unid datalink protocol(s) over a PSK8 ST and STANAG-4539 (2)

I had the opportunity to record other transmissions on 3712.70 KHz/USB and - also following the comment of my friend KarapuZ - I can state with reasonable certainty that the waveforms analyzed in the previous post [1] come from Thales equipment. 
As mentioned, both Thales and L3Harris use the GMSK-MFSK8 waveform to handle HF links but the L3Harris bitmap/bitstream have a very recognizable pattern that is not present in the bursts recorded today (Figs 1,2): therefore, the GMSK-MFSK-8 signal is the Thales Systeme-3000 "Skymaster ALE", used in TRC-3500 and TRC-3600/TRC-3700 series radios (HF 3000 family).

Fig. 1 - Thales Systeme-3000 GMFKS+MFSK8

Fig. 2 - Thales Systeme-3000 GMFKS: bitstream after differential decoding and 50ms bitmap

As you see in Figure 2, I used the OQPSK "view" to demodulate the preamble of the Skyaster ALE signal: however, the differential decoding clearly show a 2-state keying (precisely GMFSK) that can be demodulated also using the "classic" FSK approach (Figure 3).

Fig. 3 - use of the SA MFSK dem

For what concerns the two PSK8 Serial Tone waveforms A & B [1], they also could be proprietary ones (Thales); indeed, quoting TRC-3600 datasheet: "Thanks to its digital advanced technology, the TRC 3600 offers new embedded services: secure high data rate and digital voice transmissions. It integrates a high data rate, multiwaveform, single tone modem (from 75 to 5400 bps) and a vocoder (800 - 2400 bps) associated to a high security digital COMSEC chip". 

The data link protocol could be the digital voice vocoder (new MELP/LPC10), given the similarity of the bitstream with its L3Harris analogue, but that is just an unconfirmed hypothesis of mine.

Fig. 4 - bitmaps of the two PSK8 ST waveforms

 

 https://disk.yandex.com/d/6NK6xYRAWzjzEw

 [1] http://i56578-swl.blogspot.com/2024/04/unid-datalink-protocols-over-psk8-st.html

THALES Skymaster, "skyhopper" mode

This is a fairly comprehensive list of the ALE waveforms provided by Thales' Systeme 3000 Series Skymaster and Skyhopper Modes, a set of procedures and adaptive waveforms that allow to offer reliable and real-time optimized links even in degraded ionospheric conditions of the HF channel. All the signals, kindly sent me by my friend ANgazu, belong to the same session, even if the recording is edited in the time axis. These Thales proprietary waveforms are used in TRC-3500/TRC-3600 and TRC-3700 series transceivers.

The first two parts are the Skyhopper mode, an intelligent frequency hopping and automatic hop band selection; the signals consist of a series of 40 ms MFSK-8 125 Bd bursts (figure 1) and 50 ms GMSK / OQPSK 200 Bd bursts (figure 2). It's interesting to notice that the MFSK-8 burst actually use 5-out-of-8 tones of the Skymaster ALE waveform (see the comparison in Figure 1 below).

 

Fig. 1 - MFSK-8 125Bd/250 (actually 5-out-of-8 tones)

The following 50 ms bursts, below in figure 2, are of difficult analysis given their duration and the used modulation, friends of  radioscanner suggest OQPSK modulation.

Fig. 2

The third part is the "classic" GMSK/OQPSK 2000 Bd & MFSK-8 125 Bd/250 part, see figure 3.

 

Fig. 3

The initial GMSK/OQPSK part has a 50 ms ACF that corresponds to a 100-bit frame: the waveform is similar to Harris RF-5800 selective call (figure 4).

