Fast WALE (4G-ALE) and wide band traffic (WBHF)

Thanks to a reporting of my friend Martin G8JNJ, on 4744.0 KHz - mostly in the morning -  it is possible to receive transmissions which use Fast WALE (188-141D App.G) and WBHF (188-110D App.D) waveforms: it's the first time for me that I have the canche to "see" and analyze 4G-ALE signals. 

The WALE (4G-ALE) system uses waveforms derived from the WBHF waveforms for its transmissions, and draws ideas from both second and third-generation ALE for its protocols. The WALE waveforms operate in 3 kHz and provide two interoperable modes for sending PDU: the “Fast” WALE waveform (intended for very fast link setup in voice-quality channels) and the “Deep” WALE waveform (designed for operation in the most challenging channels, including SNR < 0dB). The choice between Fast or Deep WALE can be made on a call-by-call basis as receivers listen to both types of WALE calls, as well as 3G & 2G ALE calls for simultaneous operation with existing narrowband circuits.[1]

In the recorded session shown in Figure 1, the transmissions consist of two-way WALE handshakes followed by data transfers using ARQ method and WBHF waveforms: the bursts following the last ACQs are probably an EOM signaling given that the following session begins with a WALE handshake. Since the strong signals in the analyzed sample, I can't say if it's a bidirectional link. 

Fig. 1

The WALE LSU protocol use a fixed 96-bit length PDU for both Fast and Deep waveforms with a correction coding consists of a constraint length 9 (CL-9), half rate convolutional code producing a 192-bit coded block (ie, for each bit input to the encoder, two bits are taken from the encoder). Using Fast WALE the coded and interleaved bits of each PDU are sent in alternating blocks of unknown (data) symbols and known (probe) symbols.

The WALE waveforms employ PSK8 modulation of an 1800 Hz subcarrier at a rate of 2400 symbols per second. The two more dense states in the phase plane of Figure 2 are due to the BPSK modulation of  Fast WALE data.

Fig. 2

 

In the analyzed samples the portion before the coded and interleaved PDU, according its 83.33 ms duration, consists of 200 PSK8 symbols (figure 3). Since the preamble and the TLC sections use the same 32-element Walsh chips (32 PSK8 symbols), the initial portion consists of 1 TLC block (13.333 ms) followed by 168 PSK8 symbols (70 ms) which do not resolve into an integer number of 32-element Walsh chips! These values, durations and symbols, are not compliant with relevant standard (188-141D #G.5.1.8.2) which requires nine 32-element Walsh chips for the Fast WALE  preamble, for a total of 288 PSK8 symbols and a 120 ms duration.

Fig. 3

The structure of the known/unknown symbols blocks is exactly compliant with 188-141D: ie, 288 PSK8 symbols and a 120 ms duration (figure 4). Notice that according 188-141D, the length of the preamble shall be equal to the sum of the lengths of the known/unknown symbols blocks.

Fig. 4

The traffic waveforms are PSK8 modulated at symbol rate of 9600Bd, ACF value is 120ms that makes a 3456-bit length period or 1152 PSK8 symbols (Figure 5): the frame structure (Figure 6) matches the waveform #7 of 188-110D App.D ie, 1024 Unknow symbols (3072 bit) + 128 Known symbols (384 bit). 

Fig. 5 - WBHF waveform #7

Fig. 6

The bursts I termed as "EOM" also employ PSK8 modulation at symbol rate of 9600 Baud and have a frame length of 1504 symbols (Figure 7).

Fig. 7

[1] https://www.rapidm.com/wp-content/uploads/2018/10/RM10_WBHF_EN.pdf

https://yadi.sk/d/FkvzXFHKLL0Rbw

Interesting MS-110D App.D (WBHF) traffic

Interesting traffic heard on 5750 KHz/USB and picked up thanks to the UK KiwiSDR owned by G8JNJ.

