CIS Navy VLF 50Bd/75 FSK (T-600 75Hz)

50Bd/75 FSK is the T600 waveform variant utilized by Russian Navy on 18.1 kHz, commonly for submarine communications.

Fig. 1 - 50Bd/75 waveform

 

As seen in CIS 36-50, frames are constructed from data blocks consisting of 7-bit words with a fixed ratio of '1's vs. '0's of 4 to 3 or vice versa, depending on polarity of reception (Figure 2). 

Fig. 2 - 4/3 ratio test on a five-message transmission (s1 and s2 data blocks are the same)

 

Multiple Russian military naval communication stations share this frequency (18.10 KHz) and the call sign "RDL".  The 24h transmission schedule has frequent flash-override messages in A1A Morse, FSK-Morse and T600 75 Hz, as shown in the lower image of Figure 1.

https://yadi.sk/d/h2IHsKnam1JpTA

https://yadi.sk/d/0M7f_H_WOD9LTA (T600-75 bitstream)

Swedish Navy submarine MSK multi-channel broadcast

(For background it might be helpful to read the relevant entries here)

Swedish Royal Navy (Swedish: Svenska marinen [1]) uses a broadcast function of STANAG-5030 (1) for communication with its subs in the Baltic Sea, the return channel is believed to be low-end HF. These LF broadcasts use the 200Bd/100 MSK waveform and can be heard on 40.4, 42.5, and 44.2 KHz (CF) by using  KiwiSDR receivers located in the island of Gotland which have a good SNR. [2].

All the three signals have the classic set of parameters for (G)MSK: a spectrum equal to 1.5*Br (300Hz), shift equal to Br/2 (100Hz), a characteristic bell-shaped appearance (Figure 1), and others such as 4-point constellation, transitions and real trajectories (Figure 2). Please note that the carrier in the fourth degree is very weakly expressed, sometimes it is practically invisible at all.

Fig. 1

Fig. 2

Using 200Bd MSK (a form of QPSK) it is possible to transmit two 100 Baud channels X and Y, each on a pair of phase, and each channel can consists of 2x50 Baud multiplexed channels. Thus, MSK can provide a TDM multi-channel broadcast of  up to 4x50 Baud X1 X2 Y1 Y2 channels within the 200Hz assigned band (MSK4).  Some aspects about the similarities bewteen QPSK and MSK are covered in radioscanner forum [3].

In conditions where no messages are available for transmission, the four channels are arranegd with two "empty channel filler" (ECF) patterns, probably generated automatically at the transmitter equipment:

- two channels share the same 15-bit pattern;
- a third channel uses a different 5-bit pattern;
- the fourth channel uses the same 5-bit pattern where one column is repalced by the bits of the pseuso-random sequence generated by the polynomial x^31+x^3+1.
An example of this "idle" mode is shown in Figure 4: here the m-sequence is sent in the Y2 channel (notice the same pattern sent in X1 X2 channels ).

Fig. 3

A more generalized scheme highlighting the position of the m-sequence channel in four different recordings is shown in Figure 4.

Fig. 4

 In case of messages, the four channels use a 5-bit format with different framings:  

- two channels share the same 5-bit framing, i.e 1-bit marker (pos/neg according the polarity) + 4-bit data:

- a third channel uses an unid (to me) framing;

- the fourth channel uses the same 5-bit framing of the first two channels but the marker column is replaced by the bits of the pseuso-random sequence generated by the polynomial x^31+x^3+1.
Figures 5a,5b show such arrangement.

Fig. 5a

Fig. 5b

Due to their strategic and tactical importance, subcomms require secure cryptographic protocols and this could explain the presence of the x^31+x^3+1 pseudo-ramdom sequence which is used to sync the receive KW-46/KIV-7 ciphers (other than to permit channel identification), although an encrypted 4-bit stream is rather unusual as well as the use of the 1+4 bits frames. 

In this regard, one might even think that the actual secured messages channel is Y before the TDM split (Figure 6), while the other channels X1 X2 transport not critical 4-bit coded data (WX forecast, sea conditions, ...). This way, messages could use 10-bit START-STOP code which is then encrypted using the KW-46/KIV-7 equipment. Encryption results in bits 2 to 10 being encrypted and bit 1 (START) being replaced with unencrypted bit defined by the polynomial x^31+x^3+1, or in reverse order - bits 1 to 9 encrypted and bit 10 (STOP) replaced (2). A second hypothesis - perhaps the most likely - is that each channel is encrypted with a specific cipher ...but these are just my speculations.

