29 June 2016

Siemens CHX200 F1-modem (CHP-200): FSK 249 & 250 Bd /170 Hz waveform

The CHX200 F1-modem (also known as CHP200 or CHP-200, i.e. the name of the embedded comunications processor) has been built in Germany by Siemens and under license in Indonesia (for domestic use).  It is part of their CHX200 family of HF ECCOM frequency hopping equipment and it has been in production since 1981. Ops 1.3-30 MHz (all mode transceiver), 10 KHz-30 MHz (receive), in 100 Hz steps. Dependent on the deployment, its RF power levels range from 100 to 1000 Watts (CHX250 1000 watt station, CHX240 400 watt station, CHX210 100 watt station). Known accessories and major items include PA-400 power amplifier, ATU-400 antenna tuning unit, PA/ATU-100 power amplifier/antenna tuner, CHP-200 receiver/exciter with communications processor.

This transission consists of the selcall part followed by the non-hopping ARQ part and was heard on 10154.0 KHz, with a +1600Hz shift on USB, at 0815 UTC. The signals belong to the FSK family, the ARQ part is characterized by a costant 250 Bd manipulation speed and a shift of 170 Hz (figs. 1a, 1b).

fig. 1a - constant 250 Baud speed
fig. 1b - ISS bursts and IRS ACKs

The most interesting feature of this FSK signal consists in the different manipulation speeds used in the two 'segments' (here indicated as A and B) of the selcall procedure. Although the CHP200 logs (at least the ones that I found) report the 250 symbols/sec speed, a more accurate analysis of the signals shows two different speeds and this could suggest the use of the 2-way ARQ mechanism.
According to the speed measurements (and to the ARQ mechanism) it seems that the sender transmits data at 250 Baud while the acknowledgements are sent back by the receive peer at 249 Baud (fig. 2).

fig. 2
One could say that it's a tollerance question since the two speeds differ in only one sybol, but the difference between the segments A and B is real and is clearly shown in figure 3 (obtained after the demodulation of the signal)
fig. 3
Other than the speeds, the two segments adopt different frame structures for their data transfer: 46 bits length (corresponding to a duration of 184ms) for the segment A and 36 bits length (144.5s) for the segment B, as shown in figs 4 and 5. Since these characteristics, I think that discussing about two distinct waveforms - rather than two segments of the same waveform - would be more appropriate.

fig. 4 - the 46 bits frame structure of the waveform A
fig. 5 - the 36 bit frame structure of the waveform B

The patterns visible in the two bistreams (fig 6) resemble data + ACKs and are another clue in favor of the ARQ.

fig. 6
Unfortunately I could not find official Siemens documentation about this modem and the selcall procedure: it would be interesting if someone could provide such info.
I want to thanks my friend Karapuz for pointing e in the right direction.

27 June 2016

Russian Air Force "Chayka", FSK 150Bd/500

This transmission was heard this morning on 14781.1 Khz (cf) at 0720 UTC sending encrypted bursts of ~21 secs duration. "Chayka" is the nick name for this commands/signaling FSK messaging system used  for  (military) aircrafts-ground communications.
The shift is costant 500 Hz while the manipulation speed may be 75, 150, 300 and 1200 Baud: in this sample the measured speed is 150 Baud (fig. 1).

fig. 1 - manipulation speed and shift
Each "message" consists of a preamble phase and the data phase; during the preamble phase the lower tone frequency is transmitted followed by the alternation of the two tone frequencies. The data phase may consist of separated segments and/or insertions of the 2-tones alternation, as clearly visible in figure 2 where the signal has been resampled to 4 KHz.

fig. 2
At least according to this sample, the messages can be continuously transmitted as 2 in-a-row or 3 in-a-row without manipulation breaks (figure 3) and this affects the lengths of the preambles.

fig. 3

23 June 2016

MIL 188-110B App. C (STANAG-4539 Annex B)

in this recording a MIL 188-141 2G-ALE link setup between ALE calls 5CIND2 and 5CIND1, and two MIL 188-110B App.C 4800bps short sessions for data transfer. The Appendix C of MIL 188-110B describes the HF data modem waveforms for data rates above 2400 bps (3200, 4800, 6400, 8000, 9600, and optional uncoded 12800 bps) and  is  defined as High Data Rate Traffic Waveforms in STANAG-4539 Annex B (the counterpart NATO compatible standard).
This transmission was spotted on 10074.0 KHz/USB @ 0710 UTC, on June 22.