Most of the signals are definitely "110C Appendix D" 3 KHz BW waveform (WID 1 or 2, BPSK). The synchronization preamble has a framing of ~240ms length that makes 576 symbols @2400Bd speed (Fig. 1). From 188-110C App.D documentation, the orthogonal Walsh modulation is used in the synchronization section of the preamble and the length of the repeated super-frame is 18 channel-symbols, ie: 9 (fixed) + 4 (downcount) + 5 (waveform identification). Since in 3 KHz bandwidth waveforms the preamble channel-symbols are 32 symbol long, the length of each repeated superframe is: 18 (channel-symbols) x 32 (length of one channel-symbol) that just matches the measured 576 symbols length.
Data section has 40ms length frames (Fig. 2) i.e. each frame consists of 96 symbols: 48 unknown data + 48 known data (mini-probe). This framing meet the waveform IDs 1 and 2 of the 3KHz bandwidth set (BPSK modulated data).

Fig. 1 - Synchronization preamble superframes

Fig.2 - data section frames

Anyway, FLSU BW5 bursts and unid 2400Bd bursts are the most interesting aspects in this catch.
In my opinion the presence of (repeated) 3G-HF Fast Link SetUp (FLSU) BW5 bursts is rather strange also because the link seems to be terminated with a 188-141A 2G-ALE "TWS" sequence: a kind of "fall back" for 2G-ALE? Perhaps we're dealing with a STANAG-4538 "circuit-mode" service and I did not hear the BW5 PDUs sent by the other side of  the link, or perhaps BW5 PDUs are just used to signal the following traffic waveform.
The other 2400Bd bursts (Fig. 3) have a fixed duration of ~2840ms: unfortunately the poor SNR of the signals does not allow to get other significant parameters from their analysis.

Fig. 3

As said, the link was terminated using 2G-ALE: the TWS message was sent by the ALE callsign "AC7", It's to be noticed that during the monitoring period other ALE soundings from calls "AC7" and "AC9"  have been heard. According to recent UDXF logs, these calls refer to a unid Jordan network, although it sounds weird to me that they use WBHF technology. Maybe some WBHF trials... but it's just a guess.

southwest.ddns.net_2020-02-06T21_02_31Z_5750.00_usb.wav
southwest.ddns.net_2020-02-06T20_56_47Z_5750.00_usb.wav

MIL 188-110C App.D: 9KHz/7200Bd & 12KHz/9600Bd

9KHz/7200Bd & 12KHz/9600Bd WBHF waveforms spotted on 9 MHz band. Both the ACFs show a value of 120ms that corresponds to 864 symbols for the 7200 Bd waveform (768 uk + 96k) and 1152 symbols for the 9600 waveform (1024 uk + 128 k).

The extra spikes in ACF diagrams, more evident in CCF, in my guess are due to the cyclically rotated version of the mini-probe which is utilized to identify the long interleaver block boundary (MIL 188-110D #D.5.2.2). Note that 2 data block make 4608-bit blocks (768x2x3) and 21 data blocks make 64512-bit block (1024x21x3), therefore the CCF spikes are related since 64512/4608=14

188-110C/D Appendix D, waveform Id 0 (ortogonal Walsh modulation)

9213.0/usb: 188-110C/D Appendix D waveform Id 0 (WID0) using ortogonal Walsh modulation in preamble section and in data blocks. The use of this waveform leads to think to poor channel conditions...

Symbols are scrambled to appear as PSK-8 on-air, symbol-rate 2400Bd.

audio recording (wav): https://yadi.sk/d/N9979JiT3VAbtW

binary stream after PSK-8 demodulation: https://yadi.sk/d/iwgDYrr73VAcCj 

WBHF comms in the 9 MHz band (188-110C/D Appendix D)

Just a couple of good quality recordings of the wideband activity that can be monitored in 9 MHz band. Both the waveforms belong to WBHF 188-110C/D App.D.

The 6 KHz burst is modulated at a symbol rate of 4800Bd and has a 192 symbols frame consisting of 96 data symbols (user data) followed by 96 known symbols (mini-probes): according to TABLE D-XI and TABLE D-XII, this the Waveform ID 1 or ID 2, (scrambled) BPSK modulation, depending on the used data rate (300 or 600 bps, as in TABLE D-II). Note that the BPSK constellations are scrambled to appear, on-air, as a PSK-8 constellation.

