Showing posts with label QAM. Show all posts
Showing posts with label QAM. Show all posts

29 August 2025

Link-22 12QAM waveform

Fig. 1 - Link-22 transmission

Recently my friend ANgazu from radiofrecuencias.es sent me a great catch of a Link-22 transmission - Figure 1 - recorded at 11128.0 KHz/USB. Identifying the mode (Link-22) is fairly straightforward by examining the bitmap depicting the framing period used by the waveform (Figure 2).
The 112.5 ms duration is typical of the waveforms used by Link-22 and described by STANAG-4539 standard (non-hopping TDMA traffic waveforms). Note that in this case the framing consists of 3 data blocks (DATA) interspersed with three mini-probes (MP) blocks.

Fig. 2 - typical Link-22 framing

Honestly, examining the individual bursts I expected to find QPSK or PSK8 modulations: I was very surprised when the phase plane revealed bursts with QPSK and even 12QAM constellations within the same transmission (Figure 3): clear sign that the header must therefore encode the modulation mode.

Fig. 3 - QPSK and 12QAM constellations

A 12QAM modulation is employed in non-hopping TDMA traffic waveform #13 (Annex G to STANAG-4539):

12QAM is unusual because QAM typically uses powers of 2 (so each symbol cleanly represents an integer number of bits). 12 is not a power of 2, so it cannot map bits directly since log⁡2(12) ≈ 3.585 bits per symbol, which is not an integer.
However, some NATO HF modem implementations of STANAG-4539 use a circular 12QAM layout (which uses two concentric rings) rather than the rectangular one (3x4 grid). Figure 4 shows an approximate layout:
- inner ring 4 points (like QPSK), offset for symmetry
- outer ring 8 points evenly spaced (like 8-PSK)
This design gives a radial + angular separation, making it easier to decode under fading and noise than a rectangular grid. 

Fig. 4 -  circular 12QAM (STANG-4539 style)

This variation of a constellation is not "new" in STANAG-4539 as, for example, the 64-QAM constellation described in paragraph #4.2.2.1.6: "This constellation is a variation on the standard 8 x 8 square constellation, which achieves a better peak-to-average ratio without sacrificing the very good pseudo-Gray code properties of the square constellation".

As seen, with 12QAM circular, the goal is 3.5 bits/symbol (b/sym). There are at least three practical approaches:
1) 4-bit labeling + FEC rate 7/8
2) Multilevel/TCM ( trellis-coded modulation): 3 info bits + 1 structural bit
3) Probabilistic Amplitude Shaping (PAS)
The most common is the 4-bit labeling + FEC rate 7/8:
- assign a 4-bit mapping to the 12 points (16 combos → 12 used, 4 unused).
- apply channel coding with rate R=7/8 (e.g., LDPC or turbo). Net efficiency: 4×7/8=3.5 b/sym.

I can give an Octave example [1] for such method with a 12QAM circular constellation. Since Octave doesn’t have built-in LDPC/RS at hand, the code illustrates it using a simple block code to emulate the R=7/8 effect (i.e., 7 info bits + 1 parity). The principle is the same as using LDPC/Turbo in practice.
What it does:
1. Defines the 12QAM circular constellation (4+8 rings) with 4-bit Gray-like labels.
2. Implements a (7,8) block encoder (simple parity, emulating FEC with rate 7/8).
3. Transmits random data: 7 info bits → +1 parity → 8 coded bits → mapped into 2 QAM symbols.
4. Sends through an AWGN channel.
5. At the receiver: nearest-neighbour detection, recover labels.

Fig. 5 - 4-bit labeling + FEC rate 7/8 simulation

Must be noted that:

* the STANAG-4539 12QAM waveform uses a channel coding with rate R=4/5 and TBCC (Tail-Biting Convolutional Code). Net efficiency: 4×4/5=3.2 b/sym.