There are two clues that confirm this waveform:
1) the ACF value is 119.58ms and corresponds to a frame structure consisting of 287 symbols data block consisting of 256 data symbols followed by a mini-probe of 31 symbols of known data  (188-110C Appendix D has 120ms ACF and 256 +32 = 288 symbols per data block)

fig. 1 - ACF and frame structure
2) the preamble exhibits a clear 184 symbols blocks structure 

fig. 2 - preamble
Both the two structures are also visible looking at the bistream obtained after the PSK-8 symbols demodulation: the preamble consists of 552 bits and each data frame consists of 861 bits  (fig. 3)

fig. 3
Unfortunatelly it's a poor quality signal and the constellation is not so clear, although the 8-ary modulation is quite evident in figure 4. Since the 3200bps QPSK constellation is scrambled to appear on-air as a PSK-8 constellation, we can't be positive about the data rate. Compatible decoders say 4800bps Short interleaver.
filg. 4 -  PSK-8 'over-the-air' constellation
According to the standard, preamble re-insertions occur each 72 data frames, thus the reinsertion period Tr is 8,61 secs (20664 symbols): since the duration of each session is <Tr (in this recording we count 36-37 data frames) we then do not see such reinsertions (they are not transmitted).

Using the PSK-8 symbol mapping, each mini-probe is based on the repeated Frank-Heimiller sequence. The sequence that is used, specified in terms of the 8PSK symbol numbers, is given by:
0, 0, 0, 0, 0, 2, 4, 6, 0, 4, 0, 4, 0, 6, 4, 2, 0, 0, 0, 0, 0, 2, 4, 6, 0, 4, 0, 4, 0, 6, 4
This mini-probe are designated ‘+’. The phase inverted version of this is:
4, 4, 4, 4, 4, 6, 0, 2, 4, 0, 4, 0, 4, 2, 0, 6, 4, 4, 4, 4, 4, 6, 0, 2, 4, 0, 4, 0, 4, 2, 0
and mini-probes using this sequence are designated ‘-’ (as the phase of each symbol has been rotated 180 degrees from the ‘+’). The 72 mini-probes before the preamble reinsertion are grouped into four sets of 18 consecutive mini-probes (1 to 18, 19 to 36, 37 to 54, and 55 to 72). Pictorially, this length 18 sequence is:
- - - - - - - + S0 S1 S2 S3 S4 S5 S6 S7 S8 +
where the Si sign values are defined in Tables C-IX, C-X, and C-XI of MIL 188-110B. No scrambling is applied to the mini-probes symbols.
Since the low quality of the recording and the characteristics of the SA universal PSK demodulator, we can just apreciate a "nuance" of the mini-probe pattern (fig. 5). Maybe further and better recordings will help.

