This is just a short note that my recent talk on KiwiSDR TDoA at the Software Defined Radio Academy 2019, which took place during the German Ham Convention in Friedrichshafen, Germany, is now available on YouTube.

For other talks from this meeting see http://youtube.sdra.io/.

# Signal Monitoring and Analysis

## Thursday, July 4, 2019

## Tuesday, June 25, 2019

### 4800 symb/sec QPSK signal on 10160 kHz (2)

This in an update related to the last blog post. As before, all analysis is done in GNU octave.

In order to extract the bit stream from the signal on 10160 kHz we assume that it (D)QPSK modulated and use the gray code mapping [0,1,2,3] -> [0,1,3,2].

The extracted bits are shown below in terms of 894-bit long frames.

The rank-deficiency analysis of this bit stream indicates the presence of a convolutional code:

For obtaining the rank-deficiencies above, the bit stream has been aligned by using an offset for which the R(k)/k is minimal, i.e., at 10+m×24:

As a result, the code rate is n/k=1/4, and the length of the dual code is 41. The latter is quite large and therefore hints at the use of some form of Turbo Code, or something similar to it.

It is unlikely by coincidence that the frame length is 24×41, the length of the dual code is 41, and the distance between the rank deficiencies is 24.

The fixed bits in each frame when assuming DQPSK modulation are likely being used for frame synchronization: in this case, 4 of the 14 systematic bits are used for frame alignment and there are 5+5 parity bits.

Obviously it would be interesting to figure out the full parameters of the convolutional coding.

In order to extract the bit stream from the signal on 10160 kHz we assume that it (D)QPSK modulated and use the gray code mapping [0,1,2,3] -> [0,1,3,2].

## Assuming QPSK modulation

The extracted bits are shown below in terms of 894-bit long frames.

bit stream in terms of 24×41 frames (QPSK) |

The rank-deficiency analysis of this bit stream indicates the presence of a convolutional code:

rank-deficiency (QPSK) |

For obtaining the rank-deficiencies above, the bit stream has been aligned by using an offset for which the R(k)/k is minimal, i.e., at 10+m×24:

alignment of bit stream for the rank-deficiency analysis (QPSK) |

As a result, the code rate is n/k=1/4, and the length of the dual code is 41. The latter is quite large and therefore hints at the use of some form of Turbo Code, or something similar to it.

## Assuming DQPSK modulation

The extracted bits are shown below in terms of 894-bit long frames. Unlike for QPSK modulation the bits in positions [1,18,19,24]+m×24 are the same in each frame.

zoom of bit stream in terms of 24×41 frames (DQPSK) |

Also assuming DQPSK modulation, the presence of a convolutional code is detected; it has code rate 7/12 and the length of the dual code is 41. (This might be a Turbo Code with 14 systematic bits and 5+5 parity bits)

rank deficiency (DQPSK) |

alignment of bit stream for the rank-deficiency analysis (DQPSK) |

## Summary

It is unlikely by coincidence that the frame length is 24×41, the length of the dual code is 41, and the distance between the rank deficiencies is 24.

The fixed bits in each frame when assuming DQPSK modulation are likely being used for frame synchronization: in this case, 4 of the 14 systematic bits are used for frame alignment and there are 5+5 parity bits.

Obviously it would be interesting to figure out the full parameters of the convolutional coding.

## Friday, June 14, 2019

### 4800 symb/sec QPSK signal on 10160 kHz

symbol autocorrelation |

Arranging the QPSK symbols in frames of 492 symbols, some interesting structures can be seen

492 symbols / frame |

When the symbols are arranged in terms of 12-symbol long frames, some columns of the resulting matrix have a periodicity of 41 in the squared symbols.

TDoA geo-location indicates a location close to Luxembourg.

TDoA |

## Friday, May 31, 2019

### THALES Salamandre HFXL bursts

In the last days THALES Salamandre HFXL signals were again active, as was also noticed by Antonio.

TDoA points to the area around Paris. However, judging from the observed field strengths, there were transmitters at (at least) two locations active.

A 72-frame long HFXL burst is shown below (most bursts consist of 9 frames). The symbols were obtained by manually correcting for the doppler offset and searching for the correct symbol timing using GNU octave. The burst consists of frames with 287 symbols where the last 31 symbols are +-sign miniprobes.

The preamble consists of three parts where the 1st two parts are following MIL-STD-188-110 App. C and the 3rd part is a proprietary extension. It encodes 10 di-bits D

It is known that the first few di-bits encode information about the used modulation schema:

The table below shows a map between [M

The bits extracted from the 72-frame long burst shown above have a mean of 0.377; assuming that the probability for a bit to be 1 is 0.5 this translates into 24.6% of the payload consisting of zeros. If this is correct then one should see long strings of 0 bits.

