LINK-11 SLEW, transmission format

The SLEW waveform transmission format consists of an acquisition preamble followed by two or more fields, each field followed by a reinsertion probe. 

The first field immediately following the preamble is the header field and contains information that is used by the Combat Data System (CDS) and the encryption device. If a network PU (Partecipating Unit) has data to transmit, successive data fields follow the reinsertion probe of the preceding fields. These data fields consist of track data and other user data. The last field to be transmitted is the end-of-message (EOM) field. The transmission ends with a reinsertion probe.

Fig. 1

Data are accommodated using 3 different types of fields: header field, CDS data field and EOM field. The acquisition preamble, a very interesting topic, will be discussed in a next post.

The structure of the header field  consists of 33 data bits appended with 12 error detection bits,  H(45,33). The 45 bit sequence is encoded with a 1/2 rate error correction code resulting in a 90 bit field. The header field contains information to define (Figure 2): 

the transmission type T (1 bit),

the Picket address ADDR (6 bits), 

the KG-40 24-bit Initialization Vector (MI), 

the NCS/Picket designation N (1 bit),

a spare field SP (1 Bit).

Fig. 2 - Link-11 SLEW header field

The transmission type (T) indicates the format of the transmission to follow: is set to 0 to indicate an NCS Interrogation Message (IM) and is set to 1 to indicate a NCS Interrogation with Message (IWM) or a Picket reply transmission (the term picket indicates a PU on the network that is not the NCS).

The KG-40 Initialization Vector (IV) subfield contains the sequence generated by the KG-40 crypto device. Cryptographic synchronization is achieved when the receiver acquires the correct IV. Since 24 bits is the length used by the Golay code, I tried to verify if the KG-40 IV was really coded using the extended Golay (24,12) ...but without success. For an NCS interrogation transmission (tramission type subfield = 0), this subfield will contain all zeros since no message is carried.

The address subfield  ADDR contains either the address of the next Picket to be interrogated or the address of the Picket that initiated the current transmission: note that only Pickets addresses are exposed.

The NCS/Picket designation (N)  identifies whether the current transmission originates from the NCS or from a Picket: 0 indicates an NCS transmission, 1 indicates a Picket transmission.

The structure of the CDC data field consists of 48 data bits (two standard 24 bit CDS frames seen in CLEW waveform) appended with 12 error detection bits - H(60,48) - that are encoded with 2/3 rate error correction code resulting in a 90 bit data field. 
The EOM field is used to indicate the end of the transmission and consists of a sequence of 90 bits. No error detection or correction bits are applied to this field. The sequence depends on the unit that is transmitting:
An EOM from the NCS is a 90 bit sequence of all “0”
An EOM from a Picket is a 90 bit sequence of all “1”

Below an example where all the SLEW fields are visible:

100101000110111110001110000011111 000001111100
100010100010001011000001101110010000101011110011 011001011010
111000010110000011110010111001001000000001110000 111100101001
011000001000110111001101100000001100011010110011 001111011101
111001010110100001101001111101011000101011010100 001110110011
111111111111111111111111111111111111111111111111

100101010001100001001000111101001 001101011111
111111010001010101000001001101001111111111101001 001110110000
000111000100111011000110010010001001111110011110 100010111111
001100111011011100100100010000110000001100101110 011101010010
111001100100110100111100010001100010100100011101 100100001111
000000000000000000000000000000000000000000000000

100101001110110010000010101000011 001111010111
100101110000001100001111011000110111011101110111 001111001101
110011011001010000111110011001100101100111110000 011111110010
000111101110101111010000101001011010010100010010 010100001110
100011010110110101111100001110111000011011111010 100010011011
111111111111111111111111111111111111111111111111 

It's interesting to analyze the headers related to the SLEW transmissions shown in Figure 3 

Fig. 3 - SLEW transmissions headers

In all the headers the transmission type subfields (T) are set to 1 to indicate that the following data sub-fields are NCS transmissions or Picket reply transmissions.
In the first header the NCS/Picket designation subfield (N) is et to 0 to indicate an NCS transmission: in this case the 6-bit subfield address identifies the address of the Picket to be interrogated (010100). In the second header the NCS/Picket designation is set to 1 to idicate the Picket reply transmission: in this case the 6-bit address identifies the address of the Picket which initiated the transmission (010100). You may check that the other headers are interpretable in the same way. So, the headers indicate a series of IWMs and replies between the NCS and the Picket station addressed by 010100. 