fig. 5 - 188-110B App.C mini-probes

21 June 2016


06378.0 ---: Australian MHFCS net, AUS 2250 ISB FSK 600Bd/340 (06Jun16) (AAI)
06733.0 IDR: Italian Navy, I 0710 USB/J3E calling ORALE, PILONE, BUSSOLA (14Jun16) (AAI)
06745.5 FS01: Algerian Mil, ALG 2130 USB MIL 188-141 2G-ALE calling SZ01 (15Jun16) (AAI)
06931.0 ---: Unid (prob. Croatian Mil/Gov) 0555 USB modified STANAG-4285 waveform (four 100ms pre-tones at ~ 516,1216,1716,2616 Hz), short msgs (16Jun16) (AAI)
07455.0 NAA: Navy Isabela, PTR 0400 (cf) FSK 50Bd/850 (18Jun16) (AAI)
07508.7 D: MX Beacon "D" Sevastopol, UKR 2040 CW (19Jun16) (AAI)
07508.9 S: MX Beacon "S" Severomorsk, RUS 2040 CW (19Jun16) (AAI)
07526.0 ---: Russian Mil, RUS 1950 USB AT-3004D 12-tone modem BPSK 120Bd (19Jun16) (AAI)
07527.0 03x:COTHEN Remote Directional Transmitter, Omaha, NE USA0420 USB MIL 188-141 2G-ALE sounding (18Jun16) (AAI)
07590.0 CNC: Algerian AF, ALG 2042 USB MIL 188-141 2G-ALE calling CM3 (19Jun16) (AAI)
07596.0 DB3: Special Troops Battalion region 3 Kut, IRQ 1836 USB MIL 188-141 2G-ALE calling COM (19Jun16) (AAI)
07617.0 331013: Turkish Civil Defense Hatay, TUR 1910 USB MIL 188-141 2G-ALE sounding (19Jun16) (AAI)
07617.0 364013: Turkish Civil Defense Usak, TUR 0355 USB MIL 188-141 2G-ALE sounding (18Jun16) (AAI)
07629.0 DB3: Special Troops Battalion region 3 Kut, IRQ 1827 USB MIL 188-141 2G-ALE calling JQ1 (19Jun16) (AAI)
07651.0 BB3: Israeli AF, ISR 1916 USB MIL 188-141 2G-ALE sounding (19Jun16) (AAI)
07655.0 AA1: Israeli AF, ISR 1850 USB MIL 188-141 2G-ALE sounding (19Jun16) (AAI)
07655.0 AAA: Israeli AF, ISR 2050 USB MIL 188-141 2G-ALE sounding (19Jun16) (AAI)
07731.0 TM6: Unid network 1839 USB MIL 188-141 2G-ALE calling TM5 (19Jun16) (AAI)
07739.0 3127: Sonatrach, ALG 0352 USB MIL 188-141 2G-ALE sounding (18Jun16) (AAI)
07739.0 3404: Sonatrach, ALG 2035 USB MIL 188-141 2G-ALE sounding (19Jun16) (AAI)
07739.0 4011: Sonatrach, ALG 1914 LSB MIL 188-141 2G-ALE sounding (19Jun16) (AAI)
07748.0 ---: Russian Mil, RUS 1919 USB AT-3004D 12-tone modem BPSK 120Bd (19Jun16) (AAI)
07771.0 ---: Russian Mil, RUS 2053 USB AT-3004D 12-tone modem BPSK 120Bd (19Jun16) (AAI)
07809.0 DB3: Special Troops Battalion region 3 Kut, IRQ 1854 USB MIL 188-141 2G-ALE calling JQ1 (19Jun16) (AAI)
07820.0 ---: Unid 1950 USB Arab voice comms, ~ 1220Hz beep (19Jun16) (AAI)