Fig. 6 (m-sequence columns are highlighted)

The results of TD0A geolocation indicate three probable transmitter sites that match fairly exactly with those indicated in a map presented by FMV (the Swedish Defence Materiel Administration) [4] at the March 2020 HFIA HF Industry Association [5] Meeting in San Diego, CA (Figure 7):

- 40.4 KHz: SAS/SRC Varberg
- 42.5 KHz: SAS2 Gudinge
- 44.2 KHz: SHR Ruda

Fig. 7

It must be taken into account that I can't record the (KiwiSDR) LF spectrum 24/7 so the results indicated above may be incomplete: further recordings are needed and possibly an update post will be published later. Hints and comments are welcome.

https://yadi.sk/d/RlVneazxS8HT4w idle

https://yadi.sk/d/hDRK-867rvKaqg traffic

(1) STANAG-5030 is a restricted document so no information is publicy available. Moreover, the new STANAG-4724 "VLF/LF MSK Multi Channel Broadcast" is currently being ratified by NATO member states as next evolution:

https://nso.nato.int/nso/nsdd/ListPromulg.html 

(2) max success for x^31+x^3+1 in Y stream was found for a length frame of 10 bit; that same frame does not have parity bits (x^31+x^3+1 column excluded from the checksum)

[1] https://www.forsvarsmakten.se/../marinen/

[2] http://kiwisdr.thulesius.se:8073/ ,  http://158.174.17.55:8073/

[3] http://signals.radioscanner.ru/info/item281/

[4] https://www.fmv.se/english/

[5] https://www.hfindustry.com/

(yet another) 100Bd/500 FSK-2

4 August 2020 update
some frequency, same timing, and same 511-bit sequence but the speed has switched to 50Bd (shift remains unchanged, 500Hz):

It's to notice that the 511-bit sequence is obtained using the seed  s=[0 0 0 0 0 0 0 0 1]  and transmitting the output in opposite polarity (i.e., inverting the polarity of the demodulated sequence we get the exact sequence generated with seed s=[0 0 0 0 0 0 0 0 1]):

up: LFSR sequence when seed = [0 0 0 0 0 0 0 0 1], down: received sequence after reversing the polarity

2 August 2020
Just to log interesting 100Bd/500 FSK-2 transmissions found on 9130 KHz (CF). Data sent consist of a repeated 511-bit pseudo-random sequence which is generated by the polynomial x^9+x^5+1 (Fig. 1); likely that sequence is used when no data to transmit is available or to mantain sync between transmitting and receive modem (see also ITU Recommendation O.153 [1]). Since the 100Bd/500Hz waveform is used in several systems, it's difficult to state the source; anyway, it's to notice that x^9+x^5+1 sequences (PRBS9) are also used in CIS-12 and more generally in T-230 family devices.

Fig. 1 - the 511-bit pseudo-random sequence

Looking at the two FSK tones, it seems that they preserve their phase after each switch-over (Fig. 2). By the way: F1 = 753.87 Hz (1:0.001326479), F2 = 1253.68 Hz (2:0.001595299), dF = 499.81 Hz.

Fig. 2

I followed the transmissions for some days, they usually take place on weekdays at 0943 and stop at 1100 (UTC times). I ran several TDoA attempts and results point to the Moscow area, unfortunately they do not exactly agree.

Fig. 3 - start stop period

Fig. 4 - some of the TDoA results

[1] https://www.itu.int/rec/T-REC-O.153/en

CIS-11 (TORG 10/11)

CIS-11 (also designated as TORG 10/11) is a synchronous, duplex ARQ system requiring separate forward and return links. It's used mainly for aeronautical weather reports in CIS, thus transmissions normally take place in M2 alphabet (Cyrillic third-shift ITA-2). Modulation used is FSK2, usually 100Bd and 500Hz shift with 11-bit period (figure 1).

Fig. 11

Its characteristic 11-bit format consists of the 5 bits of the ITA-2 alphabet d4-d0 (but in reversed bit order: d0-d4), 2 system state bits s0 and s1 and 4 parity bits p0-p4: the checksum is calculated by modulo-2 addition from all 7 other bits (d4-d0 + s0-s1) as: 

p0 = d1 + d3 + d4 + s0
p1 = d0 + d2 + d4
p2 = d0 + d1 + d3 + s1
p3 = d0 + d2 + d3 + s0 + s1

Fig. 2

I wrote a simple Octave script (CIS11_detect.m) just to check CIS-11 streams and extract the 5-bit data in case of  successful result:

## usage: CIS11_detect(fn,e)
## input:  fn ... filename containing a string of 0's and 1's (no space between)
##         e  ... 0 doesn't exctract data
##            ... 1 extracts M2 data
## output: m  ... CIS-11 parity bits success [0..1]
##         a  ... aligned bit frames: parity bits in a(8:14), in case m > 0.9
##         fn_M2-data.txt
##                ASCII file with the exctracted data, in case m > 0.9 and e = 1

CIS11_detect is downloadable from:

https://yadi.sk/d/FXe96jvqNZoreQ

(you will need the GNU Octave package [1] to run the script).

I checked two transmissions and results are shown in Figs. 3,4; note the values of the system state bits (the two solid columns) in the two streams.