 

Fig. 4 - framing' comparison of Thales (up) and Harris (down)  ALE

 

https://disk.yandex.com/d/owrO7l3R0MKEFQ

SCS/ALE: a 2G ALE Modem/Controller for DR-7400 and DR-7800 P4 modems

 

SCS/ALE controller (2G MIL 188-141 ALE) supports two modes: ALE/PACTOR, see the video below, and full stand alone ALE. In ALE/PACTOR existing PACTOR software needs to know nothing about ALE. The PACTOR Connect request is turned into an ALE Linking Call, which if should fail, results in the modem telling the PACTOR software that the PACTOR Connect failed. If the ALE Link is achieved then the PACTOR Connect process proceeds. After the PACTOR is complete, the ALE Link is cleared and ALE Scanning resumes. Thus no modification of existing PACTOR software is required for an ALE front end operation. The Bluetooth option must be installed to have full ALE operational awareness when in ALE/PACTOR mode.

 

In stand alone ALE one can use PACTOR or AMD messaging or any external modem where the DR-7800 series modems provide an external modem sense PTT line to reset the ALE Link timeout. The MS110A hardware or MS-DMT software modems can be used. To use PACTOR the Bluetooth option is required.
In addition many additional HF transceiver used in MARS and SHARES have been added from reuse of source code from the MARS-ALE Radio Control Library where simple split VFO is being applied where needed for ALE Quiet Scanning and dropping out of split for TX. The use of PA relay bypass commands where applicable. No other external ALE controller on the market takes these steps.

Thanks to my friend Steve Hajducek from "MIL-STD tools for MARS Multimedia Library" group:
https://www.facebook.com/groups/MARS.MIL.STD.TOOLS.LIB

TADIRAN AutoCall MFSK-4

signal heard on 5892.0 KHz/USB, 0758 UTC, most likely from Austrian Military. AutoCall is a proprietary ALE waveform by Israeli Tadiran/Elbit communication system. AutoCall delivers faster and more reliable link establishment and is recommended when greater tactical efficiency is critical; AutoCall is used eg in TADIRAN HF-6000 radio system. HF-6000 system is also sold by Telefunken Racoms.

model VRC-6020 (20 W)

Some characteristic elements of the signal can be observed from the sonogram:

• the 1000-Hz tuning/sync beep which preceeds all transmissions;
• the proprietary MFSK-4 Autocall system's tones centered at 2850 Hz, serving a variety of linking and communication functions;
• the four tones located at 2400, 2700, 3000 and 3300 Hz

Manipulation speed is 125 symbols/sec and the step between two tones is 300Hz. 

https://yadi.sk/d/hxuJsK-ewh7va

examples of 2G-ALE followed by forward of data

MS188-141A + MS188-110A serial

MS188-141A + MS188-110A App.B

CODAN

MS188-141A + R&S GM2100

MS188-141A + voice comm

R&S ALIS + R&S GM2100

THALES Skymaster ALE + THALES TRC 177x serial modem

MS188-141A + STANAG-4285

Rohde & Schwarz ALIS (RS-ARQ selcall)

This is the Rohde & Schwarz proprietary standard "ALIS" (Automatic Link Setup) selective call, an adaptive ALE procedure based on FSK modem and ALIS processor. 
Quoting Hoka: "Rohde & Schwarz simplex ARQ, so far found in use by German, Italian, Nairobi and Turkish Diplo services, typically 228.7bd but reports of 457.0 have been noted. There appears to be no "real" name for the data system. Some people call RS-ARQ as ALIS but strictly speaking, ALIS is only the automatic link processor and frequency management system. It is not responsible for generating the traffic. ALIS is therefore somewhat of a misnomer. The modems generating the traffic are the GM857 and GM2000. Our suggestion is to stick with RS-ARQ as the system name."

The signal has been heard today afternoon at 1620z on 12270.5 KHz on USB. The waveform is an FSK 228.6Bd/170 (normal FSK modulation, ALIS basic feature), ACF value (in the analyzed sample) of 342.6 msec or 78 bit. By using the SA "scan raster" method is visible the feature called "diagonal bit" that can be used to recognize the signal.

Fig. 1

The following basic parameters are permanently stored in the communication processor unit:

- address list with geographical coordinates and distances of corresponding stations;
- frequency pool (total number of frequencies up to 100, with a maximum of
16 frequencies for each pool and a maximum of 25 different pools);
- date and time;
- sunspot number.