07824.5 BL7: Polish Mil, POL 0728 USB MIL 188-141 2G-ALE calling BL6 (06Jun16) (AAI)
07824.5 MA1: Polish Mil, POL 0728 USB MIL 188-141 2G-ALE calling BL6 (06Jun16) (AAI)
07850.0 CHU: NRC Ottawa, CAN 0406 USB 1000 hz second pips /BELL 300 bps data (18Jun16) (AAI)
07937.0 ---: Unid 1924 USB STANAG-4285 1200/L (19Jun16) (AAI)
07959.0 REA4: Russian AF, RUS 1858 (cf) FSK 100Bd/1000, idle (19Jun16) (AAI)
07990.0 RFI: Saudi AF, ARS 1941 LSB MIL 188-141 2G-ALE calling JC1 (19Jun16) (AAI)
08494.9 D: MX Beacon "D" Sevastopol, UKR 2057 CW (16Jun16) (AAI)
08494.9 S: MX Beacon "S" Severomorsk, RUS 2057 CW (16Jun16) (AAI)
08580.0 ---: South Africa Navy, RSA 2104 USB Saab Grintek MHF-50 MFSK Modem (13Jun16) (AAI)
08800.0 ---: Unid 0616 USB STANAG-4285 600L KG-84 encrypted transmission (16Jun16) (AAI)
08815.0 SCPTOC: US-Army Camp Bondsteel, HRV 2109 USB MIL 188-141 2G-ALE sounding (16Jun16) (AAI)
10165.0 ---: Unid 0702 USB RFSM serial modem with Data Masking, QRX 10170.0 (10Jun16) (AAI)
10370.0 SPT424: Polish Mil, POL 1132 USB MIL 188-141 2G-ALE handshake with SNB813 (05Jun16) (AAI)
11130.0 C4: Moroccan Military, MRC 2039 USB MIL 188-141 2G-ALE sounding (06Jun16) (AAI)
11577.2 ---: Russian Intel 2043 (cf + 1800Hz) MFSK-16 175Hz 65.80Bd (06Jun16) (AAI)
12120.0 ---: Russian Intel, RUS 0654 USB CIS-3000 PSK-8 3000Bd serial flwd by MFSK-68 (34+34) (06Jun16) (AAI)
14363.0 CENTR2: MFA Bucharest, ROU 0629 USB MIL 188-141 2G-ALE calling ZMF (14Jun16) (AAI)
14449.5 ---: Russian Air Force, RUS 0635 (cf) FSK 100Bd/2000 (14Jun16) (AAI)
14628.0 ---: MFA Cairo EGY 2028 USB (cf +1700) SiTOR ARQ 100Bd/170 calling RCVB Washington Embassy (16Jun16) (AAI)
14951.2 ---: Russian Intel 1307 (cf + 1800Hz) MFSK-16 175Hz 16.44Bd (06Jun16) (AAI)
15025.0 ---: Unid 1230 USB STANAG-4197 modem, using second tone library only (OFDM 16-tone DQPSK 75Bd) (12Jun16) (AAI)
15252.2 ---: Unid (prob. ustrian Army?) 0817 USB MIL 188-141 App.B, OFDM 39-tone QPSK (07Jun16) (AAI)
15940.05 ---: Unid (prob. Russian gov/mil) 0815 (cf) FSK 40(39.76)Bd/500 (Moroz system?) (16Jun16) (AAI)
16023.0 ---: MFA Cairo, EGY 0739 USB (cf +1700Hz) SiTOR ARQ 100Bd/170 calling OOVC New Delhi Embassy, then into SiTOR-FEC sending for 7 times "FMFM FMFMFMFMFMFMFMFMFMFM  MDRS JG KDCFUSG 22281" (14Jun16) (AAI)