LINK-11 SLEW, Systematic CRC check matrix

In Link-11 SLEW the error detection encoding is applied to all 48-bit data words within each type of field with the exception of the EOM field. The encoding scheme uses Cyclic Redundancy Check (CRC) H(60,48) which is generated using a 12-bit Shift Register defined by the polynomial x¹² + x¹⁰ + x⁸ + x⁵ + x⁴ + x³ + 1, and producing the Link-11 SLEW 60-bit (48+12) encoded frames.

Quoting STANAG-5511 Annex-B §11.1.1.1 "The data is shifted serially into the Shift Register starting with the most significant bit (MSB) until the least significant bit (LSB) has been applied to the input stage of the Shift Register. This accomplishes a division of the data by the polynomial that defines the Shift Register. The remainder of the division is represented by the values in each stage of the Shift Register: these 12 values are appended to the data bits as parity, creating a systematic code".

Systematic codes have the advantage that the parity data can simply be appended to the source block, and receivers do not need to recover the original source data if received correctly since they are located in the leftmost bits of the received data (this explains because systematic code is also called “Separable”). The standard CRC encoder is different from the Systematic CRC encoder in the way the encoded word is calculated, therefore the data bits cannot be separated from encoded word before decoding takes place. 

In my opinion, actually STANAG-5511 seems to describe the "systematic CRC decoder" rather than the "systematic CRC encoder": indeed, the decoder just works by getting the input encoded word, which might contain errors, and dividing it by the generator polynomial to get the remainder (i.e. calculating E(x) mod G(x) and getting R(x)). If remainder of division is zero then the encoded word has no errors, otherwise error is detected with a non-zero remainder [1]. 

That said, the systematic generator matrix is obtained by selecting as rows the codewords associated with the 12-bit fields 100000000000, 010000000000, ..., and 000000000001. Well, my friend cryptomaster worked on the 4095-bit maximum-length sequence produced by the generator polynomial x¹² + x¹⁰ + x⁸ + x⁵ + x⁴ + x³ + 1 obtaining the 12-row 60-column parity-check matrix that is shown below

                                
111100110100011000110111111001001001110101100010 100000000000
011110011010001100011011111100100100111010110001 010000000000
110011111001011110111010000111011011101000111010 001000000000
111001111100101111011101000011101101110100011101 000100000000
100000001010001111011001011000111111001111101100 000010000000
110000000101000111101100101100011111100111110110 000001000000
011000000010100011110110010110001111110011111011 000000100000
010000110101001001001100110010001110001100011111 000000010000
110100101110111100010001100000001110110011101101 000000001000
100110100011000110111111001001001110101100010100 000000000100
110011010001100011011111100100100111010110001010 000000000010
111001101000110001101111110010010011101011000101 000000000001

If an error is detected with a non-zero remainder, the error can be corrected just using the check matrix. 
Code verification is carried out by comparing each line of encoded data in turn with all rows of the check sub-matrix: the vertical correspondences of the "ones" locations in the encode line and in the row #n of the check sub-matrix are counted. If the matches are even then the CRC bit #n will be "0", otherwhise (ie matches are a odd number) the CRC bit #n will be "1".

Let's try a verification for the first 48-bit data in Fig.1

Fig. 1

48-bit data                                                                    12-bit CRC
111011100101011011110011001001101010001000010100 011000011001
111100110100011000110111111001001001110101100010 check sub-matrix row #1
14 matches (even), CRC bit value: 0

111011100101011011110011001001101010001000010100 011000011001
011110011010001100011011111100100100111010110001 row #2
11 matches (odd), CRC bit value:  1

111011100101011011110011001001101010001000010100 011000011001
110011111001011110111010000111011011101000111010 row #3
17 matches (odd), CRC bit value:  1

111011100101011011110011001001101010001000010100 011000011001
111001111100101111011101000011101101110100011101 row #4
16 matches (even), CRC bit value: 0

111011100101011011110011001001101010001000010100 011000011001
111001111100101111011101000011101101110100011101 row #5
16 matches (even), CRC bit value: 0

111011100101011011110011001001101010001000010100 011000011001
100000001010001111011001011000111111001111101100 row #6
12 matches (even), CRC bit value: 0

111011100101011011110011001001101010001000010100 011000011001
011000000010100011110110010110001111110011111011 row #7
10 matches (even), CRC bit value: 0

111011100101011011110011001001101010001000010100 011000011001
010000110101001001001100110010001110001100011111 row #8
11 matches (odd), CRC bit value:  1

111011100101011011110011001001101010001000010100 011000011001
110100101110111100010001100000001110110011101101 row #9
11 matches (odd), CRC bit value:  1

111011100101011011110011001001101010001000010100 011000011001
100110100011000110111111001001001110101100010100 row #10
16 matches (even), CRC bit value: 0

111011100101011011110011001001101010001000010100 011000011001
110011010001100011011111100100100111010110001010 row #11
12 matches (even), CRC bit value: 0

111011100101011011110011001001101010001000010100 011000011001
111001101000110001101111110010010011101011000101 row #12
13 matches (odd), CRC bit value:  1

as expected, the 12-bit CRC added to the first 48-bit frame is: 011000011001.