The calling (master) station establishes the connection. It transmits a defined number of frames on each frequency of the desired pool to enable a weighted bit addition at the receiving station. The frames are repeated because the slave station must have enough time to scan through all the programmed frequencies and receive at least three frames on each single frequency for synchronization.
After the correct reception of (at least) three frames from the master station, the slave station transmits a synchronization acknowledgement and additional information about the reception quality along with the monitored status of the sending station to ensure that the two stations are working in the same operation mode. 

The selcall phase maybe followed by the data transfer phase which is performed using several waveforms, as indicated in in the field "followon"  ("status") of some decoded selcalls (Fig. 3). Note also the different "pool size" which is related to the number of the allowed frequencies for the current pool.

Fig.3

Harris RF-5800 'Selective Call', MSK 2000Bd/1000

('Systeme3000-ALE' equivocation)

 

(AngazU,I56578)

We recently had the opportunity to get and study the Harris Selective Call waveform (we name it as Harris-ALE but it's not its official name!): it's an MSK modulation at 2000 Baud speed, followed by short MFSK-8 125 Baud in non-standard MS-188-141A (ALE), acf is 50 ms (100 bit). We focused on the initial 3 seconds segment in order to define modulation mode and other features in order to help to clarify the above misunderstanding (see later).

At first glance it looks like a serial-tone signal: carrier frequency 1600 Hz and OQPSK modulation at 2000 Bd speed (pic. 1). As reported in this article by Sergey Makarov (SergUA6) http://signals.radioscanner.ru/info/item281/ "it is not easy to tell apart between QPSK and MSK since they are tightly connected".

Pic. 1- Harris Selective Call and its phase-plane

By measuring the main parameters of the signal we had (pic.2):

baudrate (Br) = 2000 Bd

bandwidth (Bw) ~ 3000 Hz

shift (Sh) = 1000 Hz

Pic. 2

That said, and according to what reported here http://signals.radioscanner.ru/info/item68/ we are pretty sure that the Harris Selective Call is not an OQPSK but rather an MSK 2000/1000 waveform, 2000Baud speed and 1000Hz shifted. As it is clearly visible in pic.2, are verified those relationships that are specific to MKS signals, i.e.: Bw = 1.5 Br and Sh = Br/2 as shown in the cited article (pic.3):

Pic. 3 - MSK relationships (from radioscanner.ru)

  
Moreover, into the Harris signal, there is another clue that points to MSK. As you can see in the picture 4, there is a long state staying in one frequency, if should it be PSK, the frequency should come back to carrier and stay there till a new phase change. 

 

Pic. 4

 The shape of the eye diagram (pic. 5) also points in this direction (MSK with BT = 0.3):

Pic. 5

The Harris signal has an ACF value of 50 mSec (100 bit) and it is characterized by the presence of what looks like a signature, something like a 'business card':

  

As said, this is a safe-origin signal since it was recordered some years ago during Harris RF-5800 acceptance tests: at that time it was supposed to be standard in Falcon-II series radios. Harris equipment is wide spread in NATO countries, but this mode, although available, seems to be not much used.

With these points in mind, we asked ourselves the question that we indicated at the beginning: the so-called Thales “Systeme3000-ALE” (reported also in a post on this blog) has a waveform that is very similar to the Harris-ALE' one, also aurally they just sound in the same way. Browsing the web, there are logs by listeners reporting both the signals: altought the Thales waveform be almost 99.99% OQPSK, may be the case that these two signals could be confused each other ?

Thales Systeme-3000 Skymaster ALE

The signal reported here was heard on 2 May at 10.254.0 KHz on USB, around 0730z, and it is  Thales proprietary ALE protocol called Skymaster

The initial part of the signal SDPSK (Symmerical Differential PSK) modulation at 2000 Baud speed and carrier frequency ~1600 Hz; as you see, transitions do not traverse the origin and the information is stored in the transitions and not in the (four) states.