16072.2 ---: Russian Intel 1250 (cf + 1800Hz) MFSK-16 175Hz 16.44Bd (06Jun16) (AAI)
16104.0 ---: Russian Navy, RUS 1255 CIS Akula ("Shark"), FSK 500Bd/1000 (05Jun16) (AAI)
16116.5 OEY61: Austrian Mil, AUT 0629 USB MIL 188-141 2G-ALE handshake with OEY20 then into MIL 188-110 App.B (17Jun16) (AAI)
16122.0 ---: Russian Diplo, RUS 0756 (cf) Serdolik sync marker (08Jun16) (AAI)
16125.0 STAT16: Tunisian MOI, TUN 0725 USB (cf +1700) weak PacTOR-II 100Bd/200, HF e-mail "DEFAULT@#HFARQ#STAT16" (15Jun16) (AAI)
16161.0 20001: Iranian Mil, IRN 0909 USB MIL 188-141 2G-ALE sounding (07Jun16) (AAI)
16175.0 ---: Russian Mil/Gov, RUS 0550 USB CIS VFT 3x100 100Bd/1440 (17Jun16) (AAI)
16223.0 ---: Russian Intel, RUS 0830 (cf) CIS FTM-4, MFSK-4 150Bd (effective 37.5Bd) 4000Hz (tones at: -6, -2, +2, +6 KHz) (07Jun16) (AAI)
16234.2 ---: Russian Intel 0739 (cf + 1800Hz) MFSK-16 175Hz 16.44Bd (07Jun16) (AAI)
16240.0 11021: MOROCCAN DGPC, MRC 0919 USB MIL 188-141 2G-ALE sounding (07Jun16) (AAI)
16256.5 ---: Unid (prob French Mil?) 0645 USB Thales Systeme-3000 ALE (06Jun16) (AAI)
16262.5 ---: Unid (prob French Mil?) 0739 USB THALES Skymaster ALE + THALES TRC 177x/1752 serial modem (08Jun16) (AAI)
16285.0 STAT11: Tun-MOI, TUN 0837 USB MIL 188-141 2G-ALE handshake with TUD then into PacTOR-II (07Jun16) (AAI)
16285.0 STAT151: Tun-MOI, TUN 0826 USB MIL 188-141 2G-ALE calling STAT13 (07Jun16) (AAI)
16300.0 CM1: Algerian AF, ALG 0839 USB MIL 188-141 2G-ALE calling BFK (07Jun16) (AAI)
16311.0 ---: Russian Mil, RUS 0638 USB CIS-112 OFDM BPSK 22.22Bd burst mode then into stream mode(06Jun16) (AAI)
16352.0 ---: Russian Mil, RUS 0816 FSK 50Bd/500 msgs, ACF 16 bit (15Jun16) (AAI)
16484.5 ---: Unid (prob French Mil?) 0905 USB THALES Skymaster ALE Skyhopper mode (07Jun16) (AAI)
16555.0 ---: North Korean Diplo, DPRK 0906 LSB (cf +1500) DPRK-ARQ 600Bd/600 (07Jun16) (AAI)
16634.5 ---: Unid (prob. German Mil) 1326 USB Arcotel MAHRS-2400 serial 2400Bd PSK-8, ACF 106.66ms (10Jun16) (AAI)
16648.1 GUC: Unid net 0849 USB MIL 188-141 2G-ALE calling PHR (07Jun16) (AAI)
17469.0 ---: Russian Intel, RUS 0545 USB MFSK-68 (34+34) (17Jun16) (AAI)
17976.0 HAWSPR: USAF Ascencion Is. SIPR-net, ASC 0811 USB USB MIL 188-141 2G-ALE sounding (15Jun16) (AAI)
18270.0 ---: Unid (prob. Czech Diplo) 0745 USB (cf +1500) PacTOR-III (10Jun16) (AAI)

