4). Structurally, this framing resembles the 1536-bit period previously observed in UK DHFCS transmissions [2] and, as mentioned above, is very similar to that used in the 800Bd/850 FSK transmission.
The layout in Figure 4 highlights six distinct recurring blocks (numbered 1 to 6) plus a final seventh block within the 1024-bit frame structure. As detailed in the lower insets, each of the seven blocks is further subdivided into specific sub-fields. For readability and descriptive purposes, I have arbitrarily labeled the static delimiter fields consisting of all-one bits as 'F' (Framing) and the variable payload sections as 'D' (Data) — for instance, F1–D1, F2–D2, F3–D3, and so on. Note that these designations are purely my working labels.
 |
| Figure 4: The 1024-bit frame structure aligned to the chosen sequence |
Table 1 summarizes the bit-length distribution across the six primary blocks. As shown, each block consists of alternating framing fields (F1, F2, F3, composed of all-one sequences) and data fields (D1, D2, D3). TABLE I highlights a clear, repeating structural pattern:
[F1] → [D1] → [F2] → [D2] → [F3] → [D3]
* Framing bit lengths: While most delimiter fields are fixed at 5 bits, a single 6-bit delimiter shifts diagonally across the frame structure following a cyclical pattern (F3 in blocks 1 & 4, F2 in blocks 2 & 5, and F1 in blocks 3 & 6, as indicated by the shaded cells).
* Data bit lengths: The first two data sub-fields (D1 and D2) consistently contain 16 bits per block, whereas D3 carries 37 bits in blocks 1, 2, 4, and 5, expanding to 38 bits in blocks 3 and 6 (just when the 6-bit delimiter is in F1 fields) to compensate for the framing arrangement.
In total, these six blocks account for 512 bits (half of the full 1024-bit frame structure), evenly divided into 96 bits of framing overhead (static '1s') and 416 bits of variable data payload.
 |
| Table I: Bit allocation and field breakdown across Blocks 1–6. Shaded cells denote the 6-bit delimiter fields |
As detailed in Table II, and according to the chosen synchronization, Block 7 acts as a tail or termination sub-frame. Unlike the standard 6-field blocks, Block 7 consists of only four sub-fields—F4 (5 bits), D4 (16 bits), F5 (5 bits), and D5 (11 bits) — resulting in a reduced length of 37 bits. Here, the fixed 5-bit delimiters (F4, F5) frame a standard 16-bit data register (D4), while the shortened 11-bit data field (D5) likely serves to pad the frame to its exact required total length of 512 bits.
 |
| Table II: Structure of the terminal sub-frame (Block 7), showing a reduced 37-bit total allocation across four fields |
Once demodulated, the STANAG-4285 transmission reveals a 1536-bit period, structurally identical to the 1024-bit bitstream identified in the FSK transmissions — differing by exactly 512 bits.The layout in Figure 5 illustrates the 1536-bit frame structure. As with the FSK signal, the bitstream resulting from demodulation was synchronized to a common sequence (specifically, a common 16-bit sequence at the start of the frame).
The structural identity between the 800 Bd / 850 Hz FSK signal and the 1200 bps STANAG-4285 signal demonstrates that the framing scheme operates at a higher Data Link / TDM layer, independently of the underlying Physical layer.
 |
| Figure 5: 1536-bit bitstream of the STANAG-4285 transmission, aligned to the chosen sequence |
Unlike the FSK transmission, the field lengths within the 1536-bit STANAG-4285 bitstream exhibit a remarkably strict byte-aligned regularity. As shown in Table III, all static delimiters (F1–F5) are fixed at exactly 8 bits (1 byte), while the data fields (D1–D3) in Blocks 1 through 6 are uniformly sized at 56 bits (7 bytes) each, resulting in perfectly symmetric 192-bit sub-frames. Similarly, the terminal Block 7 consists entirely of byte multiples — F4 (8 bits), D4 (24 bits / 3 bytes), F5 (8 bits), and D5 (16 bits / 2 bytes) — totaling 56 bits. This rigid, byte-oriented structure strongly suggests that the framing hardware operates on standard 8-bit word boundaries when processing higher-throughput PSK streams.
 |
| Table III: Field layout and bit-length distribution for Blocks 1–7 of the 1536-bit STANAG-4285 bitstream |
As shown in Figure 6, the left section of the STANAG-4285 1536-bit bitstream contains three parallel 7-bit counters, which yield 128 possible states (0-127) before resetting. Note that the highlighted field reads "1001100" — equivalent to 76 in decimal — whereas the bit editor displays "line 77". This apparent discrepancy arises because the initial state is "0000000" (0), which the editor counts as line 1 (meaning the values from 0 to 76 encompass 77 discrete lines). While the exact function of the three parallel 7-bit counters (cnt1–cnt3) cannot be definitively confirmed, their synchronized 128-state cycle suggests they may be used for frame numbering, sequence tracking, or TDM sub-channel control. These interpretations remain unverified hypotheses based solely on bitstream pattern analysis.
 |
| Figure 6: Detail of the left section of the STANAG-4285 bitstream showing three parallel 7-bit counters |
These initial segments could serve as a frame header or control region, potentially containing protocol signaling flags, operational mode indicators, or a Frame Check Sequence / CRC (Cyclic Redundancy Check) to ensure header integrity, alongside a short stabilization pattern for receiver synchronization. It must be emphasized, however, that all the above functional interpretations remain strictly my own speculative hypotheses, derived solely from visual bitstream observation.
 |
| Figure 7: Visual comparison of the initial bitstream regions following the used sync sequence in FSK (top) and STANAG-4285 (bottom) |
For the sake of completeness, a statistical test on the use of encryption within the data fields was performed (Figure 8), although — in truth — it was not strictly necessary.
 |
| Figure 8: Statistical randomness and encryption test on the data fields |
Attempts to locate the geographic emission site point decisively to the St. Eval site in Cornwall (Figure 9)(2). Direction finding was performed using three independent TDoA (Time Difference of Arrival) runs using different KiwiSDR receiver clusters to validate spatial convergence.
 |
| Figure 9: Geolocation analysis combining KiwiSDR TDoA results with DHFCS infrastructure maps |
Upper sign (white):
MOD St Eval
Lower sign (red/white):
MOD PROPERTY KEEP OUT NO ACCESS OR TIPPING
Right circle (side fence):
Warning sign (red/yellow):
MOD Property Keep Out Multi hazard area Danger of death
 |
Figure 10: Aerial view of the former RAF St Eval airfield, currently housing the DHFCS transmitter site (Image credit: Google Earth) |
 |
| Figure 11: Ground-level view of the St. Eval site entrance. Highlighted are the UK Ministry of Defence (MOD) warning signs (Image credit: Google Earth) |
3. GA-205 is a 12-channel Time Division Multiplexer (TDM) that provides full-duplex and half-duplex transmission and reception of data at selectable user port rates up to 9600 bps. The system accommodates user data that do not share common timing sources and provides for isochronous, bit stuff, synchronous and asynchronous operation.
[2] http://i56578- swl.blogspot.com/search/label/1536-bit%20TDM
[3] http://i56578- swl.blogspot.com/2019/07/110a-2400bps-modem-carrying-1536-bit.html
No comments:
Post a Comment