The initial part is followed by short MFSK-8  125 Baud segment that is not compatible with MS 188-141 2G-ALE although the scope be the same.

The initial SDPSK part exhibits a 50ms ACF that corresponds to a 100-bit frame.

This proprietary waveform is used in their TRC-3500/TRC-3600 and TRC-3700 series radios.

 

Arcotel MAHRS ALE burst

The Multiple Adaptive HF Radio System (MAHRS) is based on the Arcotel transmission processor that controls the automatic frequency selection, the link establishment and the following waveform for the ARQ-based exchange of data. The modem used is the Echotel 1810  manufactured by EADS RACOM.

Fast bursts sent every 500 msec, spreading about a 2800 Hz bandwidth. Each burst shows a short preamble of 8 un-modulated carriers, symmetrical with respect to the center frequency of the signal, and a short PSK-2 preamble. The data segment is a serial tone carrier at ~ 1800 Hz with a PSK-8 manipulation at 2400 baud.
The MAHRS "procedure" was described in WUN-10 newsletter, and here reported:

"For establishing the link between two stations there is a call of one dot each second at a length of 500ms. Most of the time the station calls 62 times then changes back to listening for 60 seconds and then selects a new frequency for calling. The selection of freqs happens according to position of both sender and receiver, actual daytime and actual sunspot numbers. The system calculates a prediction model of propagation and decides which line may be the best. When in contact the called station answers after waiting a maximum of 15 seconds by one dot of 500ms and the both stations give their "handshakes" and then the full transmission starts using a high speed ARQ like transmission system at a speed of 4800 bps" [http://www.udxf.nl/WUN-v10.pdf]

CODAN CALM

While CODAN-9001 transports data, CODAN CALM (CODAN Automated Link Management) provides the ALE part between the peers. CODAN Chirp uses PSK-2 modulation across 32 channels with 80Hz of spacing and speed of 80 Baud,  and uses ~2600 Hz of bandwidth.
http://hf-ssb-transceiver.at-communication.com/en/codan/hf_ssb_transceiver_ngt.html 

 

   

Below a Codan CALM session followed by data sent in Codan 9001 (Egyptian Diplo)

MIL 188-141 2G-ALE

MIL-188-141A Standard, also known as Automatic Link Establishment (ALE), specified by the US Department of Defense in September 1988 and with two Change Notices in June 1992 and September 1993, is a procedure whereby radio stations are able to automatically set up their link thus eliminating the need for skilled operators - in fact the growing lack of trained and experienced staff was a driving force behind the idea of ALE.

In March 1999 MIL-188-141A was integrated into the new specification MIL-188-141B, Appendix A. The message protocol was thereby extended slightly.

A station will transmit a link quality burst which may or may not contain the address of another station on a series of pre-assigned frequencies. The listening station(s) will continuously scan through these frequencies. During scanning the receiving station will perform a link quality analysis and measure signal to noise ratio and bit error ratio. These measurements are used to set up a table in memory of link quality assessments for each station and frequency.

Based on the values of the table, the best frequency available is selected when the station wishes to transmit. When the ALE controller of a receiving station hears its own address (or the address of the group to which it belongs) it will stop the scanning and respond to the call. The stations will then either switch to a low speed data exchange mode or to a high speed data (FSK or PSK) modem or to voice mode.

The MIL-188-141A signal is an 8-tone MFSK signal in the range 750 - 2500 Hz spaced 250 Hz apart. Each tone (symbol) is 8 ms long corresponding to 125 Baud and represents three bits giving a bit rate of 375 bps.

The MIL-188-141A bit-stream is structured in 24-bit frame, which includes three bits preamble for the frame type and three 7-bit ASCII characters or just 21 bits unformatted binary data.

To increase robustness the 24-bit frame is Golay (24, 12) encoded, and then interleaved giving a total frame length of 48 bits + 1 stuff bit. Each 49-bit code word is transmitted three times one after another to combat burst interference.