18 June 2016

'Arcotel MAHRS 2400' and 'THALES TRC-1752': same PSK-8 2400Bd, same 468 bits ACF, but two different waveforms

Single tone PSK-8/2400Bd waveforms are very common and it's easy to get mistakes in their identification, sometimes also their ACF values are equal and so things get complicated (it could also happen that the same waveform exhibits different ACFs according to the input data signaling rate, as in the case of MIL 188-110 ST). In cases of uncertainty or ambiguity, a careful examination may decide the questions.
Below just an example about  the 'THALES TRC-1752' and 'ARCOTEL MAHRS 2400' signals: they not only have the same PSK-8 2400Bd single tone features but also the same ACF. 
(Althought THALES TRC-1752 is a "modem" and ARCOTEL MAHRS is a "standard", I  generically refer to both as "signals").

Looking at their representation in the waterfall, they have a quite similar shape characterized by the same bandwidth, a non-fixed length duration and a short preamble: a first difference is visible just in this part. Looking with a little more attention, the Arcotel preamble is composed of 8+8 simmetrical tones while Thales signal exhibits a different header (fig. 1).

fig. 1
The data transfer parts of the two signals share the same features: 8-ary phase-shift keying of a single 1800 Hz carrier and 2400 symbols/sec modulation rate (input data signaling rate is not detected here). It's interesting to note the enhanced BPSK footprints that, unless their phase shift, appear in both the constellations of the signals (fig. 2).

fig. 2
These footprints suggest the presence of BPSK segments in the structure of both the two signals. As from literature, they consist of known-data symbols, in contrast with the unknown (user) data, and are are scrambled to appear, on-air, as PSK-8 symbols.
The BPSK insertions, as well as the differences between the two preambles, are more evident reducing the FFT size in the waterfall (fig. 3).

fig. 3
Looking at the two waterfalls, both with the same settings, we can also estimate that the two signals have the same pattern repetition rate (pic.3). Running the ACF and CCF functions for a better accuracy of the repetition rate, we get the same 106.665 ms result for both the signals: this value makes 468 bits, or 256 PSK-8 symbols periods since the manipulation speed is 2400Bd.

At this point, the real difference between these two signals, unless the preamble, can only be found by examining their frame structures.

The frame structure for the Arcotel signal is shown in figure 4. The preamble is followed by 256 symbols blocks, each block consisting of 176 unknown data symbols and a mini-probe consisting of 80 symbols of known data. This is the MIL 188-110 ST style waveform.

fig. 4 - frame structure for Arcotel MAHRS serial
The frame structure for the Thales signal is shown in figure 5. As well as in the frame of Arcotel signal, the frame cosists of 256 symbols blocks, each block consisting of 80 symbols preamble followed by 176 symbols data block, each data block consisting of 4 x 32 unknown data symbols and 3 x 16 symbols mini-probes. This is the STANAG-4285 style waveform.

fig. 5 - frame structure for THALES TRC-1752
It's worth noting that the two signals have the same length, 80 symbols, for the BPSK modulated  segment.

So, although both accomodate the same room, 256 symbols, they are formatted in different ways and thus belong to two different waveform families: MS188-110 (Arcotel MAHRS 2400 serial) and STANAG-4285 (THALES TRC-1752), each with its specific features and performances.

13 June 2016

MS188-110 poor man ASCII-bit stepper simulator (I)

the poor-man ASCII-bit stepper simulator implements a fixed-frequency serial (single-tone) waveform as speciefied in MIL-STD 188-110B 5.3, it only supports the 1200/2400 bps data rate and short interleaver only.

-why poor man
I'm just an hobbist in signals analysis and do not have resources to invest in sophisticated hw-devices or sw-tools suited to this specific activity (it's not my work).

- why ASCII-bit
the simulator does not treat the data in a bitwise mode but rather it uses their ASCII text representation, i.e. the data are written (and processed) as ASCII chars of zeroes and ones ("0" and "1") and so it's not a real modem since each ASCII character is a 7-bit code stored in a byte. This means, for example, that an initial ASCII string such
will end in a different baseband signal if processed by a real MS188-110 software modem as, for example, MS-DMT. 
Nevertheless, the ASCII-bit representation of data doesn't alter the way these are processed and appear at the input of the SSB modulator and, unless data representation, it's always possible to get a valid baseband waveform once the scrambled data 000,001,010,... are mapped into PSK-8 complex symbols 1+j0, 1+j1, 0+j1,...
Note that the binary values for ASCII text '0' and '1' are 00110000 and 00110001 respectively.

- why stepper
the simulator is not a single piece of software running in concurrent mode but rather it is composed of a series of pipeline modules, which have as their input-file the output-file of the preceeding module and therefore the modules are executed one at time (by manually running each of them). This allows the chance to examine step-by-step the evolution and the contents of the bitflow along the functional blocks of the modem.

- why simulator
from the above, it can't replace the original for a real use and it could be seen as a (limited) model for analysis.