Assuming that the 72 frames in this burst consist of two blocks of 36 frames, and that an interleaver of the form specified in MIL-STD-188-110 App. D is used, the maximum run lengths for all interleaver increments are shown below. For both interleaver blocks there is a maximum for an interleaver increment of 469.

Assuming that the correct interleaver increment is 469, the deinterleaved bits are shown below:

As this analysis is based on a single burst with 72 frames, it might be a mere coincidence. In addition it is worth noticing that using the same interleaver increment, assuming that all 72 frames are a single interleaver block, the double of the bit patterns above is obtained.

TDoA points to the area around Paris. However, judging from the observed field strengths, there were transmitters at (at least) two locations active.

TDoA |

A 72-frame long HFXL burst is shown below (most bursts consist of 9 frames). The symbols were obtained by manually correcting for the doppler offset and searching for the correct symbol timing using GNU octave. The burst consists of frames with 287 symbols where the last 31 symbols are +-sign miniprobes.

HFXL burst |

The preamble consists of three parts where the 1st two parts are following MIL-STD-188-110 App. C and the 3rd part is a proprietary extension. It encodes 10 di-bits D

_{0},...,D_{9}containing information about the used modulation schema and other signal parameters.HFXL preamble |

It is known that the first few di-bits encode information about the used modulation schema:

[DIn order to study these bursts more systematically the extended HFXL preamble was implemented in gr-digitalhf as an extension of the 110C mode. A number of recorded HFXL signals were analyzed and the constellations shown below were found (not shown: BPSK). Note that the BPSK and QPSK modes are scrambled to 8PSK symbols._{0}, D_{1}, D_{2}] = [(1,M_{0}), (1,M_{1}), (1,M_{2})]

HFXL constellations after descrambling |

The table below shows a map between [M

_{0},M_{1},M_{2}] and the channel symbols after descrambling. 64QAM mode was not observed and is therefore missing in the table below.At first is was puzzling that two combinations of [MM0, 0, 0 BPSK 1, 0, 0 QPSK 0, 1, 0 8PSK 1, 1, 0 16QAM 0, 0, 1 32QAM 1, 0, 1 ---- 0, 1, 1 QPSK chips with phases [+1,-1,-1,+1] 1, 1, 1 ----_{0},M_{1},M_{2}Channel symbols after descrambling

_{0},M_{1},M_{2}] correspond to QPSK descrambled symbols. Having a closer look at (0,1,1) bursts, it can be seen that it consists of QPSK symbols S_{i}spread out using [+1,-1,-1,+1] chips,*i.e.*,..., Smaking it a very robust mode to transmit data._{i},-S_{i},-S_{i},S_{i}, S_{i+1},-S_{i+1},-S_{i+1},S_{i+1}, ...

QPSK (0,1,1) mode |

The bits extracted from the 72-frame long burst shown above have a mean of 0.377; assuming that the probability for a bit to be 1 is 0.5 this translates into 24.6% of the payload consisting of zeros. If this is correct then one should see long strings of 0 bits.

Assuming that the 72 frames in this burst consist of two blocks of 36 frames, and that an interleaver of the form specified in MIL-STD-188-110 App. D is used, the maximum run lengths for all interleaver increments are shown below. For both interleaver blocks there is a maximum for an interleaver increment of 469.

maximum run length as a function of interleaver increment |

Assuming that the correct interleaver increment is 469, the deinterleaved bits are shown below:

- there are four gaps, each about 215 bits long
- the probability of a bit to be 1 if it is not in one of these gaps is 46.1% for the 1st block and 46.9% for the 2nd block
- the distribution of the deinterleaved bits for both blocks is similar and shows an interesting pattern

deinterleaved bits for interleaver increment 469 |

As this analysis is based on a single burst with 72 frames, it might be a mere coincidence. In addition it is worth noticing that using the same interleaver increment, assuming that all 72 frames are a single interleaver block, the double of the bit patterns above is obtained.

deinterleaved bits for interleaver increment 469 |

## Wednesday, May 29, 2019

### MIL-STD-188-110 App.C QAM

Recently MIL-STD-188-110 App C (STANAG 4539) signals were found on a KiwiSDR. This made it possible to complete the corresponding decoder in gr-digitalhf which includes an adaptive channel filter, descrambling, deinterleaving, and convolutional decoding. For the QAM modes descrambling is done by applying an XOR operation on the soft decisions.

