Showing posts with label Japanese Waveforms. Show all posts
Showing posts with label Japanese Waveforms. Show all posts

17 May 2024

Japanese Navy fleet broadcast, a review of the "Japanese Slot Machine" (I)

Japanese Maritime Self-Defence Forces (JMSDF) HF Fleet Broadcast, also known as the "Japanese Slot Machine", heard with data payloads on 8312.50 KHz/USB using a remote KiwiSDR located in Azumino-city, Nagano Japan [1]. This signal has the Enigma designation "xsl" but I honestly don't understand why it was placed among the "mysterious signals" or even among the number stations: probably due to its characteristic idling refrain because it is nothing more than a fleet broadcast as well as the continuous and uninterrupted STANAG-4285 transmissions. 

The waveform is composed of the idle phase and the traffic/data phase. 


The data waveform occupies a 2 KHz bandwidth and use a 1500 Hz sub-carrier which is QPSK modulated at the symbol rate of 1500 Baud (Figure 1). 

Fig. 1 - QPSK parameters of the data waveform

The signal has strong ACF spikes every 93.33 ms (Figure 2) that, at the speed of 1500 Bd, correspond to a frame of 140 dibit symbols in length (frame rate of 10.71 Hz).

Fig. 2 - autocorrelation spikes and relative bitmap (data waveform)

The demodulated bitstream in Figure 3 shows a framing consisting of a probe/sync aimed "preamble" sequence (ps) of 28 known symbols (56 bits) in length followed by 112 unknown symbols representing the transferred data

[10001010001000100000001010100010101010100000100000101000]

Fig. 3 - 140 QPSK symbols (28 + 112) frame structure

Looking at the representation of the QPSK symbols of a frame (Figure 4) you can see that the 28 symbols of the preamble sequence are PSK2 modulated and then mapped to dibit symbols.

Fig. 4 - graphic rapresentation of a 140-symbol frame

The confirmation comes from the examination of the second degree harmonics in Figure 5 where the PSK2 modulation of the subcarrier can be clearly distinguished for a duration of 18.66 ms corresponding to 28 symbols at the keying speed of 1500 Baud. Also note the accentuated PSK transitions in the phase diagram.

Fig. 5 - PSK2 modulations

Data symbols have a flat autocorrelation indicating a (convolutional?) coding other than interleaving and encryption: bit distribution and Shannon entrophy graphs are good clues.

Fig. 6 - bit distribution and Shannon entropy of the data symbols

The idle waveform too is QPSK modulated at a symbol rate of 1500 baud but has a complex framing which to some extent follows the traffic waveform. As in the traffic waveform, the framing consists of repetions of 140 symbols/93.33 ms frames which generate the distinctive audio refrain (Figure 7).

Fig. 7 - idle phase signal

The underlying clicks audible during the idle phase have a frequency of 11.5 Hz and corresponds to the 140-symbol frames (Figure 8).

Fig. 8 - 11.5 Hz ticks

The autocorrelation of the idle signal (Figure 9) shows strong 5973 ms spikes grouping the lower 93.33 ms spikes; since the 1500 Bd keying speed, from a simple calculation the 5973 ms ACF results as a group of 64 frames each of 140 symbols: the 64 frames sequence is here designated as "superframe" and it exactly lasts as the refrain.  

Fig. 9 - autocorrelation spikes and relative bitmap (idle waveform)

The superframe structure is visible in the demodulated bitstream once reshaped to 140 symbols (280 bits) in order to highlight the 64 component frames: it's worth noting the presence of the same 28 symbols preamble sequence seen in the demodulated data bitstream (Figs 10, 3). Since the preambles are repeated in all frames, they are the cause of the underlying clickings mentioned above.

Fig. 10 - idle waveform, superframe structure

After the removal of the preamble sequence, it's easy to see that the remaining 112 symbols of the superframes are formed of four 28-symbols blocks, each block consisting of the same patterns (Figure 11).

Fig. 11

After having isolated a single block I identified eleven patterns (designated here as p01 - p11) which are repeated in various ways within it (Figure 12). 

☆ Please notice that: ☆

1) the "designations" I used here are only mine and are introduced just for convenient reference.

2) the repeated patterns p01-p11 are numbered in the order of their appearance within a frame (the first pattern is the one following the preamble)

3) the choice of which frame in the superframe should be designated as the first one is arbitrary (superframe boundaries may be seen as a fixed-width 64-frame sliding window)

4) I chose the carrier reference phase such that the probe/sync preamble is

[10001010001000100000001010100010101010100000100000101000]

another arbitrary carrier phase reference could be chosen and then the resulting patterns will differ: therefore the values of the patterns in Figure 11 are not to be understood here as "absolute"

Fig. 12 -  repeated patterns

The repeated patterns are indicated in Table I: note that the pattern p01 is composed of 28 symbols of the same phase and therefore generates a single tone as well as the pattern p06 does, being in counter-phase with respect to p01 (180° far).

Table I

 The superframe is then described as in Table II.

Table II

Patterns p02 and p05 seem to play a particular role: in the first 44 frames looks like they are used as "separators" between three frames of same value (redundancy?) while they are used exclusively - and grouped - in the remaining 20 frames. Most likely the long duration of the idle phase provides a strong channel probing and frame/time synchronization for the receive modems. It's worth noting that the duration of the data phase is a multiple of the duration of the idle superframe, e.g. 7 times in the sample shown in Figure 13. 

Fig. 13

A "hybrid" superframe is sometimes transmitted alone or immediately before/after data superframes and consists of a mix of 16 QPSK data inserts and repeating patterns - that's why I called it "hybrid" (Figure 14).

Fig. 14 - hybrid superframe

 Frames 16 and 17 are joined in case two hybrid superframes are transmitted consecutively (Figure 15)

Fig. 15 - two hybrid superframes transmitted consecutively

The demodulated bitstream of a hybrid superframe shows the expected framing: that is, the usual preamble of 28 symbols followed by four blocks, each of 28 symbols (Figure 16).

Fig. 16 - demodulated bitstream of the hybrid superframe

The 28-symbol reshaped bitstream (after removing the preamble sequence) clearly shows the 16 QPSK data inserts separated by the two patterns hp01 and hp02

[11000000001010101011000000001010101011000000001010101011]
[01101010100000000001101010100000000001101010100000000001]

Fig. 17 - 28-symbol reshaped demodulated bitstream of the hybrid superframe

While idle superframes are most likely used for channel probing and frame/time synchronization, the purpose of hybrid superframes is unclear as they also carry coded information.

As said above, the choice of a different carrier phase reference will obviously produce different values of the patterns. So, since that:
- the preamble sequence is PSK2 modulated (Figs 4,5)
- the phase offsets between preamble and patterns symbols shall be preserved
according to the choice of the carrier phase reference and relative mappings we'll get four different preamble sequences and thus four different "sets" of the eleven patterns p01-p11... but the same "formal" scheme as Table II will always be obtained. The same goes for hp01-hp02 patterns of the hybrid superframe.

Table III

The frames structure that is used for the idle and data/traffic waveforms is shown in Figure 18, a possible functional block diagram of the modem is illustrated in Figure 19. When switch S is in positions 2-1 the data phase is selected, positions 2-3 are used for the idle phase, positions 2-4 are used for the hybrid superframes. The presence of the interleaver & Gray decoder block is a my guess.

Fig. 18 - Frame structure for "Slot Machine" idle and traffic/data waveforms


Fig. 19 - "Slot Machine" (possible) functional block diagram

 

Direction Finding tries (TDoA algorithm) pinpoint the Ichihara transmitting station as the source of the signal [2]. 

Fig. 20 - direction finding results

The Ichihara transmitting station occupies an extensive area next to a golf course in Ichihara City. It has a microwave tower with four dishes, a large HF inverted conical array, strung between six tall masts, a mast with HF and VHF vertically polarised inverted conical monopoles, two HF rhombic antennas, two large horizontal HF/VHF log-periodic antennas, and a large horizontal curtain antenna [3].

Fig. 21 - Ichihara transmitting station (by google earth image)

Fig. 22 - Ichihara transmitting station antennas (by google street view)

A question still remains unanswered: why did JMSDF engineers design such a complex, though easily recognizable, idle waveform?

https://disk.yandex.com/d/suGK1GjRDEuX6Q
https://disk.yandex.com/d/qd4Cjj-YptLepg (Ichihara, file KML)


[1] http://jf0fumkiwi.ddns.net:8073/
[2] https://www.mod.go.jp/en/presiding/law/sdf.html
[3] https://www.jstor.org/stable/j.ctt13wwvvt.12

1 May 2019

OFDM-30 (+1 pilot, +2) DPSK 50Bd

updated

The signal was recorded at 8403.5 KHz (CF) thanks to the use of some KiwiSDRs [1], it occupies a bandwidth of 2500 Hz  and seemigly consists of 35 tones (Fig. 1a). The lower tone (in case of USB) most likely is the "pilot" one, used for Doppler correction, and its level is 7 dB higher than the normal level of any one of the the remaining 34 tones (Fig. 1b). The pilot seems followed by four tones: actually two PSK2 channels modulated at 25 and 50 Bd.
The remainig 30 tones are used for data transfer, they are ~71 Hz spaced and are formed using the OFDM technology. Curiously, the transition from idle/data phases does not happen simultaneously for all the channels, the delay is approximately 3500ms starting from the lowest channel (Fig. 1c). The same signal was already meet here (thanks pir3 for his comment in twitter).

Fig. 1a
Fig. 1b
Fig. 1c

The two lower 25Bd and 50Bd PSK2 channels after the pilot tone send a continuous sequence of zeros and ones which is most likely used for sync purposes.

Fig. 2a
Fig. 2b

The analysis of the 30 data tones shows a 4-ary constellation in absolute mode and a 2-ary constellation in relative mode (Fig. 3), in my opinion these tones are keyed using DPSK ,or MSK, modulation with symbol-rate of 50 Baud and 25Hz shift (note that MSK is a particolar form of QPSK); the analysis of a single tone confirms my guess (Fig. 4). No particular patterns were detected during the data phase.

Fig.3
Fig.4

A raw demodulation (!) results in a 100-bit period stream (Fig. 5). As you see, 100-bit period makes a 2000ms interval that matches the intervals in Fig. 1c.


Fig.5
Signal localization is rather difficult, indeed several TDoA runs result in the middle of nowhere in Pacific Ocean (Fig. 6).

Fig.5

4 April update (replying to my friend Daniel's comment)
I simply used DPSK but I should have specified if it is a CDPSK or a SDPSK.
Indeed, "the difference between PSK and DPSK (Differential PSK) is in their encoding of the input data sequence. PSK encodes the input data sequences in-pahes (states), while DPSK encodes it in the phase difference (transitions) between successive bits or symbols.
This means that there would be a phase change in the modulation signal if the two successive bits in the input data sequence are different (0 to 1 or 1 to 0), and no phase changes if the successive bits are the same. DPSK is called conventional DPSK (or CDPSK) if the phase differences is in the set of [0,π] and symmetrical DPSK (SDPSK, also called π/2-DPSK) if the phase difference is in the set of [π/2,-π/2]". As you see in Figs. 3 and 4 the transitions are in the set
of [π/2,-π/2] so most likely it's a SDPSK (π/2-DPSK). 
As a further proof, I synthesized a OFDM-30 SDPSK 50Bd using the OCG tool: the results are shown in Figs 6 and 7 below.

Fig. 6
Fig. 7
The "delay" in the transitions from idle to data and from data to idle (Fig. 1c) are clearly visible in the demodulated bitstream in Fig. 8 that my friend Daniel linked in his comments.
 
Fig. 8


https://yadi.sk/d/2Qs8X9e1sr1Pgg  (OCG synthesized OFDM-30 SDPSK 50Bd)
https://yadi.sk/d/cn6iqtWQhn-Sig 
https://yadi.sk/d/CUxayO9wyIeeAw

[1] the recordings were possible mainly thanks to the owner of KiwiSDRs at:
AI6VN/KH6 - Kahakuloa, Maui, Hawaii 

other useful KiwiSDRs used in monitoring: 
Marahau, Tasman District, New Zealand 
Northeast Asian Broadcasting Institute - Seoul, Republic of Korea
ZMH292 - Bay of Islands, New Zealand
Yokohama, Japan

22 March 2016

Japanese Military, OFDM-30 +2 (mutichannel hybrid modem)


For several days, at a frequency of 12384.0 and 16553.0 kHz on USB (16553.0 is a constant for the Japanese MIL 8 freq signal), we heard unmodulated carriers only, and then finally they went to the data! 
At a first glance the signal looks like an OFDM 32 tones, ~70Hz spaced and BPSK modulation at 50 Baud (pic.1). A separated unmodulated tone, the lower in the spectrum, acts as a pilot-tone for Doppler correction and is transmitted at a higher level that the other tones.
 
pic.1 - OFDM analysis
studying more carefully the individual tones and especially the first two tones in the lower part of the spectrum, the signal is not properly constructed with OFDM technology but rather is a multichannel waveform with a DPSK or MSK modulation with 25 Hz shift and 50 Baud speed for what concerns the 30 upper channels.
Indeed, once isolated the higher tone, there is no evicence of carrier harmonics in the 2^ power and the phase detector shows a characteristic FSK-2 shape with 25Hz shift (pic.2).
pic.2 - absence of the carrier in the 2^ power harmonics
The 4-ary phase plane related to such channel reveals no diagonal transitions and two-state  transitions in Diff.1: signs of a DPSK or MSK modulation (pic.3)
pic. 3
The upper 30 tones are then MSK 50Bd 25Hz shift, spaced by 70 Hz.
The two lower tones just after the pilot tone (the lowest one) exhibit a BPSK modulation and a speed of 25 Baud for the first (pic. 4) and 50 Baud for the second (pic. 5). It is worth noting that:
- the sequence "0101010101" which is transmitted with these two channels is maybe used for sync purposes,
- these two tones are tranmitted at a lower level that the upper 30 tones. 
pic. 4 - the lower BPSK channel
pic. 5 - BPSK 50Bd in the second channel
Sumarizing the characteristics (pic. 6):
30 data-channels DPSK/MSK 50Bd/25Hz, 25Hz spaced (OFDM)
2 service-channels BPSK 25 and 50 Baud, transmitted at lower level than the 30 upper tones
1 pilot-tone, transmitted at higher level that the 30 upper tones
pic.6
Both 16553.5 kHz USB and 12384.5 kHz USB was previously channels for the old Japanese 8-tone mode, probably a litlle mis-tuning.

21 April 2015

Japanese Military 8 frequencies: 2 FSK channels, cross-schema reduntant

This signal was seen on 16553.5 KHz/USB around 1900z  and - at that same time - on 12384.5 KHz/USB by my friend Mauro IK2GFT from Milano:


It is composed of 8 distinct channels, 300 Hz spaced and 100 Baud as symbol rate. The signal uses about a 2400 Hz bandwidth.
The signal consists of two independent FSK-2 channels which are doubled according to a cross-schema (tones separation too is doubled), so the 4 FSK-2 channels (8 traces) that are visible in the sonogram/spectrum. According to the analysis performed by radioscanner group, all the four channels use the Manchester code and, since the time offset between the first and second channel, they are formed using OFDM technology.

more info here (signals.radioscanner.ru)