The simulator is coded using the Lua language, a fast and powerfull interpreter (altough the sources could be compiled) and is limited to 1200/2400bps and short interleaver (I did not want to code a 188-110 compatible modem but just a way to look inside it). Please, at least now, do not ask for the code: it needs to be further debugged, does not have GUI , it's roughly written and need more lines to be user safe and 100% error-free.

unknown (user) data

In this eaxmple the input user data come from a random generator (https://www.random.org/bytes/): the randomized binary strings are printed on the screen and have to be cut&past into a simple editor (such as notepad) to create the input data file.  This procedure will cause a weird (but predictable) result once the data are passed through the FEC encoder.

FEC Encoder block

In this example, the output data from the FEC encoder exhibit a fixed pattern characterized by a 130 bits length period. As said above, this (apparently) weird result is due to the way Windows OS store the text files and to the length of the randomized binary strings printed out by the random generator.
Looking closely at the input file using a Linux terminal, we realize that is composed of 64 chars rows (the lenght of the random strings produced by the random generator), each row terminated by the DOS/Windows line-ending character ^M (or ctrl M, not visible using Windows notepad) that make 65 chars per row.

Since at the 1200bps rate the convolutional coder performs an effective code rate of 1/2, coded rows streams of 130 bits are generated for input data rows of 65 bits length 

remember that the simulator treats each single ASCII text '1' or '0' as one bit!


Interleaver block

The interleaver matrix accommodates a block storage of 600ms of receiving bits in case of short interleaver and 1200bps rate. Because the bits are loaded and fetched in different orders, two distinct interleave matrices are used: this allows one block of data to be loaded while the other is being fetched!
At the 1200bps rate the short interleaver matrix has a dimension of 40 rows x 36 cols, providing 1440 bits room: this value matches the number of output bits from the FEC encoder during the 600ms interleaver load period, i.e. 1200 * 2 * 0.6 (remember that FEC encodes at 1/2 rate).
The effect produced by the interleaver is most evident forcing a long sequences of zeroes and ones at its input:

MGD and Symbol Formation blocks

At the 1200bps rate, the bits fetched from the interleaver matrix are grouped together as  two bit entities (dibit channel symbols) and applied to the Modified Gray Decoder (MGD) to guarantee that only one bit changes. Three bit entities (tribit channel symbols) are used in case of the 2400bps rate. 
Following the above example of a long sequences input file:

The function of Symbol Formation block is one of mapping the channel symbols from the MGD (or from the sync preamble sequence) into tribit numbers compatible with transmission using an 8-ary modulation scheme. For user data, at the 1200-bps rate the dibit channel symbol formation use tribit numbers 0, 2, 4, and 6. At the 2400-bps rates, all the tribit numbers (0-7) are used for symbol formation. A different mapping process is used for preamble transmissions.

Sync Preamble Sequence
The waveform for synchronization is essentially the same for all data rates. The synchronization pattern shall consist of either three or twenty four 200ms segments (depending on whether either zero, short, or long interleave periods are used). Each 200-ms segment shall consist of a transmission of 15 three bit channel symbols
0, 1, 3, 0, 1, 3, 1, 2, 0. Dl, D2, C1, C2, C3, 0
The three bit values of Dl and D2 designate the bit rate and interleave setting of the transmitting modem. The three count symbols C1, C2, and C3 represent a count of the 200 ms segments starting at 2 for the zero and short interleave setting cases and 23 for the long interleave case.

Scrambler block

The Scrambler block modulo 8 adds the tribit number supplied from the Symbol Formation block for each 8-ary transmitted symbol to a three bit value supplied by either the data sequence randomizing generator or the sync sequence randomizing generator.
The bitstream at the 1200bps rate exhibits a 480 bit period corresponding to 160 symbols or 66.66ms: as seen in a previous post, this value is due to scrambler length. The frame structure, at the 1200bps rate, is the expected 20 (unknown) + 20 (known) symbols as specified in standard

Modulator block
The modulator block will be discussed closely in a further post (...I'm still working at it). The output data from the Scrambler block, after converted to the 0-7 numbers, will be mapped into the PSK-8 constellation complex symbols 1+j0, 1+j1, 0+j1,... to form the baseband waveform file: in a few words, a sequence of "samples" of the modulated signal (2400 samples/sec).