 

Fig. 1 - 6 KHz bandwidth bursts

Fig. 2

 
The 9 Khz burst has symbol-rate of 7200Bd and a period length of 2048 symbols. The period length helps to identify the waveform as the Waveform ID 0. Quoting D.5.1.4 "For the case of Waveform ID 0, an 8-PSK data scrambling sequence is utilized [...] this implementation is used to generate 256*8 or 2048 values. For the Walsh Orthogonal Modes the sequences are continuously wrapped around the 2048 symbol boundary". Since the 9 KHz bandwidth, the data rate is 300bps (TABLE D-II).

Fig. 3

Linking is performed using 3GWB extensions (3G ALE FLSU + WBALE). WBHF modes could also deliver video for awareness, such bandwidth allows information rather than data.

Fig. 4

https://yadi.sk/d/i-kCpOlj3UQRwG

https://yadi.sk/d/gkYepjZm3UQS4z

MIL 188-110C App.D: BW6 KHz, SR4800 Bd, Walsh

yet another 188-110C App.D signal (WBHF,  Wide Band High Frequency) spotted around 1850 UTC on 5407.0 KHz/USB by my friend Karapuz: it worth noting the bandwidth of the signal, 6000Hz, and consequently the sampling frequency adopted for the recording, 24000 Hz, which allows a good signal resolution and accommodation. Since the presence of an annoying fading and the signal strength,  the block #2 is the most suitable for a good analysis.

The basic parameter of the waveform are shown in figs 2,3

fig. 2 - baudrate line

fig. 3 - PSK-8 constellation

The cited value of 5407.0 KHz is the tuning frequency used to mantain the signal at the center of the band and thus it isn't the real dial frequency: indeed, you may note that the carrier frequency is almost the double of the expected 3300Hz.

preamble section

From the 188-110C App.D documentation, the orthogonal Walsh modulation is used in the Synchronization Section of the preamble and the length of each super-frame is 18 channel-symbols, ie:

9 (fixed) + 4 (downcount symbols) + 5 (waveform identification symbols) 

Since in 6KHz bandwidth waveforms the preamble channel-symbol is 64 symbol length, the length of each repeated superframe is: 18 (channel-symbols) x 64 (length of one channel-symbol) = 3456 bit. 

fig. 4 - repeated superframes in the Sync Section of the preamble

The lenght of the Sync Section superframes generates the 3456 bit period which is apparent in the bitstream of the preamble after its demodulation (fig. 5).

fig. 5 - 3456 bit period in the preamble due to the superframes length

data section

The data section exhibits ~426ms ACF spikes (fig. 6) that make a 6144-bit length period(!), corresponding to 2048 tribit symbols. The period does not have the Known/Unknown data structure, so mini-probes are not sent but rather the data symbols are sent continuously after the initial preamble: this means that the block #2 is the wavfeorm Id 0 and Walsh Orthogonal Modulation is used.

fig. 6 - ACF value measured in the data section

from D.5.1.2.3  (MIL 188-110C Appendix D):

Waveform ID 0 utilizes a different modulation technique, Walsh Orthogonal Modulation. For each pair of coded and interleaved data bits, the method produces a 32 symbol repeated Walsh sequence. The Walsh Orthogonal Modulation is accomplished by taking each pair of bits, or di-bit, and selecting a corresponding Walsh Sequence. The selected four element Walsh sequence is repeated 8 times to yield a 32 element Walsh sequence. For example, if the di-bit is 01, the sequence 0404 is repeated to generate the 32 symbol sequence:

0, 4, 0, 4, 0, 4, 0, 4, 0, 4, 0, 4, 0, 4, 0, 4, 0, 4, 0, 4, 0, 4, 0, 4, 0, 4, 0, 4, 0, 4, 0, 4

Processing the bitstream of the data section, we get a value of 6144 bit (fig. 7) that matches the ACF value obtained in fig 6:

fig. 7 - 6144 bit period of the data section

Why this 6144 bit? 

For the Walsh Orthogonal Modes (waveform id 0) the data scrambling implementation generates 256 x 8 = 2048 values and the scrambling sequences are continuously wrapped around the 2048 symbol boundary: ie just 2048 x 3 = 6144 bit and then the ACF of the data section is due to the scrambler lenght.

Athough data are modulated using Walsh ortogonal modulation, they are scrambled to appear on-air as the PSK-8 constellation seen in fig. 3.