* STANAG-4539 is not the same as Link-22, but Link-22 can use STANAG-4539 as one of its underlying HF bearers.

* the Octave code is just an example/simulation just to prove that  ~3.58 bits per symbol fits nicely with the interleaving, coding, and frame structures used in the waveform: I do not know what is the method for the 12QAM used in the analyzed signal.

The choice of 12 points is not arbitrary, it’s a trade-off between spectral efficiency and robustness: it can deliver intermediate data rates where 8-PSK is too low and 16-QAM is too fragile under HF channel conditions. In military waveforms like STANAG-4539, robustness and flexibility matter more than mapping convenience.

 https://disk.yandex.com/d/tMeSf8zZjgdl4w

[1] https://disk.yandex.com/d/kZmCP-fdqtc-cw

26 August 2019

6 KHz wideband OFDM-160 PSK2/QAM-16

6 KHz wideband OFDM-160 30.469 Bd/37.5 Hz PSK2 & QAM-16 spotted on 10342 KHz (CF), probably it's connectd to the OFDM-80 seen a few days ago. Some packages of this  transmission have PSK2 modulation, other QAM-16. ACF of the transfers is equal to zero. As suggested by my friend KarapuZ, for a correct analysis it is necessary to load only the central body of a package excluding preamble and trailer.
Friends from radioscanner.ru have noticed versions of this OFDM with QPSK, PSK8, and QAM-32 modulations in the channels.



Transfers begin and end with short MFSK sessions although they are shifted upwards with respect to the central frequency of the OFDM. Don't know if the MFSK waveforms are used for link establishment or for other communication-oriented signaling.


7 February 2019

odd signals picked-up using the Arctic KiwiSDR

7600 Hz wideband signals from (only!) Kiwi ArcticSDR and using single tone QAM-64 modulation at a symbol rate of 7200Bd. The signals seem to have specular positions of a "supposed" reference/pilot tone. Most likely, the signals "leak" out of wired high-voltage lines (PLC) running close the Bjarne's KiwiSDR.




https://yadi.sk/d/P_r6r69SqVf_3g

9 October 2018

S5066 data transfer, scaling from 3200bps (QPSK/PSK8 on-air) up to 9600bps (QAM64)

8th October update: using "Wireshark" software to detect IP packets (IP over HF)

13378.0 KHz/USB, 0848z: S5066 data transfer using HF waveforms 110A & S4539 which scale from 3200bps (QPSK/PSK-8 on air) up to 9600bps (QAM-64); unid user/location. Notice in Figure 1 that QAM-32 constellation use multiple PSK rings to maintain good peak-to-average ratios, and the QAM-64 constellation is a variation of the standard square QAM constellation, which has been modified to improve the peak-to-average ratio.

Fig. 1 . HF waveforms constellations
The typical 1776 bits structure of S5066 is obtained after the removal of the HF waveforms overhead, in Figure 2 the bitstream is synchronized on the sync sequence 0x90EB. 

Fig. 2 - STANAG-5066 bitstream synched on 0X90EB
Looking at the 16-byte headers of the Data Transfer Protocol Data Units (D_PDU), we see that #0 (Data only)  is the used D_PDU type: this type is used for simplex data transfer of segmented C_PDUs with a Selective Repeat-Request (SRQ) service protocol. The peers in the link have the S5066 addresses: 001.005.005.105 and 001.001.001.101.

