S-4481/S-4539 clear-text messages sent utilizing RapidM modem (BRE1TA tests?)

i56578-swl.blogspot.com 1 dzień temu

The intent of this post is to study test transmissions heard on 6963.0 kHz USB and logged during the first week of February by both Kosmod (who sent them to me for analysis) and ANgazu (whose signal was reported by KA0KA and published on the radiofrecuencias.es forum [1]). I don’t claim much credit in this post, another than confirming erstwhile analyses and contributing further insights.
Transmissions continued for respective days without interruption, almost entirely utilizing the STANAG-4539 (MS-110B App.C) waveform. 1 of Kosmod’s recordings was peculiarly notable, as the STANAG-4539 signal was preceded by a STANAG-4481 transmission at 75 Bd/850 Hz (Figure 1). The mode control lasted about 640 ms.

Fig. 1 - STANAG-4481/STANAG-4539 switch

According to STANAG-4539, each data frame contains a 256-symbol data block followed by a 31-symbol mini-probe of known data, for a full of 287 symbols per frame (119.57 ms @ 2400 symbols/s). all 72 frames, a 72-symbol subset of the first preamble is reinserted to aid late acquisition (1) (Figure 2).

Fig. 2 - STANAG-4539 framing

The data rate is 9600 bps, and the modulation utilized to accomplish it is QAM-64. According to STANAG-4539, §4.2.2.1.6, “This [QAM-64] constellation is simply a variation on the standard 8 × 8 square constellation, which achieves a better peak-to-average ratio without sacrificing the very good pseudo-Gray code properties of the square constellation” (Figure 3).

Fig. 3 - STANAG-4539 constellations

In both cases (STANAG 4481 and STANAG 4539), the modulations are asynchronous and employment an 8N1 framing format, as shown in Figure 4.

Fig. 4 - STANAG-4481 and STANAG-4539 demodulated bitstreams

The transmitted messages are 8-bit ASCII clear text and consist of repeated instances of the same sentence, differing only in the message series number:
[binary header][message series number][text]
The portions of the demodulated bitstreams presented below were obtained from 2 different recordings (header is omitted):

[STANAG-4481]
...
000013 fast Mobile HF & V/UHF Data Modem internally generated test message.
000014 fast Mobile HF & V/UHF Data Modem internally generated test message.
000015 fast Mobile HF & V/UHF Data Modem internally generated test message.
000016 fast Mobile HF & V/UHF Data Modem internally generated test message.
...


[STANAG-4539]
...
004820 fast Mobile HF & V/UHF Data Modem internally generated test message.
004821 fast Mobile HF & V/UHF Data Modem internally generated test message.
004822 fast Mobile HF & V/UHF Data Modem internally generated test message.
...

The message series numbering is likely continuous across the transition from STANAG-4481 to STANAG-4539 (Figure 2); however, this assessment cannot be confirmed due to unreliable demodulation of the initial section of STANAG-4539.

Despite the modem-generated test traffic, the end-to-end efficiency η from payload to physical layer transmission can be evaluated for this STANAG-4539 waveform. As shown, the 9600 bps input uses asynchronous framing with 1 start bit and 1 halt bit, meaning each byte is transmitted as 10 bits of which only 8 carry payload; the symbol rate of 2400 Bd employing QAM-64 modulation (6 bits per symbol) results in a gross channel bit rate of 14400 bps. So:

- net useful payload = 9600 × (8/10) = 7680 bps
- transport efficiency comparative to 14400 bps rate:
η = 7680/14400 ≈ 0.533 i.e., an effective efficiency of about 53.3%

overhead breakdown:
20% from serial framing (start/stop bits)
~26.7% due to physical-layer mechanisms specified as FEC, preambles, and synchronization (S-4539) (2)

It's evident that a RapidM (Rapid Mobile) modem is being utilized that is capable of producing its own test traffic without needing an external server or another device to send data. This feature is frequently known as loopback testing, built-in test signal generation, or self-test mode.
Unfortunately, there is no publically documented message that a circumstantial RapidM modem model generates its own test message, manufacturers frequently keep detailed test features in restricted datasheets. However, RM2, RM5, RM8, and RM10 RapidM modems all support STANAG -4539 and STANAG- 4481. RM2/RM5 are narrowband tactical modems (up to 9600  bps) with built-in test/loopback capabilities. RM8 is simply a strategic/naval narrowband modem supporting 9600–19200  bps and 2G/3G ALE, besides capable of self-generated test traffic. RM10 adds wideband HF (3–24 kHz) while retaining narrowband 4539/4481 support [2].

Regarding the transmitting antenna’s location, both Kosmod and ANgazu performed direction uncovering utilizing the TDoA (Time Difference of Arrival) algorithm, and both results pointed to an area close Casteau-Mons in Belgium, very close to NATO’s form office (3)[3].

Fig. 5 - Direction uncovering results

Direction uncovering results may further substantiate ANgazu’s hypothesis that the signals could represent test transmissions associated with the NATO BRE1TA (BRASS Enhancement 1 method Architecture) program. BRE1TA constitutes a major architectural evolution of the NATO BRASS (Broadcast and Ship-to-Shore) HF communications system, designed to integrate advanced narrowband and wideband HF waveforms, higher spectral efficiency, improved link robustness, and IP-based data services.

Several hours of monitoring on 6063 kHz USB over the past fewer days yielded only occasional short STANAG-4285 300 bps long-interleaver transmissions encrypted with KG-84. Reception was further limited by sporadic fading during the morning sessions.

https://disk.yandex.com/d/CXaz6URgUh-3zg

(1) In Change announcement 1 of MIL-STD-110C (January 2012), the United States Department of defence removed a conviction stating that a “reinserted preamble facilitates acquisition (or re-acquisition) of an ongoing broadcast transmission.” The reason was that the conviction referred to a feature that had become obsolete. Keeping it in the standard could have caused confusion by implying support for a legacy broadcast capability that was no longer part of the modem design.

2) The relation between the nominal user data rate of 9600 bit/s and the over-the-air symbol rate of 2400 baud for the STANAG-4539 QAM-64 waveform is as follows:
- the waveform employs a symbol rate of 2400 symbols per second with 64-QAM modulation, corresponding to 6 bits per symbol. This results in a gross channel bit rate of 14400 bit/s;
- the application of forward mistake correction (FEC) with coding rate R = 3/4 to a user data rate of 9600 bit/s produces a coded bit rate of 12800 bit/s;
- the remaining capacity of 1600 bit/s (14400-12800), representing the difference between the gross channel bit rate and the coded bit rate, is allocated to waveform overhead. This overhead includes, but is not limited to, miniprobes and periodic preamble reinsertion required to support synchronization and channel estimation functions.

Figure below shows an example; the 1-second interval is chosen for ease of presentation.

over-the-air symbols/bits in a 1 second interval (STANAG-4539)

(3) The ultimate office Allied Powers Europe (SHAPE) is the office of NATO's Allied Operations Command (ACO), located in Casteau, close Mons, Belgium. It is liable for the planning and execution of all NATO military operations worldwide.

[1] https://www.radiofrecuencias.es/viewtopic.php?p=12527
[2] https://www.rapidm.com/
[3] https://shape.nato.int/

Idź do oryginalnego materiału