MIL 188-110C App.D: BW3 KHz, SR2400 Bd, WALSH and PSK-8

Both the two signals A and B have the same duration and both have a long preamble-segment followed by the data-segment. The signals spread ~3KHz bandwidth and consist of a 1800Hz carrier with PSK-8 modulation at 2400 symbols/sec.

synchronization preamble segment

From MS188-110C App.D "The synchronization preamble is used for rapid initial synchronization and provides time and frequency alignment. The synchronization preamble shall consist of two main sections, a transmitter level control (TLC) settling time section, and a synchronization section containing a repeated preamble super-frame. The preamble super-frame consists of three distinct subsections, one with a fixed (known) modulation, one to convey a downcount, and one to convey waveform identification." The superframe shall be repeated M times. The Synchronization section shall be immediately followed by the modulated data (pic 1).

Pic. 1

Both the two sync preamble segments have the same lenght (~ 5 seconds) and the same ACF structure: 239.98 ms frame that makes 576 symbols or 1728 bits. 

From the 188-110C App.D documentation, the orthogonal Walsh modulation is used in the synchronization section of the preamble and the length of the super-frame is 18 channel-symbols, ie: 

9 (fixed) + 4 (downcount) + 5 (waveform identification)  

Since in 3KHz bandwidth waveforms the preamble channel-symbol is 32 symbol length (pic. 2), the length of each repeated superframe is: 18 (channel-symbols) x 32 (length of one channel-symbol) that makes the measured 576 symbols or 1728 bits (pic. 3). 

Pic. 2

Pic. 3

That's ok in pic.4, where the synchronization section of the two preambles exhibits a clear 1728 bit period length.

Pic. 4

data segment
The data segments have the same lenghts but different frame structures (pic. 5).
 

Pic. 5 - over-the-air bitstreams after removed the sync preamble

The frame structure for the signal-A waveform is the one shown in figure D-7 of Appendix D: the initial synchronization preamble is followed by frames of alternating data (unknown-data) and probe symbols (known-data):
 

After demodulating the signal the bistream analysis reveals a 288 symbols (or 864 bits) length frame, consisting of 256 unknown-data + 32 known-data (96 bits probe). This signal  meet the waveform ID-7 of the 3KHz bandwidth set (pic. 6)

Pic. 6a - WID-7 frame structure

Pic. 6b - WID-7 32 known-data (96 bits probe)

The signal-B waveform does not exhibit a data+probe structure but rather strong 853.4ms ACF spikes (pic. 7) that makes 2048 symbols/sec at 2400Bd speed or 6144 bits.  This signal meet the waveform ID-0, which uses a different structure after the synchronization preamble. Data “frames” are 32-symbol Walsh sequences (channel symbols), each corresponding to a single unknown (data) bit.

Pic. 7 - 2048 symbols ACF (~853.4ms) for the signal B

As shown in pic. 8 (after demodulating the signal-B) mini-probes are not sent in waveform 0, Walsh-coded data symbols are sent continuously after the initial synchronization preamble and the 2048 symbols (6144 bit) period is due to the scrambler lenght. For this waveform the data scrambling implementation just generates 256 x 8 or 2048 values and the scrambling sequences are continuously wrapped around the 2048 symbol boundary. Athough data are modulated using Walsh ortogonal modulation, they are scrambled to appear, on-air, as an 8PSK constellation.

Pic. 8 - WID-0 6144 bit period caused by the scrambler lenght

MS188-110B, Appendix C/D scrambler

Both the High Speed Waveforms (HSWF) and Wide Band HF Radio waveforms (WBHF), described first time in the Appendices "C" and "D" from the standard MS188-110B, use the same scrambler. Modems operating over multiple discrete channels (Appendix F) also use this same scrambler since they use the waveforms from Appendix C. The scrambling sequence generator polynomial is:

x^9 + x^4 + 1

and is initialized to 00000001 at the start of each data frame, i.e. each 256 transmitted symbols (data block lenght is the same in both the two waveforms families). The length of the scrambling sequence is 511 bits,  computed as the maximal number of its states excluding the all-zeroes state (2^9 -1). For a 256 symbol data block with 4 bits per symbol, this means that the scrambling sequence will be repeated about 2 times, while for 6 bits per symbol just slightly more than 3 times, although in terms of symbols there will be no repetition (pseudo-random generator). In other words, the scrambler is designed to not have auto-correlation property, contrary to what happens for the MS188-110A scrambler, as we saw here, where the scrambler produces a periodic pattern 160 transmit symbols (480 bits, since the PSK-8 modulation) in length that at certain data rate speeds affects the value of ACF. 