It's worth noting that the 0-7 numbers file is the same as the one obtained by the SA phase-demodulator (unless the phase offset):

After the complex-symbols conversion, the baseband file must  be up-sampled and filtered to spectrally constrain the waveform to within the specified bandwidth. A square root of raised cosine filter is recommended with a roll off factor, excess bandwidth, of 35% (as specified in standard) then, since the baseband signal has a center frequency of 0 Hz, it must be translated to the 1800 Hz center frequency and finally saved in the wave format to get the audio signal.
The modulator block will be implemented using the SciLab environment. By now, just for fun, it's possible to plot the numbers-baseband file to get the 8-ary constellation and transitions

(to be continued)

11 June 2016

Arcotel MAHRS-2400 serial (Telefunken Racoms)


This signal has been heard several times, this one on 12282.5 KHz on USB at 1430z. An old WUN publication (http://www.udxf.nl/WUN-v10.pdf) and some other logs report the 12282.0 and 12282.4 frequencies as operated by German Military, so probably the 12282.5 frequency is also owned by that same network.
MAHRS-2400 is a STANAG4285-like 2400Bd PSK-8 serial waveform (pic. 1) with 2 x 8 pre-tones which are simmetrical in respect of the 1800Hz carrier

pic. 1
The signal exhibits ACF of 106.66ms or 256 symbols due to its frame structure: 80 symbols length probe (kown symbols) followed by 176 symbols of data (pic. 2)

pic. 2
The evidence of a pronounced 2-ary states in the constellation suggests that the known-data probe are modulated using BPSK and then scrambled to appair as 8-ary in air. The BPSK probes are clearly visible in pic. 3 after after increasing the FFT size.

pic. 3
The waveform is similar to the one used in the MAHRS ALE mode, a 500ms burst system briefly reported here

This signal is linkable to the HRA 5100 radio communication system used in airborne platforms (hra-5100.html). As far as is recoverable in the web, "MAHRS" is the name of the HF radio-data standard used for data transmission while "Arcotel" was originally used to indicate the modem:  recent Telefunken Racoms HF transceivers have integrated radio processor and modem, Arcotel is supposed to indicate just the radio processor. The company's name "Telefunken Racoms"  is used since 2004 (http://www.army-guide.com/eng/firm3787.html).

10 June 2016

Unid MSK 1200Bd 800Hz

Yesterday (10 June) morning I spotted this weird signal on 20877.0 KHz/USB at 0725 UTC, unfortunatelly some statics due to a thunder storm ruin the reception.
The signal has a 1200 Hz bandwidth and is characterized by a strong tone at ~1400 Hz (1394) and two simmetical tones at +600 and -600 Hz which are transmitted at lower level than the central one. A sort of "marks" are transmitted each 137.5 ms (pic. 1)

pic. 1

FSK bursts are inserted in a seemingly random way, they have a shift of about 800Hz and manipulation speed of 1200Bd: curiously it's the same value of the bandwidth (pic. 2)

pic. 2
The 137.5ms marks make the period of the signal = 165 bits.

pic. 3

9 June 2016

Australian MHFCS net, a distinctive sign

Just a tip: in order to identify the MHFCS transmissions, in addition to the dial frequencies listed  here (remember that they use a 1500Hz offset above the indicated carrier) and to the shift and speed parameteres (tipically 600Bd/340Hz), think that these MSK signals exhibit a quite unique sign when inspecting the harmonics  using the SA 'involutions' tool. In this case, you will see the presence of several spectral lines in the 7^ power.