QAM32 constellation obtained after decoding with gr-digitalhf |

Using the path metrics of the convolutional decoder it was verified that the whole chain of decoding steps is correct: without puncturing the path metric \(M\) for \(n\) encoded bits at rate \(1/2\) is \(2n\) if there are no errors, so it makes sense to use \(Q=M/2n\) as a measure of data quality. When there is puncturing,

*e.g.*, to rate \(3/4\) with puncturing pattern [11, 10], the expected path metric is \(3.5/4\): three out of four bits are transmitted and the probability for the puncture to be correct is \(1/2\). Therefore in this case \(Q\) has to be rescaled by the factor \(4/3.5=8/7\).## Friday, May 10, 2019

### Blind detection of convolutional codes

This post continues the topic started in this blog post,

The basic idea is to arrange a given bit stream \(b_i\) in matrices \(R_k\) \begin{equation} B_k = \begin{pmatrix} b_0 & b_1 & b_2 & \cdots & b_{k-1}\\ b_k & b_{k+1} & b_{k+2} & \cdots & b_{2k-1}\\ \vdots & \vdots & \vdots & \ddots & \vdots \end{pmatrix} \end{equation} and then to determine the rank of \(R_k = \mathsf{rank}(B_k)\) as a function of \(k\). Note that for computing the rank \(B_k\) is treated as a matrix with values in \(\mathbb{F}_2\).

If the bit stream is completely random, all matrices \(B_k\) will likely have rank \(R_k=k\). However, the redundancy introduced by convolutional coding shows up as some matrices not having full rank,

Starting from a \(k=7,\;r=1/2\) mother code, rank deficiency plots are shown below for different puncturing patterns, together with the expected behavior.

Note that this method detects any redundancy (error coding) in a given bit stream and therefore can be generalized to other coding schemes.

*i.e.*, the detection of the presence of convolutional coding in a given bit stream.**The method outlined below is not new**and a good reference it is this paper: M. Marazin, R. Gautier, G. Burel “*Blind recovery of k/n rate convolutional encoders in a noisy environment*”The basic idea is to arrange a given bit stream \(b_i\) in matrices \(R_k\) \begin{equation} B_k = \begin{pmatrix} b_0 & b_1 & b_2 & \cdots & b_{k-1}\\ b_k & b_{k+1} & b_{k+2} & \cdots & b_{2k-1}\\ \vdots & \vdots & \vdots & \ddots & \vdots \end{pmatrix} \end{equation} and then to determine the rank of \(R_k = \mathsf{rank}(B_k)\) as a function of \(k\). Note that for computing the rank \(B_k\) is treated as a matrix with values in \(\mathbb{F}_2\).

If the bit stream is completely random, all matrices \(B_k\) will likely have rank \(R_k=k\). However, the redundancy introduced by convolutional coding shows up as some matrices not having full rank,

*i.e.*, there are dependent rows in some \(B_k\) and therefore \( R_k < k \) for some \(k\).Starting from a \(k=7,\;r=1/2\) mother code, rank deficiency plots are shown below for different puncturing patterns, together with the expected behavior.

Note that this method detects any redundancy (error coding) in a given bit stream and therefore can be generalized to other coding schemes.

Rank deficiencies for the k=7 r=1/2 mother code. |

Rank deficiencies for a k=7 r=2/3 code obtained by puncturing. |

Rank deficiencies for a k=7 r=3/4 code obtained by puncturing. |

Rank deficiencies for a k=7 r=4/5 code obtained by puncturing. |

### MIL-STD-188-110D mini-probe base sequences

The mini-probes specified in MIL-STD-188-110D, Appendix D have interesting structures. Let us start with the two exceptions, \(n = 13\) and \(n = 19\):

Note that \(MP(k;4)\) is the (complex conjugate of the) length-16 Frank-Heimiller sequence contained in TABLE C-VIII,

### \(n = 13\): (TABLE D-XXII)

This is the well-known Barker-13 sequence,*i.e.*, \begin{equation} [+1, +1, +1, +1, +1, −1, −1, +1, +1, −1, +1, −1, +1]\;. \end{equation}### \(n = 19\): (TABLE D-XXIV)

This sequence is based on Legendre-19: \begin{equation} [1,\, -\mathsf{Legendre}(k/19)]\;. \end{equation}### \(n = m^2\): (TABLES D-XXIII, D-XXV - D-XXXVI)

All other mini-probe base sequences have lengths \(n=m^2\) for \(4\le m \le 17\) and can be obtained from the following formula, \begin{equation} MP(k;m) = \exp\left\{-2\pi i m \left\lfloor{\frac{k}{m}}\right\rfloor \frac{k}{n} \right\}\;, \end{equation} where \(\left\lfloor{x}\right \rfloor \) denotes floor function which returns the greatest integer \(\leq x\). Curiously, the mini-probe base sequences for \(m\ge 14\) are the complex conjugate of the formula above, so I wonder if this is by design or it is an error in the standard.Note that \(MP(k;4)\) is the (complex conjugate of the) length-16 Frank-Heimiller sequence contained in TABLE C-VIII,

*i.e.*, \begin{equation} \exp\big\{2\pi i\, [0, 0, 0, 0,\; 0, 2, 4, 6,\; 0, 4, 0, 4,\; 0, 6, 4, 2]/8\big\}\;. \end{equation} Many pages could have been saved by describing the mini-probe base sequences in terms of the formula above.
Subscribe to:
Posts (Atom)