0x90EB D_PDU sync sequence
04 D_PDU type

10 50 56 91 01 01 65 source & destination address

90 EB 04 F6 3C E9 10 50 56 91 01 01 65 48 BA 85 ...
90 EB 04 F6 3B E9 10 50 56 91 01 01 65 08 C8 87 ...
90 EB 04 F6 3A E9 10 50 56 91 01 01 65 08 C8 88 ...
90 EB 04 F6 39 E9 10 50 56 91 01 01 65 08 C8 89 ...
90 EB 04 F6 39 E9 10 50 56 91 01 01 65 08 C8 8A ...
90 EB 04 F6 38 E9 10 50 56 91 01 01 65 08 C8 8B ...
90 EB 04 F6 37 E9 10 50 56 91 01 01 65 48 BA 8C ...
90 EB 04 F6 36 E9 10 50 56 91 01 01 65 08 C8 8E ...
90 EB 04 F6 35 E9 10 50 56 91 01 01 65 08 C8 8F ...
90 EB 04 F6 34 E9 10 50 56 91 01 01 65 08 C8 90 ...

The  D_PDUs payloads originate a group of files which have the same 38 bytes length initial structure consisting of a 33-byte pattern followed by a progressive 0xnn number and four 0x00 bytes:

00 07 99 42 EF 44 45 00 05 64 FF FF 40 00 FE 32 E6 B6 C0 A8 01 30 C0 A8 0E 30 00 00 04 89 00 00 00 18 00 00 00 00 4F ...
00 07 99 42 EF 44 45 00 05 64 FF FF 40 00 FE 32 E6 B6 C0 A8 01 30 C0 A8 0E 30 00 00 04 89 00 00 00 19 00 00 00 00 5A ...
00 07 99 42 EF 44 45 00 05 64 FF FF 40 00 FE 32 E6 B6 C0 A8 01 30 C0 A8 0E 30 00 00 04 89 00 00 00 1A 00 00 00 00 CC ...
00 07 99 42 EF 44 45 00 05 64 FF FF 40 00 FE 32 E6 B6 C0 A8 01 30 C0 A8 0E 30 00 00 04 89 00 00 00 1B 00 00 00 00 53  ...
 

In my opinion the first six bytes are the headers of C (Channel Access Sublayer) and S (Subnetwork Interface Sublayer) Protocol Data Units: 

00 07 99 42 EF 44

00 C_PDU type (0 = data) 
07 S_PDU type (0 = data)
99 S_PDU source & destination SAP IDs (1001 & 1001)

42 EF 44 S_PDU control and TDD fields

and the remaining 32 bytes, from 0x45 to 0x4F, could be the headers of the User Protocol data Units (U_PDUs) incoming from the client/application upper layer (Figure 3). Since the presence of a progressive number (0x18, 0x19,0x1A,...) it could be that the client message has been segmented into smaller U_PDUs before the subnet interface, but it's only a my guess.

Fig.3 - sublayers within STANAG-5066

SAP_ID stands for Service Access Point Identifier, it's a number in the range 0-15 and is equivalent to the “port” of the TCP protocol. In this case - according to S5066, the used Service Access Point should be the IP port (1001).

My friend and colleague j. sent me an email with his comments about this signal "I also analysed the last S5066 signal you posted on your page. It finally contains IP data packets (local addresses are 192.168.1.48 ->192.168.14.48) in the direction 1.1.1.101 -> 1.5.5.105. The used protocol is ESP (IPSec). The other direction confirms the data using RCOP"
Well, it's possible to prepare an hex dump file by removing the  C & S headers (0x 00 07 99 42 EF 44) :

00 07 99 42 EF 44 45 00 05 64 FF FF 40 00 FE 32 E6 B6 C0 A8 01 30 C0 A8 0E 30 00 00 04 89 00 00 00 18 00 00 00 00 4F ...

and then process the obtained file using "wireshark" software. The results show the IP packet originally submitted to S5066 and thus to the HF network, i.e. IP over HF [1]


[1] https://www.isode.com/.../ip-over-stanag-5066.html
https://yadi.sk/d/ZFTNRhiPkoT1HQ
 

24 July 2018

the unid Kongsfjord OFDM (1)


If you open the Norwegian Kongsfjord kiwiReceiver and tune to 468 kHz/usb you will find a continous signal 12 kHz wide with a carrrier at +1,5 kHz from the lower edge and two smaller carriers at the signal's midband. 
I suspect this signal (and 3 other signals found a bit lower in the same band) to be Russian maritime broadcasts. My assumption is based on the fact that it was announced a couple of years ago that Russia intended to build a chain of MF broadband stations along the North Eastern Sea route [1], and that Russia had shown interest in the NAVDAT MF broadband system developed by Kenta, France, and adopted by ITU [2]. Anyway, it could also belong to a Narrowband (Under 500 kHz) Power Line Communications (NB-PLC) system used not only for smart metering but also for many other Smart Grid applications.