If you want try by yourself, the last 60-bit sequence consisting of all "ones" could be a segment of the picket EOM and no error detection or correction bits are applied to this field! (Link-11 fileds will be treated in a next post).
Notice that Link-11 SLEW uses also 1/2 rate and 2/3 rate convolutional encoders to improve the reliability of the system, while CLEW does not use convolutional encoders and employs Hamming (30,24) encoding with the overall parity bit:
https://i56578-swl.blogspot.com/2018/08/link-11-clew-hamming-check-matrix.html 

That said, and if me and cryptomaster are right, STANAG-5511 is not so clear in the pages related to CRC Data Encoding.

⬇ https://yadi.sk/d/C-GO-nbl3aBYKr
⬇ https://yadi.sk/d/l_2IQJrP3aBYbV

[1] http://www.ecs.umass.edu/.../SystematicCRChelp.html

LINK-11 CLEW, doubts about the generator polynomial x^5+x+1

I have some doubts about the description at page 19 of MIL 188-203-1A (Tadil-A/Link-11) [1]: the document states that the Start Code and the Address Code frames " [...] are equivalent to 60-bit portions of the maximum-length shift register sequence with generator polynomial G(x) =  x⁵+x+1" ...but such a fifth grade polinomyal has a maximum length sequence (MLS) of 31 bits (2⁵-1). Indeed, I found the generator polymonial x⁶+x+1, whose MLS is 63, for both start and address frames:

 

111100101000110000100000111111
101100110111011010010011100010
100001000001111110101011001101
110100100111000101111001010001

Using a GNU Octave script [2] I also checked the three fundamental properties of LFSR maximum length sequences: Balance Property, Runlength Property, and Autocorrelation Property [3]: verification fails for x⁵+x+1

• The Code does NOT satisfy Balance Property: number of 1s and 0s are 17 14
• The code does NOT satisfy RUN LENGTH property: the run length is 10    2    1    1    2
• The Code does NOT satisfy the Autocorrelation Property

  while verification is ok for x⁶+x+1 

• The Code satisfies Balance Property: number of 1s and 0s are 32 31
• The code satisfies RUN LENGTH property: the run length is 16    8    4    2    1    1
• The Code satisfies the Autocorrelation Property

So I do not know if I'm wrong or if there's a typo in 188-203-1A, comments are welcome.

[1] https://www.sigidwiki.com/wiki/File:MIL-STD-188_203-1A.pdf

[2] https://github.com/Nikeshbajaj/Linear_Feedback_Shift_Register 

[3] https://en.wikipedia.org/wiki/Maximum_length_sequence 
 

LINK-11 CLEW, Hamming check matrix

The check of a Link-11 CLEW stream discussed in the end part of this post, can be speed up by using the Hamming parity check matrix for the H(30,24) coding, ie a 30-bit code word consisting of 24 bits for data + 6 bits for Hamming parity bits (termed EDAC in Link-11 literature). The check matrix is constructed as shown in MIL 188-203-1A #5.2.4.1 and here.

 

Code verification is carried out by comparing each line of code in turn with all rows of the parity check matrix, except the extra parity line (the overall parity bit): the vertical correspondences of the "1" locations in the code line and in the row #n of the check sub matrix are counted. If the matches are even then the correspondent location #n in the EDAC bits will be "1", otherwhise (ie matches are a odd number) will be "0" (odd parity).

 

 

  EDAC           data
110100 000001110101110001100010
010011 111001110010010001111011
110100 111100101110010110011111
100100 010111010000110110000110
010010 011010000000010100100111
110001 010001110110000010010000

     check sub-matrix           identity sub-matrix
111111111111100000000000 010000
111111000000011111110000 001000
110000111100011110001110 000100
001100110011011001101101 000010
101010101010110101011011 000001
111111111111111111111111 111111

Test the first line of code 000001110101110001100010

000001110101110001100010
111111111111100000000000 check matrix line #0
6 matches, EDAC bit #0 shall be 1

000001110101110001100010
111111000000011111110000 check matrix line #1
4 matches, EDAC bit #1 shall be 1

000001110101110001100010
110000111100011110001110 check matrix line #2
5 matches, EDAC bit #2 shall be 0

000001110101110001100010
001100110011011001101101 check matrix line #3
6 matches, EDAC bit #3 shall be 1

000001110101110001100010
101010101010110101011011 check matrix line #4   
5 matches, EDAC bit #4 shall be 0

EDAC bits 0-4: 11010

Test the second line of code 111001110010010001111011

111001110010010001111011
111111111111100000000000 check matrix line #0
7 matches, EDAC bit #0 shall be 0

111001110010010001111011
111111000000011111110000 check matrix line #1
8 matches, EDAC bit #1 shall be 1

111001110010010001111011
110000111100011110001110 check matrix line #2
7 matches, EDAC bit #2 shall be 0

111001110010010001111011
001100110011011001101101 check matrix line #3
9 matches, EDAC bit #3 shall be 0

111001110010010001111011
101010101010110101011011 check matrix line #4   
10 matches, EDAC bit #4 shall be 1

EDAC bits 0-4: 01001

The verification of the remaining combinations confirms the use of the same method of checking (if you want, you can check it yourself).

If only one error is detected, it is corrected and sent to the computer. The computer is also advised that the word contained an error and that it is corrected. If two errors are detected the Hamming decoding can only determine that errors exist but cannot determine which bits are in error.

LINK-11 CLEW, conventional waveform

The 16 tone frequencies used by CLEW are 605 Hz (used for Doppler correction), 2915 Hz (used for data and synchronization) and 935, 1045, 1155, 1265, 1375, 1485, 1705, 1815, 1925, 2035, 2145, 2255, and 2365 Hz. All information is conveyed by DQPSK modulation at symbol rate of 75 or 45.45 Baud of the 15 data subcarriers tones (Doppler tone remains unmodulated), each of the tone represents 2 data bits and then resulting in a total of 30 data bits consisting of Control Code frames and Data Message frames(M-series messages). The tone at 935 Hz corresponds to bit locations 0 and 1, last tone at 2915 corresponds to bit locations 28 and 29.

Sometimes you may see CLEW using simultaneously the USB and LSB (ISB): indeed, identical signals are transmitted on in ISB and at the receiver both the sidebands will be separately and independently deodulated.  A means is provided to allow operator selection of USB, LSB or the diversity operation (DIV) modes:

• DIV: data words derived from the diversity combination of the USB and LSB will be provided to the tactical computer. This mode of operation is used to help combat multipath interference.
• Automatic: the receiving station automatically selects the version that represents the best information available from the USB, LSB or DIV version of the received data word.

When the criteria do not establish a clear choice, the DIV version is selected.  

The three control codes which are used to operate a Link-11 net are the Start Code, Stop Code, and Address Code, each consisting of two encoded 30-bit frames. The Start Code is the first two frames of the transmitted data message while the two frames Stop Code immediately follows the last message frame to signify the end of the data. There are two stop codes according to the transmitting station: Control Stop Code (transmission from the data net control station, or DNCS) is a 2 frames consisting of all "zeros", and Picket Stop Code (transmission from a picket station) which consists of a 2 frames consisting of all "ones". 

The Start Code is the first two frames of the transmitted data message while the two frames Stop Code immediately follows the last message frame to signify the end of the data. There are two unique stop codes according to the transmitting station:

• Control Stop Code (transmission from the data net control station, or DNCS) is a 2 frames consisting of all "zeros",
• Picket Stop Code (transmission from a picket station) is a 2 frames consisting of all "ones".

Each net partecipating unit is identified by the Address Code which immediately follows the Control Stop Code if the DNCS transmits data.

Fig. 1 - Link-11 data segment

The Data Message frames (Figure 2) follow the Start Code and contain tactical information. Each Data Message frame consists of 30 bits composed of a 24-bit word provided by the tactical computer and 6 Hamming parity bits (bit locations 24 through 29) provided by the modem. The Hamming parity bits are used by the receiver modem for error detection and correction, for this reason they are also refferred to as EDAC bits. Only Data Messages contain Hamming parity bits: Start, Stop, and Address codes are not Hamming parity encoded.
Notice that the 24-bit words may be optionally encrypted using KG-40 crypto device which just sits in midlle between tactical computer and modem. 

