unid datalink protocol(s) over a PSK8 ST and STANAG-4539 (2)

I had the opportunity to record other transmissions on 3712.70 KHz/USB and - also following the comment of my friend KarapuZ - I can state with reasonable certainty that the waveforms analyzed in the previous post [1] come from Thales equipment. 
As mentioned, both Thales and L3Harris use the GMSK-MFSK8 waveform to handle HF links but the L3Harris bitmap/bitstream have a very recognizable pattern that is not present in the bursts recorded today (Figs 1,2): therefore, the GMSK-MFSK-8 signal is the Thales Systeme-3000 "Skymaster ALE", used in TRC-3500 and TRC-3600/TRC-3700 series radios (HF 3000 family).

Fig. 1 - Thales Systeme-3000 GMFKS+MFSK8

Fig. 2 - Thales Systeme-3000 GMFKS: bitstream after differential decoding and 50ms bitmap

As you see in Figure 2, I used the OQPSK "view" to demodulate the preamble of the Skyaster ALE signal: however, the differential decoding clearly show a 2-state keying (precisely GMFSK) that can be demodulated also using the "classic" FSK approach (Figure 3).

Fig. 3 - use of the SA MFSK dem

For what concerns the two PSK8 Serial Tone waveforms A & B [1], they also could be proprietary ones (Thales); indeed, quoting TRC-3600 datasheet: "Thanks to its digital advanced technology, the TRC 3600 offers new embedded services: secure high data rate and digital voice transmissions. It integrates a high data rate, multiwaveform, single tone modem (from 75 to 5400 bps) and a vocoder (800 - 2400 bps) associated to a high security digital COMSEC chip". 

The data link protocol could be the digital voice vocoder (new MELP/LPC10), given the similarity of the bitstream with its L3Harris analogue, but that is just an unconfirmed hypothesis of mine.

Fig. 4 - bitmaps of the two PSK8 ST waveforms

 

 https://disk.yandex.com/d/6NK6xYRAWzjzEw

 [1] http://i56578-swl.blogspot.com/2024/04/unid-datalink-protocols-over-psk8-st.html

Thales mixed-mode traffic

Just a couple of comments about the different waveforms that can be seen when analyzing traffic exchanges performed using Thales equipment. 

1. As you see in Figure 1, after the proprietary Systeme-3000 Skymaster ALE, data are transferred using STANAG-4285 FEC and the HDR Single Tone waveforms (both proprietary) and even STANAG-4539. That's a bit unusual since, once link negotiation is complete, the  selected traffic waveform shall remain the same during that link session (apart FEC coding, interleaver and data rate).

Fig. 1

The order in which the different waveforms appear does not seem "formalised", probably it's due to the adaptive feature of the modem - which therefore adopts different data rates and waveforms - or it's in some way "announced" during the link negotiation. In this regard, the "dual demodulation state" comes to mind, a characteristic of 3G-ALE indicated in STANAG-4538: ie, the nodes partecipating in packet data type links do not expect a same waveform and are ready to demodulate  specific xDL waveforms. Looking at Figures 1,2, it seems that shall nodes be required to simultaneously demodulate at most four waveforms within the same logical link, ie they look for STANAG-4285 FEC and HDR ST (Thales proprietary) or NATO STANAG-4539, and obviously the ALE waveform signaling the link terminate. I don't know how this happens but I would guess the ALE phase announces what waveforms will be used.

Fig. 2

2. As from STANAG-4539 #4.3.1.1, the synchronisation preamble consists of two parts. The first part consists of at least N blocks of 184 8-PSK symbols to be used exclusively for radio and modem AGC (also known as TLC section). The value of N is configurable to range from values of 0 to 7. The second section consists of 287 symbols. The first 184 symbols are intended exclusively for synchronisation and Doppler offset removal purposes while the final 103 symbols also carry information regarding the data rate and interleaver settings. The total duration of the sync preamble as a function of the number N is shown in Table I.