After waveform analysis by me and AngazU (1), the strong 12 KHz wide signal (cf at 474 KHz) turns out to be a OFDM 95-tone, 125 Hz spaced, using a mix of QAM-16, QAM-32, and QAM-64 modulations at the same time, ie in different subcarriers, with a symbol-rate of 116.8 baud (Fig. 1)

Fig. 1 - signal spectrum
The signal seem structured as follows (Figs. 2,3):
- 2 groups of 46 (data) subcarriers,
- 2 unmodulated pilot subcarriers, 
- 1 empty place (exactly at center band), although - according to the SA OFDM module - it seems actually a modulated tone:


Fig. 2 - main parameters of the OFDM waveform

Fig. 3 - different constellations: QAM-16, QAM-32, and QAM-64

It's worth noting that the QAM-64 constellation is ~9.75 degrees rotated (Figs.4,5). A smilar feature is offered by DVB-T2 specification (tilt angle is 16,8 degr in this case) to establish a form of diversity. Also noteworthy is that DVB-T2 uses concatenated BCH and LDPC coding for FEC as does the Russian system for the Northern Sea Route. It seems that this system has borrowed features from DVB-T2. 

Fig. 4 - QAM-64 rotation in consecutive subcarriers
Fig. 5 - using GIMP software to measure the tilt angle after six rotations
This system seems operate in a “permanent mode”, stations are transmitting continously, rather than a "sequential mode" (based on time slots). As you see in the title figure, the spectrogram shows other three similar signals with lower SNR at 378, 414 KHz and 438 KHz (central frequencies), notice in Fig. 6 that the four signals are separated by intervals which are related to the 12 KHz bandwidth (3x12 and 2x12 KHz).

Fig. 6 - up to four transmitters ?
Kongsfjord SDR seems to be the only SDR which receives these signals, probably it's due to the propagation limits in this band and the power levels used since the radiated power from the regional coast station transmitter should be what is sufficient to cover the intended service area of that coast station. If you look at the map at page 3 in the cited document about a Russian Arctic MF communication system [1], below in Figure 7, you will notice the chain of stations are plotted and that one (service zone 2) covers the position in Norway where the Kongsfjord SDR is located. Also a transmitter in zone 6 (there is no service circle on the map), likely Murmansk or Severomorsk port, probably could be received at the same location in Norway. Signal's levels in Figure 6 could be a confirm of the Tx sites. 

Fig. 7 - Approximate position of the local service zones. Zone radius is 200 km.

Me and friends who collaborate to this analysis emailed Mr. Bjarne, Kongsfjiord SDR admin and arcticdx.blogspot.com owner, asking his opinion: he kindly replied by also sending  two jpgs which show the regional and local layout of the power grid. He tends to exclude the PLC option for political/strategic reasons and also for tech reasons ("the signal is also strong 14 km away from the KongSDR location", Bjarne says).

It's very interesting to notice in Fig. 8 that only 2 signals were visible on September 2017 (vs. the 4 which are visible today) during ALA1530LF Loop and Longwire comparative tests at KongSDR site: maybe other systems/sources were set in operation after September?
https://app.box.com/s/2hj8ep8j7dvv5r1rnqxgr6tbjauk6rl1


Fig. 8 - LF spectrum at Kongsfjord on September 2017

It will be interesting to follow these signals after the summer and look if they will be received in some other close SDRs as the one located in Haparanda (Sweden), the reason is the high latitude and the propagation mechanisms in the low portion of MF: as you know, in this month (July) in that Arctic region the sun comes up for more than 20 hours.
 