Fig. 2 - Link-11 Data Message frames

The six EDAC bits are encoded as follows:

• Bit 29 is set such that when added to bits locations in 11 through 23, the number of ones will be an odd number;
• Bit 28 is set such that when added to bits locations in 4 through 10 and 18 through 23, the number of ones will be an odd number;
• Bit 27 is set such that when added to bits in locations 1,2,3,7,8,9,10,14,15,16,17,22, and 23, the number of ones will be an odd number;
• Bit 26 is set such that when added to bits in locations 0,2,3,5,6,9,10,12,13,16,17,20, and 21, the number of ones will be an odd number;
• Bit 25 is set such that when added to bits in locations 0,1,3,4,6,8,10,11,13,15,17,19,21, and 23,the number of ones will be an odd number;
• Bit 24 is set such that when all the bits of the frame are added, the number of ones will be an odd number. Bit 24 is called the overall parity bit. 

Figure 3 shows a check of the first six 30-bit frames of the Data Message in Fig.2

Fig. 3

Link-11 SLEW: scrambler length and ACF value

TADIL-A/Link 11 is a secure half-duplex TADIL radio link used by US and NATO that receives or transmits --but not both simultaneously-- a sequential data exchange digital link.  It exchanges digital information among airborne, land-based, and ship-board tactical data systems. It is the primary means to exchange data such as radar tracking information beyond line of sight.
LINK-11 comes in two waveroms: the original Conventional  Link  Eleven  Waveform (CLEW) and Single (serial) tone Link Eleven Waveform (SLEW).

Single tone Link Eleven Waveform (SLEW) is one of the modes defined within the Link 11 NATO standard. For SLEW, a single analog waveform is generated for the upper side band, the PSK-8 modulation process is achieved by assigning the tri-bit numbers from the scrambler to 45-degree phase increments of a 1800 Hz carrier. Symbols rate is 2400 Bd while the user data rate is 1800 bps (pic. 1).

pic. 1

The SLEW waveform transmission format consists of an acquisition preamble followed by two or more fields. Each 45 symbols field is followed by a 19 symbols reinsertion probe. The first field  after the preamble is the header field and contains information that is used by the Combat Data System (CDS) and the encryption device. If there are data to transmit, successive data fields follow the reinsertion probe of the preceding fields (pic. 2,3).

pic. 2 SLEW waveform structure

pic. 3

Running the Cross Correlation or Auto Correlaton functions, a 64 symbols or 192 bits frame are expected, but in contrast the CCF output exhibits clear and strong 320 symbols spikes corresponding to a period of 960 bits. Note that five data and reinsertion-probe pairs are arranged inside the period window (pic. 4).

pic. 4 - SLEW waveform CCF result (133.33ms)

So, why the 133.33ms, or 320 symbols, period?

As in pic. 5, the 45 phase encoded pairs (values 0, 1, 2, 3) are mapped into tri-bit numbers (by multiplying by 2).  The tri-bit numbers (0, 2, 4, 6) are used for symbol generation and scrambled  to take on all 8 phase states. During the reinsertion probe, 19 tri-bits (set all to "000") are used for known symbol formation and scrambled.

 

pic. 5 - SLEW wavefrom formation (reinsertion probe and data field)

Since the scrambler could be an important factor in ACF generation, let's give it a close look: it's worth to noting that the data sequence randomizing generator is the same 12-bit shift register used in MS188-110 serial tone!

"The tri-bit numbers supplied for the symbols (both data and probe) are modulo-8 added to a three-bit value supplied by the data sequence randomizing generator. At the start of the data phase, the shift register is loaded with the initial pattern 101110101101 (binary) or BAD (hex) and advanced 8 times. The resulting three bits are used to supply the scrambler with a number from 0 to 7 which is modulo-8 added to the data/probe symbol. The shift register is shifted eight times each time a new three-bit number is required (every transmit symbol period). After 160 transmit symbols, the shift register is reset to BAD (hex) prior to the eight shifts."

As seen in MS188-110 low data rates, this 12-bit randomizing generator is the cause of the Link-11 SLEW ACF.

In fact, since the scramble length of 160 symbols coincides with 2.5 frames, we get that each five frames - or just two scramble cycles(!) - the same probe value "000" is scrambled exactly after the same number of shifts and hence produce the same probe patterns (pic. 6). These same patterns repetion produces the 320 symbols (or 960 bit) spikes in CCF and ACF function.

pic. 6 (qualitative rapresentation, not in scale)