Table I - sync preamble duration Vs N (at 2400 Bd)

In all the recordings at my disposal I noticed the same duration of the synchronisation preamble, i.e. 349.5 msec which correspond to N = 3 or three 184 symbols blocks for the TLC section (Figure 3): this - of course - is just a mere common peculiarity but which at least so far has not been denied in similar recordings (Thales). Other S4539 recordings I have analyzed have different preamble sync lengths. As specified above, the value of N is configurable, however it is not clear if this parameter is accessible to the operator or if it is a factory setting (however modifiable).

Fig. 3 - some Thales STANAG-4539 synchronisation preambles

Thales engineers certainly have the ability to modify the STANAG-4539 preamble, as in the case of the extended preamble employed in their Salamandre HFXL waveforms, however even military grade modems such as the Harris RF-5710A are able to recognize and demodulate these S4539 bursts, assuming that the data rate and interleaver settings values that are "read" by the modem are actually the exact ones. 

Fig. 4 - my Harris RF-5710A working Thales mixed-mode recordings

Such further recordings and comments are very welcome.

https://disk.yandex.com/d/yHtrobzZUhB2yA
 

Thales HDR Single Tone modem? (TRC-3600/3700 family)

 

I rcently spent a bit of time monitoring the data transfer sessions which frequently happen on 6478.0 KHz/usb in ARQ mode. As usual, transfers start with the link setup stage: the particular and distinguishable shape of the ALE burts makes it possible to identify the Thales Systeme-3000 Skymaster ALE. The initial part of the ALE burts is SDPSK (Symmerical Differential PSK) modulated at 2000 Baud speed with a carrier frequency of 1600 Hz; as you see, transitions do not traverse the origin and the information is stored in the transitions and not in the states (figure 1). The initial part is followed by short MFSK-8  125 Baud segment that is not compatible with MS 188-141 2G-ALE although the scope be the same (they use different tones library).

Fig. 1 - Systeme-3000 Skymaster ALE

The SDPSK part exhibits a 50ms ACF that corresponds to a 100-bit frame (figure 2)

Fig. 2

Data bursts are PSK-8 modulated at a symbol rate of 2400 Bd and exhibt a 106.6 msec ACF (corresponding to 256 symbols) but adopt diferent frame structures: likely it's due the the adaptive feature of the modem which therefore adopts different data rates and waveforms (figs 3,4).

Fig. 3

Fig. 4

The presence of the Systeme-3000 ALE bursts - and thus a Thales proprietary waveform - suggest that the 2440Bd/PSK8 waveforms (used for data) are sourced by the High Data Rate modem incorporated into the TRC-3600/3700 family of combat radios. Quoting TRC-3600 datasheet: "It integrates a high data rate, multiwaveform, single tone modem (from 75 to 5400 bps) and a vocoder (800 - 2400 bps) associated to a high security digital COMSEC chip. The performances of the modem, the use of powerful error correction codes and the use of real time adaptive procedures enable to offer reliable HF links even on a severely degraded ionospheric path. The links are automatically optimized in real time according to the possibilities of the HF channel".

...and yes, yet another 106.6 ms ACF waveform.

 https://disk.yandex.com/d/GAB7inxTA7-QWw

THALES Skymaster, "skyhopper" mode

This is a fairly comprehensive list of the ALE waveforms provided by Thales' Systeme 3000 Series Skymaster and Skyhopper Modes, a set of procedures and adaptive waveforms that allow to offer reliable and real-time optimized links even in degraded ionospheric conditions of the HF channel. All the signals, kindly sent me by my friend ANgazu, belong to the same session, even if the recording is edited in the time axis. These Thales proprietary waveforms are used in TRC-3500/TRC-3600 and TRC-3700 series transceivers.

The first two parts are the Skyhopper mode, an intelligent frequency hopping and automatic hop band selection; the signals consist of a series of 40 ms MFSK-8 125 Bd bursts (figure 1) and 50 ms GMSK / OQPSK 200 Bd bursts (figure 2). It's interesting to notice that the MFSK-8 burst actually use 5-out-of-8 tones of the Skymaster ALE waveform (see the comparison in Figure 1 below).

 

Fig. 1 - MFSK-8 125Bd/250 (actually 5-out-of-8 tones)

The following 50 ms bursts, below in figure 2, are of difficult analysis given their duration and the used modulation, friends of  radioscanner suggest OQPSK modulation.