In both specifications, especially according to MIL-188-141B Appendix B, the 21-bit ALE frame data can be encrypted before transmission. This feature is named Link Protection. The data may be encrypted according to different classified application levels: AL-1 to AL-4. Unencrypted data is transmitted with AL-0.

Only unencrypted data can be displayed correctly with the mode decoder. For protected application data – according to MIL-188-141B Appendix B (Link Protection) – the display may be meaningless, because a user specific key is necessary for data decryption.

MIL-STD-188-141 Alternate Quick Call ALE

Alternate Quick Call ALE (AQC-ALE) is derived from the MIL-STD-188-141B, Appendix A standard. 

When poor channel conditions exist, such as high noise levels, static crashes and weak signals that causes problems during a LINKing attempt where NORMAL-ALE fails to link the use of AQC-ALE can also be made to overcome such channel conditions.

AQC-ALE provides a link establishment technique that requires significantly less time to link than the baseline ALE system and is significantly better at establishing and maintaining a link on under poor channel conditions.
This is accomplished by some additional technology and trading-off some of the lesser used functions of the baseline ALE system for a faster linking process. The primary focus of AQC-ALE is to establish a link between two or more stations as rapidly as possible. Once linked, information can be exchanged in the most efficient manner as is common between stations. 

AQC-ALE is basically a tactical tool, in that although it supports Scanning/Sounding and most things that baseline (a.k.a. NORMAL ALE) supports, AQC-ALE is usually used in small tactical network operations rather than fixed point 24/7 ALE Network operations.

AQC-ALE allows for a maximum of a 6 character (2 ALE word) address for both the OWN, OTHER and NET address. In addition, AQC-ALE does NOT support AMD, DTM or DBM during link set up, or an AMD at link clear or an MOTD or initiating an QC-ALE link by use of a MIL-STD-188-110 modem associated link request.

AQC-ALE has a very fast calling handshake and all parties must be using FAST AGC and the Scanning/Sounding station MUST be operating at a 5 ch/sec scan rate for best results. A 2 ch/sec scan rate will work depending on the number of channels in the Scan Group and timing considerations as to when the calling station starts transmitting and when the Scanning station comes to that channel next, a 1 ch/sec. scan rate will not work reliably. An AQC-ALE call will reliably capture a station Scanning that is using a 6 channel or less Scan Group at a 2 ch/sec. scan rate and has “Listen Calls” checked and “Listen Time” set to 400.

Quick AMD Dictionary
AQC-ALE offers additional tactical features not found in baseline ALE, such as Quick AMD Dictionary operation. QAMD works from three dictionaries in a code book fashion where no actual text of the message is being sent out over the air. It is a table lookup value in the code book which are the dictionaries. There is no data encryption going on here. Using a combination of a fixed dictionary for most commonly needed words and mission specific expressions in the additional two dictionaries, which can be changed to fit the scenario of the Exercise or non-Exercise.

AMD Dictionary is a quick mouse double click system of selecting words and phrases to create an AMD when using AQC-ALE. The operator can not enter any words on the fly, the word or phrase must pre-exist in the dictionaries. If all the users are not using the same dictionaries then the receiving station will not print the proper message.

AQC-ALE MEET ME
AQC-ALE provides the “Meet Me” dialog for rapid frequency changes that can steer an entire net on the fly, the “Meet Me” Orderwire command capability.
The “Meet Me” capability requires that all stations in the link be under computer control and all are using the exact same GROUP/Channels configuration, then the NCS or any station can steer the group (or individual station) to a new channel instantly without the need for a voice announcement or even an AMD message.
The process simply requires entering the RX and TX frequency in Hz (channel based pull down from current GROUP is planned) and checking LSB if required and clicking OK, then an Ordewire message is sent and all the stations will QSY to the new frequency/mode pair if entered correctly and if existing in the current GROUP of all linked stations. Optionally stations may be added or deleted from the linked stations and an acknowledgement (Ack This) may be requested.