(next post here)


(1) Since the 11968 KHz bandwidth available for IQ recording, limited by the KiwiSDR itself, the analysis could return some inaccurate estimates, anyway we resampled the recordings to 48 KHz. 


29 July 2016

STANAG-4538, HDL+ BW7 waveforms

Bearing in mind the results and considerations about STANAG-4538 HDL+ protocol, as reported in the previous post, one can easily face the analysis of 3G-HF burst signals like this (fig. 1)

fig. 1
Once checked the headers and the length of the data sections, and found to be 288 symbols, I used the "harmonics" tool in order to get the modulations: I also used the zoom tool to better clarify the differences in each forward burst. A partial result at 8^ power is shown in figure 2: the PSK-8 harmonics due to BW6 headers are well visible, while the data sections (BW7) use different modulations according to the table of figure 3.

fig.2
Fig. 3
 Analyzing all the forward bursts, it's possible identify the presence of the QAM-16 and QAM-64 BW7 waveforms, other than the PSK-8 BW6 waveform. 

fig. 4 - 4800 bps PSK-8 BW7 waveform
fig. 5 - 6400 bps BW7 QAM-16 waveform

fig. 6 - 9600/12800 bps BW7 QAM-64 waveform
It is worth noting in figs. 5,6 that the used constellations for QAM modulations are in 'circular rings' and then they are modified with respect to the standard ones.

fig.7
fig.8
 

5 November 2015

MIL 188-110C App.D: BW24 KHz, SR19200 Bd, QAM-64


 

Cross Correlation Function returns 106.6 ms (Pic. 2) and highlighting a single frame it can be seen that the length of the mini-probe is worth 6.8 ms (Pic. 3): since the baudrate (19200 Bd), it makes ~130 symbols length. Now, looking at Table-D for 24KHz bandwidth waveforms (Pic. 4), this value (~130 symbols) can be assumed as 128 and consequently the data segment consists of 1920 symbols: this way we get (128 + 1920) 2048 symbols per frame that generate a 106.6ms ACF,  and 'salright (*). So, the waveform number may be 11 (64-QAM) or 12 (156-QA). The value of the carrier can be obtained in the fourth degree, wich is characteristic of QAM modulation (Pic. 5), and - althought it's not so clear - the typical 5 rings of QAM-64 are distinguished in the phase-plane constellation (Pic. 6).

Pic. 1 - 24 KHz bandwidth and 19200 Baud
Pic. 2 - CCF
Pic. 3 - Mini-Probe lenght
Pic. 4
Pic. 5 - detecting baudrate, carrier ad harmonics of the signal
Pic. 6 - the 5 rings (hardly distinguishable) correspond to QAM-64
(*) 'salright, it's all right, as Lennon sings here (Whatever Gets You Through The Night)

8 October 2015

CIS-128 broadband (6 KHz) waveform


Broadband waveform (6 KHz) of the CIS-128 OFDM modem. The values of the manipulation speed and carriers separation are the double of the ones seen in the 3 KHz waveform, i.e. 42 Baud  and 47 Hz, whilst the OFDM formation values remain unchanged (Pic. 1). The waveform allows the two 'data' and 'sync' modes, with the same 1-of-five character feature clearly visible in the data mode. Modulation is always QAM-16 (Pic. 2) and the ACF value is 10 symbols lenght (Pic. 3), like the narrow band waveform.

Pic. 1 - narrow band (3 KHz) and broadband (6 KHz) OFDM parameters
Pic. 2 - QAM-16 modulation in the channels
Pic. 3 -  10 symbols ACF

Below the screenshot of a CIS-128 BB reception (added as update on October, 10) on 14711.5 KHz on USB