Fig. 3

Fig. 4

The system state bits signal the link state and traffic information, below a possible relationship just based on the (few) analyzed recordings:

00   - idle or Request
01   - ?
10   - Cyrillic
11   - Latin

transition to Cyrillic traffic is signaled by 00000 10

transition to Latin traffic is signalled by 11111 11

CIS-11 uses also two "idle signals", according to ITU-R F.342-2 [2]): idle signal α "01101 00 1100" is used when no data to transmit is available and mantains sync between transmitting and receive modems; idle signal β "10101 00 0001" is the ARQ request character. It's to note that:

- both the idle signals have the system state bits set to 00
- if shifted(!) the idle signal β is CIS-11 compliant (look at start bit offset in Fig.5)
- idle signal α is a LFSR x^3+x^2+1 sequence, the 7-bit sequence is used in d0-d4,s0-s1 bits
- idle signal β can be scrambled using the LFSR x^5+x^4+1

Fig. 5

https://yadi.sk/d/D-BbuOwZwVHykQ

[1] https://www.gnu.org/software/octave/

[2] https://www.itu.int/rec/R-REC-F.342-2-197007-W/en

CIS-81-81 (81-81, Moroz) T-206

update
A friend of mine sent me an interesting comment about the 6 and 12 bit formats used in CIS-81-81 mode, likely they refer to a former version of 81-81 and clear-text transmissions:

6-bit format (40.5 Bd): idle and traffic

12-bit format (81 Bd), two cahannels "a" and "b", bit-interleaved:

a) Channel a and b idle
b) Channel a traffic
c) Channel b traffic
d) Channel a and b traffic

(bits 2 and 5 are sent in inverted polarity).

July, 21 
Since in the last few weeks I have encountered mostly FSK2 signals (mostly from the East), I decided to take a slightly deeper look at "old" FSK2 modes such as CIS-81-81 and CIS-11 (the latter in a next post).
CIS-81-81, also designated as 81-81 (1) , T206-M 3M1 device, is the dual channel version of CIS-40.5 mode, hence the designation 81-81; "Moroz" ("FROST" in English) is just an old nickname for the mode [1]. Most likely, when operating in two channels the data are transmitted using time division multiplexing. Both 40.5 and 81 are quite "old" systems, most likely also in use by some ex USSR republic. Speculation is that this older 81-81 system, as defined above, is no longer in use and that the newer 81-81 system is most likely to be derived from CIS-14 or CIS-27 system (81-29 designation?) [2]. Some old reports from WUN logs indicate different users of these systems [2].

Shift           Common User
-------------------------------
125             Navy   
500             Railway Authority
200,250,500,    Military
1000,1500

So far, I have at my disposal CIS-81 samples in two different shift patterns:

81Bd 250

Fig. 1

It's the 81-81 most interesting waveform since its demodulated stream exhibits a 24-bit pattern due to the  length of the idle signal which consists of 12 mark and 12 space bits (notice that CIS-40.5 250 uses 12-bit idle signal consisting of 6 mark and 6 space bits). The sequence generated by x^11+x^9+1 (PRBS11)  is used to scramble to the following data block or symply as "test" message; then the idle signal is repeated in opposite polarity (Fig. 3). Traffic in the channels is encrypted. It's worth noting that the polynomial and the idle signal "format" are the same in the 250Hz shift patterns of CIS 40.5 and 81 Baud.

Fig. 2 - CIS-81-81 250 

Fig.3

81Bd 500

Although the lack of the idle signals (at least in this recording), the demodulated stream is very interesting since it too can be descrambled using  the polynomial x^11+x^9+1 (Fig. 5).

Fig.4

Fig.5

 
T-206 MT "WESNA" (T-206 MT, T-206 2MT, T-206 3M und T-206 3M1)
T-206 is a Soviet teletype and data encryption family devices (not a modem!) used in stationary and mobile operation [3].

Fig. 5 - T206 MT [3]

(1)
The system has it roots in the synchronous, manual Baudot printing telegraph system whcih was used extensively already in Imperial Russia. The telegraph network of Imperial Russia was of course inherited by the Soviet Union, where the political leadership very soon realized that good telecommunications were at the roots of its modernization project. During and after WWII teleprinting was extended to radio links using either A1 or F1 modulation. It was therefore natural to adapt the old Baudot system to radio transmission and reception. As the system was synchronous its frame format needed a means to tell whether the link was active or idle, consequently a status bit was added in front of the five data bits yielding a 6-bit frame. For 2-channel systems this was naturally expanded to 2 x (1+5) = 12 bits. The system would then be transmitted as frame or bit interleaved. These systems used the first version of the International Telegraph Alphabet (ITA 1).

https://yadi.sk/d/WQikSYo77Z6oBA (250Hz shift, #1)
https://yadi.sk/d/bd81CpHyBFDuCQ (250Hz shift, #2) 
https://yadi.sk/d/-Q-4JagM1eeBHw (500Hz shift)                     

[1] https://i56578-swl.blogspot.com/p/russcomms.html

[2] http://xoomer.virgilio.it/.../Digitalsignalsfaq.html Digital Signals FAQ  V5.0 (2001)

[3] http://scz.bplaced.net/t206mt.html