Fig. 2

The third part is the "classic" GMSK/OQPSK 2000 Bd & MFSK-8 125 Bd/250 part, see figure 3.

 

Fig. 3

The initial GMSK/OQPSK part has a 50 ms ACF that corresponds to a 100-bit frame: the waveform is similar to Harris RF-5800 selective call (figure 4).

 

Fig. 4 - framing' comparison of Thales (up) and Harris (down)  ALE

 

https://disk.yandex.com/d/owrO7l3R0MKEFQ

THALES XL modem, channels time lag

 

Thales HF XL SALAMANDRE (1) test transmissions spotted by my friend Geoff (who kindly sent me his recordings) on the upper limit of the 6 MHz band. In these tests the modems are able to use 16 contiguous 3 kHz channels with 2 KHz spacing and occupies a bandwidth of about 80 KHz. As a rule, two stations are used. 

Each transmitted burst consists of an initial XL synchronization preamble (2), followed by 9 frames of alternating data and known symbols. Each data frame consists of a data block consisting of 256 data symbols, followed by a mini-probe consisting of 31 symbols of known data, as per STANAG-4539 (188-110C Ap.C).  All the sixteen channels use PSK8 modulation at the symbol rate of 2400 Bd, user data rate is measured as 3200 bps with Very Short interleaver. Figure 1 shows the analysis of the upper channel and the Thales 124-symbol length extended preamble.

 

Fig. 1

 

A necessary foreword to understand how XL modem works. From what is possible to know from public documents available on the web, the XL multi narrow band (MNB) waveform is implemented by a multithread software running in a Linux PC (figure 2): "[...]The input stream is coded, interleaved and sent to different individual modulators having different data rates, each attached to a single channel. The modems outputs are combined in a frequency division multiplex and then the composite signal modulates the HF radio" (3).

 

Fig. 2 - multi-narrow band “XL” modem approach (Thales - HFIA meeting, San Diego Jan. 31th, 2013)

I realized that, modifying the FFT values, it turns out that the 16 channels do not come out at the same time but rather sequentially; more precisely, by filtering the intermediate channels, it is possible to measure a time lag of 3200 μs between the first and the 16th channel (figure 3). Likely, the parallel to serial buffer at the receive modem shall cancel that delay.

 

Fig. 3

 

Assuming that the XL modem  approach of figure 2 is still used today, I wonder if that time lag - unless it's a something like a required feature - is due to the context switching between the threads, ie between the software-defined  modems. I think that the initial de-multiplexing is irrelevant, since it will start to feed the n modems after the sync preambles have been formed, ie the symbols that are transmitted first are those of the n TLC/AGC sequences.  

Since the process spawns as many threads as the channels to be used,  the time delay is expected to decrease as the number of channels decreases: and indeed that's what happens in case of use of 12 and 9 channels (figure 4).

Fig. 4

I want to say that it's just a my guess and it relies either on the accuracy of SA measurements and the modem approach of figure 2: obviously more samples are needed to support my guess; unfortunately, both for the very nature of these transmissions (trials) and for the difficulty in having broadband recordings, it is a bit difficult to recover/find similar files to be analyzed. It would be great if someone from Thales would came across this post and would shed a light on this behavior.

 

As a final note, since 16 is the maximum number of channels the XL modem can allocate (figure 5), the one shown above is definitely the best performance possible in terms of used bandwidth: that is, 16 contiguous channels in only 80 KHz; but - at the same time - it is also the worst case when considering the total time delay between the limit channels. 

Fig. 5

https://disk.yandex.com/d/WyHqZXAy3yzu1w 
https://disk.yandex.com/d/RsIhraUOmlHaWA

(1)  Système Avancé pour Liaisons HF Adaptatives Multi-bANDes Rapides et Efficientes (adaptable, bandwidth-efficient, multi-band high-speed and high-frequency communication system)

(2) The synchronization preamble consists of three parts:
- a Transmitter Level Control / Automatic Gain Control (TLC/AGC) sequence, including an optional sequence to provide offset between channels;
- the main synchronization preamble, compatible with STANAG 4539 preamble;
- an extended synchronization preamble, specific to HF XL.
This last part, not included when operating according to 4539 or ISB modes, is combined with the main preamble to carry all information necessary to the HF XL waveform, in particular information on modulation choice for each channel. 