I do not want reinvent the wheel here but only practice of analysis, so I just looked for a confirmation of this behavior (and described below) by analyzing the bitstream produced by a software-scrambler that I wrote in Lua language for both PSK-8 and QAM-16 modulations, in the latter case I also examined a real-world QAM-16 signal to verify the lack of possible signs/repetitions caused by the scrambler.

PSK-8 modulation

For PSK-8 data symbols (3200 bps and 4800 bps), the scrambling shall be carried out taking the modulo 8 sum of the numerical value of the binary triplet consisting of the last (rightmost) three bits in the shift register, and the symbol number.  A block diagram of the scrambling sequence generator is shown in pic. 1, in this illustration, three output bits are shown: this is the case for PSK waveforms.

Pic. 1

After each data symbol is scrambled, the generator shall be iterated (shifted) the required number of times to produce all new bits for use in scrambling the next symbol, so will be 3 iterations for PSK-8. Since the generator is iterated after the bits are use, the first data symbol of every data block (256 symbols) shall, therefore, be scrambled by the appropriate number of bits from the initialization value of 00000001.

pic. 2

The sw-scrambler writes the scrambled symbols, ready to be sent to the PSK modulator, to the "scrambler-output.txt" file. Examining this bitstream (pic. 2) a 768 bits period is revealed and this lenght is exactly the lenght of the 256 PSK-8 symbols data block: there is no evidence of 511 bits cycle due to the scrambler.

QAM-16 modulation
The data symbols for QAM modulations shall be scrambled by using an exclusive or (XOR) operation: sequentially, the data bits forming each symbol (4 for QAM-16, 5 for QAM-32, 6 for QAM-64 and 8 for QAM-256) shall be XORed with an equal number of bits from the scrambling sequence (pic. 3).

pic. 3 - scrambler for QAM-16 modulation

After each data symbol is scrambled, the generator shall be iterated 4 times to produce all new bits for use in scrambling the next symbol. As said, since the generator is iterated after the bits are use, the first data symbol of every data frame shall, therefore, be scrambled by the appropriate number of bits from the initialization value of 00000001. I used a constant data symbol value (0110) just to highlight the behavior of the scrambler.

pic. 4 - running the sw-scrambler for QAM-16 modulation

The sw-scrambler writes the scrambled symbols to the "QAM-16-scrambler-output.txt" file. Examining this 5000 symbols bitstream (pic. 5) a 1024 bits period is revealed. As in the case of PSK-8 scrambler, this lenght is exactly the lenght of the 256 QAM-16 symbols data block: also in this case there is no evidence of 511 bits cycle due to the scrambler.

pic. 5

real-world QAM-16 signal

pic. 6a - real-world MS188-110C App.D signal

pic. 6b - MS188-110C App.D, QAM-16 ACF

As expected, the ACF returns a 120ms period (pic. 6) that makes 288 symbols length frame at 2400 Baud. Since the data block for QAM-16 modulation is always 256 symbols, it follows that mini-probes are 32 symbols lenght (waveform n.8 from Appendix D TABLE D- XI):

After demodulating the QAM-16 signal with SA, it was then converted into an ASCII-bit file by using a simple HEX2BIN converter also written in Lua: the output file was then analyzed using a bit-flow processor tool. 
The analysis of the bitstream reveals a strong 1152 bits period that is exactly what is expected for the 4-bits symbols WBHF waveform (pic.7):

pic. 7

data-block: 256 symbols = 1024 bits
mini-probe: 32 symbols = 128 bits
frame (data-block + mini-probe): 288 symbols = 1152 bits
and in terms of symbols, there are no repetition caused by the scrambler (no auto-correlation property).

The same scrambling sequence generator polynomial x^9 + x^4 + 1 is also used in STANAG-4285 waveform (see Annex-A to STANAG-4285) but with a different inizialization vector (see the picture below and pic. 1):

and the results are obviously the same, the bit flow processor only detects the expected 768 bits period: