CIS MPSK-16, a POSTNET 2-of-5 variant?

As for the 6-bit encoding used in CIS MPSK-16 streams, see this post for background, my friend Nicholas suggested that most likely it's a variant of the 2-out-of-5 code [1], a constant-weight code that provides ten possible combinations of two bits and is used for representing the decimal digits using five bits. A such coding works as follows: each bit position is assigned a numerical weight, i.e. a value, e.g. seen from the left '01236', so if bit 4 (the leftmost bit) is a '1' and bit 2 is also a '1' then the combination '10100' would yield 0+2 = 2.

The codeword format is XXXXXS, where X = '0' or '1' and S is the stop bit, always '1', so in order to decode it you will have to invert the polarity of the bitstream 1 to obtain a 1:0 ratio of 2:3, indeed, I found a ratio 1:0 = 3:2 in reverse polarity.

Fig. 1

Using the table shown in the cited post, after  invert the polarity and remove the stop bits, I tried to apply the  POSTNET 74210 code [2] to the source message (assuming 11111/00000 is the codeword used for the separator character):

Fig. 2 - 2-out-of-5 code

 

00111 = A     11000 = 0 (---)
01011 = B     10100 = 9 (7+2)
01101 = C     10010 = 8 (7+1)
01110 = D     10001 = 7 (7+0)
10011 = E     01100 = 6 (4+2)
10101 = F     01010 = 5 (4+1)
10110 = G     01001 = 4 (4+0)
11001 = H     00110 = 3 (2+1)
11010 = I     00101 = 2 (2+0)
11100 = L     00011 = 1 (1+0)

 

As you see, applying the POSTNET 74210 coding to the source message, from the fourth group of the first line (and form the first group of the last line) yields the 5-digit group 99932  where 32 is just the total number of the groups within the message:

79128 79128 79128 99932
73814 04737 77008 73818
73717 65621 93714 65728
71837 65621 72185 46677
73815 72716 63472 21056
98742 10365 72716 62714
75321 63451 45660 87242
65721 72716 16078 75025
45666 12343 23445 00352
99932 79128 79128 79128

However, it remains to be seen whether '999' is actually '000' or "---" (as said, the coding could be a variant of 74210) and the meaning of the other 3 groups (79128) of the first and last line: probably something related to the message itself, perhaps the number of the message?

[1] https://encyclopedia.thefreedictionary.com/two-out-of-five+code
[2] https://en.wikipedia.org/wiki/POSTNET

CIS MPSK-16, PSK2 500Bd

Interesting CIS transmission spotted by my friend KarapuZ, whom I thank for sharing. The signal is a wideband MPSK-16 waveform, with 2500 Hz channel spacing, and use a PSK2 modulation at the symbol rate of 500 Bd in each channel. The 16 channels transport the same data.

Fig. 1 - PSK parameters of a single channel

A better view of the decoded bitstream of a single channel is obtained by using a 36-bit length period (figure 2):

Fig. 2 - 36-bit period

The messages consist of 5-FGs groups and a separator character (111110). In my opinion each group is coded into a 5-bit Figures, (after the removal of the common trailing "0") and has a constant ratio "1s"/"0s" = 3/2, except the separator which consists of all ones bit (11111). Nothing changes if the reverse polarity is taken into consideration. By using the association:

11111 = space/separator
00111 = A
01011 = B
01101 = C
01110 = D
10011 = E
10101 = F
10110 = G
11001 = H
11010 = I
11100 = L

we get :

DBLIC DBLIC DBLIC BBBHI
DHCLG AGDHD DDAAC DHCLC
DHDLD EFEIL BHDLG EFDIC
DLCHD EFEIL DILCF GEEDD
DHCLF DIDLE EHGDI ILAFE
BCDGI LAHEF DIDLE EIDLG
DFHIL EHGFL GFEEA CDIGI
EFDIL DIDLE LEADC DFAIF
GFEEE LIHGH IHGGF AAHFI
BBBHI DBLIC DBLIC DBLIC

Notice the particular "format" that is used for the initial and last four groups of the message: some conjectures can be made about its purpose such as for example the signaling of SOM/EOM or the date/number of the message... anyway only hypotesis. The messages are probably off-line encrypted and maybe using the so-called OTP (one-time pad) technique: anyway, one could test the possible associations as for example the following A=0 - L=9 (or the reverse order) and see what it turns out:.

31982 31982 31982 11178
37296 06373 33002 37292
37393 45489 17396 45382
39273 45489 38925 64433
37295 38394 47638 89054
12368 90745 38394 48396
35789 47659 65440 23868
45389 38394 94032 35085
65444 98767 87665 00758
11178 31982 31982 31982

My friend Cryptomaster came to the same conclusions in his reply in radioscanner taking a different approach: ie 6-bit words consisting of 5-bit code + 1 parity bit. Probably the MPSK waveform is an evolution of the CIS PSK-2 serial tone waveform (same period, same bitstream pattern) [1]: given that the 16 channels transport the same data, they provide a better immunity to noise and interferences.

https://disk.yandex.com/d/uBpZwnz0dv47Rw

[1] http://signals.radioscanner.ru/base/signal172/ 

15-channel BPSK 500Bd 30KHz, CIS (wideband?) Akula

Quite rare Akula ("Shark") [1] signal catched by my friend KarapuZ. The usual Akula 500Bd/1000 FSK2 waveform is preceeded by the transmission of 15 PSK tones (MPSK-15) lasting the same time of the FSK signal. The 15 channels are about 2200 Hz spaced and occupy a bandwidth of 30 KHz, each channel consisting of a BPSK modulated tone at the symbol rate of 500Bd (Akula II), ie the same of the following FSK2 burst; the 15 subcarriers are not orthogonal (Figs 1,2).

Fig. 1

Fig. 2

 

Either the BPSK channels and the FSK2 transport the same data and use the well-known distinctive sign "1771/"  as shown in Figure 3.
As per [1], FSK2 Akula may be descrambled using the LFSRs described by the polinomyals x^5+x^3+x+1 or x^4+x^3+1 after differential decoding: well, in this case none of the two modes (BPSK and FSK2) is successfully descrambled using the above polynomials.

 

Fig. 3 - ending parts of the demodulated bitstreams

The FSK2 signal is exactly centered on the passband of the preceeding 8th DBPSK tone (likely the "call" frequency): it could be that the FSK2 signal is targeted to "legacy" receivers while the wideband part to "stared" SDR receivers (as said, the contents are the same)... but that's only a my guess, who knows? anyway, using such a width signal (about 30 kHz) should provide good noise immunity. It's to notice how the power of the FSK signal appears spreaded on the DBPSK signals (same transmitter). 

 

The use of BPSK modulation (Akula II) is not new, as a 2015 recording demonstrates (Figure 4). Also in this sample, the FSK signal is centered on the passband of the preceeding BPSK subcarrier, although the switch time  BPSK -> FSK2 is longer than the one 15xBPSK -> FSK2. The two demodulated bitstreams - at least in this sample - are not the same (Figure 5).

 

Fig. 4 

 

Fig. 5

https://disk.yandex.com/d/9L9PXtSOkvAcpA 

[1] https://i56578-swl.blogspot.com/.../akula.html

Telsy/Q-MAC MPSK 30+1 48.8Bd 60Hzi56578, DF3LZ,KarapuZ

Radio-check bewteen voice callsigns GAMMA 130 and ROSTRO 530 (respectively It-GdF shore station and patrol-boat) followed by short MPSK blocks, most likely digital voice.  
The MPSK signal occupies a bandwidth of ~2280Hz and has a FSK-2 600Hz shift preamble lasting 150ms (Fig. 1). Except for the 1st block, the FSK preambles of the following 3 blocks are similar. The 30 tones are 60Hz spaced: in the lower group of 20 tones the π/4-DQPSK modulation at 48.8Bd is used; in the upper group of 10 tones, a mix of modulations (MFSK, DBPSK and π/4-DQPSK) at same 48,8Bd speed is used (Fig. 2).

Fig. 1

Fig. 2 - upper group of 10 tones (credits to KarapuZ)

The tone in between the two groups is modulated using DBPSK2 at 48.8Bd (same speed as above) and is used for for synch purposes. The 3 blocks have the same sequences transmitted in the sync channel (Fig. 3). 

Fig. 3

This signal is similar to the Q-MAC HF modem waveform reported by radioscanner, except for the presence of the FSK preamble (Fig. 4). Indeed, a DXer from UDXF suggested the  Telsy TCH01c  rather than Q-MAC modem. Quoting form Telsy documentation [1]: "The TCH01c – Telsy Crypto Handset – is a unique and sophisticated encryption unit, combining an encryption module, a vocoder and a modem in a single handset."  Well, in August 2009 Barrett Communications has announced its acquisition of Q-MAC Electronics:
http://www.barrettcommunications.com.au/.../
and it's interesting to note that Barrett recommends the Telsy TCH01c crypto handset for some of their transceivers:
http://www.italponti.it/_files/download/allegati/2090.pdf
That said, perhaps Telsy embeds the modem in their handset using a Q-MAC/Barret EOM license? I emailed Telsy but I did not have any reply.

 

Fig. 4 - signal by radioscanner (upper) and the signal being analyzed

It's also interesting to note that the digital signal was preceded by the following comms:
GAMMA 160: let's have a try with a 'passage' in red, I'll take you
ROSTRO 530: yes go ahead, take me up
usually "red" stands for not encrypted transmissions so it seems that they used a clear-text transmission for the modem check.

[1] http://www.telsy.com/wp-content/uploads/2016/07/TCH01c_UK120914.pdf

https://yadi.sk/d/XJWRrvoK3Ut87Y