(3) HF XL: ADAPTIVE WIDEBAND HF TRANSMISSIONS - NordicHF 2013

THALES HFXL, "wide band link" phase? (tentative) AngazU, i56578

In our recent THALES HFXL monitorings we noted an initial "leader" burst which is exchanged in each frequency of the channel between the peers, the exchanges occurs after the 2G-ALE phase and just before the traffic starts: in our guess it appears to be the "wide band link", i.e. the third step of the HFXL link establishment procedure.

The used waveform is the same of HFXL-S4539: you may note the presence of the Thales "extented" preamble in Fig. 1

Fig. 1 . the presence of the THALES extened preamble following the S4539 normal preamble

It's interesting to note that after removing the mini-probes, the data blocks symbols show a regular structure of 768 bits (!), i.e. the 256 tribit data symbols of the S4539 framing appear as composed of repeated sequences/data; indeed, such a perfect 768-bit period does not occur in cases where user data such as chat, HTML, FTP, emails,... are sent. The presence of such repetitions is also clearly visible at a glance in the bistream (Fig. 2).

Fig. 2

Another clue in favor of repeated sequences in the data blocks is the ease with which the autocorrelation of 27648 bits is detected (Fig. 3): that's the length of the inteleaver block and just thanks to repeated data that it's possible to mark it. Also, the strong result of the autocorrelation leads to think of the use of Walsh Orthogonal Modulation, although it's not provided in S4539. Indeed, the detection of the interleaver length is facilitated because the last di-bit in any interleaver block is identified by the use of alternate set of Walsh sequences.

Fig. 3 - result from the autocorrelation

AngazU edited a header to eliminate the miniprobes (roughly)  and the resulting ACF is 26.6 ms considering both polarities and 13.3 ms considering only one. This indicates that it could be a walsh code of 32 symbols that is repeated inverted (Fig.4): 64 (32+32) symbols lasting ~26.6ms makes a data rate of 2400 Baud.
But be careful, it's just a speculation! We'll need a good quality recording to demodulate it and to verify it at  bit level.

Fig. 4

From the above, we think that the initial bursts use Walsh modulation and are used as a negotiation phase before the traffic starts: possibly we are facing with the "wide band link" (Fig. 4) that makes use of the "Cognitive Engine" software during the link establishment procedure, taking into account information on MUF, requested SNR, noise level, propagation modes, antenna performances.

As said, the above are only our hypotheses, we do not yet have any confirmation of them. Comments are welcome.

Fig. 4 - HFXL link establishment procedure

 https://yadi.sk/d/GnqkH_t_ua44-w

THALES mention

happy to be mentioned by THALES in their HFXL modem "Sea Trials" presentation during the last HFIA meeting in Kjeller Norway on 8 September 2017. Thanks to Catherine LAMY-BERGOT, from THALES, who kindly asked the permission to use the material from my blog.
The whole presentation HFXL Sea Trials on French BPC, as well as other works, can be downloaded from here:
http://www.hfindustry.com/meetings_presentations/2017_sep_hfia.htm

 

THALES HFXL modem, "SALAMANDRE" tests go on

Likely another "SALAMANDRE" test session for the new Thales HFXL modem spotted this morning on the 7MHz band. This time the modem uses 12 non-contiguous 3 kHz channels from 7505.8 KHz up to 7656.1 KHz (~150 KHz bandwidth). The HF waveform is a modified STANAG-4539 with the extended preamble of 124 symbols added by Thales developers; further info about the modified waveform and the modem, as well as useful links, can be read in this post.

Fig. 1

It's interesting to note in Figure 2 the use of a double 188-141A 2G link setup exchange before the beginning of the HFXL session: the ALE exchanges happen just on the first and last channel of the next HFXL transmission as to negotiate/announce the used band; anyway, the HFXL session starts after the usual 2G 3-way handshake (as in Fig. 1). This initial link setup part is termed by Thales as the "3KHz phase" and it is illustrated in one of their presentations. 

By the way, the used ALE calls are XLA and XLB and almost surely they stand for (HF)XL modem-A and modem-B and belongs to French Forces network.

Fig. 2

The HFXL modem 12 channels have been tracked using SDR-Console v3 software configured for twelve simultaneous receivers, in this sample all the channels exhibit a PSK-8 modulation at 2400 symbols/sec (Figs. 3,4): the channel #4 is damaged by an adiacente FSK-2 transmission.

Fig. 3

Fig. 4

https://yadi.sk/d/EevNUVXy3KMSap

STANAG-4539 in multichannel mode: Thales HF XL modem (likely "SALAMANDRE" tests)

This system has been copied on 9 different simultaneous channels from ~6200 to ~6400 KHz on USB during 9 June morning. The analysis reveals it's a STANAG-4539 modem (frame length is 287 PSK-8 symbols) running at different data signaling rates at constant 2400Bd data rate. The system uses bursts and (possibly) ARQ mode. My friend KarapuZ too copied this system but on a different HF segment.

Fig. 1

Fig. 2

The decisive contribution for the identification of the signal came from my friend ANgazu: he suggested that these transmissions could be the Thales HFXL modem, since they use up to 16 narrowband channels in 200 Khz bw just using 4539 waveforms. Most likely, the heard transmissions are tests related to the Thales /French MOD contract: PEA "SALAMANDRE".

Indeed, as depicted in Thales presentation of the HFXL modem:

http://www.hfindustry.com/meetings_presentations/presentation_materials/2013_jan_hfia/presentations/8-HFIA_HF_modemXL.pdf 

they uses an evolution from the SANAG-4539 frame structure, mainly differing in the preamble parts as shown in Figure 3 

Fig. 3

Other than the long miniproble (32 symbols length rather than 31), they added a third 124 PSK-8 symbols part (termed "Extended") to the S-4539 initial synchronization preamble. The data block length (256 symbols) and the mini probe length (31 symbols) remain unchanged so that the period counts 287 symbols as in S-4539 (Figure 2).
The extended synchronization preamble is specific to  HF XL.  This part, not included when operating according to S-4539 or MS 188-110C ISB modes, is combined with the main preamble to carry all  information  necessary  to  the  HF XL  waveform, in particular information on modulation choice for each channel. Furthermore, a specific redundancy capability is introduced, that ensures resilience to the loss of a channel as long as the number of channels is greater or equal to 3.

A deeper look at the preamble of one heard transmission confirms the Thales HF XL modem, as depicted in Figures 4,5

Fig. 4 - the whole preamble

Fig. 5 - the 124 symbols (51.6 msec) added by Thales

As further confirm, ANgazu measured the parts of the preamble (Fig. 6) and time durations fit perfectly:

Fig. 6 - parts durations in HF XL preamble

A: syncronization preamble (76 ms)
B: initial sync 287 symbols (b1 of 184 and b2 of 103 symbols)
C: extended Thales preamble (124 symbols)

The adaptive wideband HF waveform termed “HF XL” relies on the usage of several non-contiguous 3 kHz channels spread over a 200 kHz wide sub-band.

Fig. 7

Expanding on the high performance of the serial tone modem technology standardized in STANAG 4539 for 3 kHz sideband to conjugate a plurality of channels in a multi narrow band (MNB) waveform, this approach can be seen as an extension of the US MIL-STD-188-110C appendix F “ISB”, with the addition of specific redundancy capabilities to provide resistance to the highly variable HF channel conditions.  As illustrated in Figure 7, these channels do not need to be contiguous, which allows to select only good quality and authorized channels. A 4G ALE alternate proposte ?
(continue in this post)

Thanks to ANgazu for the identification and collaboration.

Links:
https://events.thalesgroup.com/euronaval/en/article/778731/SALAMANDRE-HF-with-wideband-capability 
http://www.hfindustry.com/meetings_presentations/presentation_materials/2014_feb_hfia/presentations/8-HFIAfeb2014ThalesXLALEfinal.pdf 
http://www.hfindustry.com/meetings_presentations/presentation_materials/2013_jan_hfia/presentations/8-HFIA_HF_modemXL.pdf 
http://lamyc.free.fr/publications/NORDICHF2013_1.pdf 

https://yadi.sk/d/iS9KPa-h3Jybxq