{"id":1526,"date":"2022-06-16T09:21:01","date_gmt":"2022-06-16T09:21:01","guid":{"rendered":"https:\/\/klubnl.pl\/wpr\/?p=1526"},"modified":"2022-07-04T23:25:54","modified_gmt":"2022-07-04T23:25:54","slug":"analysis-of-zevs-messages","status":"publish","type":"post","link":"https:\/\/klubnl.pl\/wpr\/en\/2022\/06\/16\/analysis-of-zevs-messages\/","title":{"rendered":"Analysis of ZEVS messages"},"content":{"rendered":"

Russia uses radiocommunications in the ELF band to send messages to it’s\u00a0 nuclear submarine fleet. This transmitter it called ZEVS, the frequency is 82Hz (yes: hertz, not kilohertz, not megahertz). For more info see here: http:\/\/www.vlf.it\/zevs\/zevs.htm<\/a><\/p>\n

I’ve installed a grabber on the KLUBNL.PL page showing the spectrum around 82Hz. It is available here: https:\/\/klubnl.pl\/wpr\/index.php\/klubnl-pl-grabbers\/grabber-zevs-82hz\/<\/a><\/p>\n

This grabber calculates the spectrum in 80-84Hz every 60 seconds, and makes spectrograms out of it. The files with the spectrum information are not deleted, so out out of coincidence i have a history of data from 25 August 2021 until now (around 10 June 2022).<\/p>\n

And since i have this data, it would be nice to do an analysis how the messages to the submarine fleet look like, and how often are they transmitted.<\/p>\n

\"Example
The spectrum of an example ZEVS transmisson. The signal around 83.3-83.5Hz is some local interference.<\/figcaption><\/figure>\n

<\/p>\n

WHAT is ZEVS<\/h4>\n

ZEVS is a transmitter located on the Kola penisula in Russia. It transmits around 82Hz. For more info see here: http:\/\/www.vlf.it\/zevs\/zevs.htm<\/a><\/p>\n

Radio waves can enter a conductor into a depth which is proportional to the wavelength (the “skin effect”). At a frequency of 82Hz the wavelength is around 3500km, so electromagnetic waves of this frequency can penetrate deeply into even a good conductor. An example of such well conducting medium is ocean saltwater, where the russian nuclear fleet is hidden.<\/p>\n

How does the ZEVS transmission look like<\/h4>\n

ZEVS uses MFSK modulation (multiple frequency shift keying). The messages are transmitted as 4 minute symbols on the following frequencies around 82Hz every 0.2Hz: 80.8Hz, 81.0Hz, 81.2Hz, 81.4Hz, 81.6Hz, 81.8Hz, 82.0Hz, 82.2Hz, 82.4Hz, 82.6Hz, 82.8Hz, 83.0Hz, 83.2Hz. The symbol time is 4 minutes.<\/p>\n

A typical message starts with a signal at 82.0Hz which lasts at least 4 minutes (the symbol time). Then usually 7 symbols are transmitted (with a frequency other than 82.0Hz).\u00a0 Then a 82.0Hz signal is transmitted for a duration of at leat one symbol time (usually longer). After this another message may be transmitted.<\/p>\n

The transmission speed is very low. One symbol takes 4 minutes, so the transmission speed is 0.00416 baud. One symbol can have 12 possible values (frequencies), so the resulting transmission speed is 0.05 bit\/s.<\/p>\n

With this low transmission speed, only short messages are possible, like “go to the surface and start radio contact” (transmission on higher frequencies, possibly via satellite) etc.<\/p>\n

Analysing ZEVS messages<\/h4>\n

Grabber ZEVS<\/a> uses vtnspec<\/a> from the excellent vlfrx-tools<\/a> software package. My scripts produce a file containing the amplitude and phase of signals at 80-84Hz. These files are produced every 60 seconds, and are not deleted afterwards, so i have a dataset from 25 August 2021 (when the grabber was started).<\/p>\n

I’ve published the analysis software on github: https:\/\/github.com\/sq5bpf\/zevs-analysis<\/a> , and the raw dataset on\u00a0 https:\/\/klubnl.pl\/zevs\/<\/a> .<\/p>\n

The file names are named after the unix time (seconds since January 1st 1970). Every file has 4 columns, we will use the 1st (frequency) and the 4th (RMS signal magnitude). Below is an example fragment of such file:<\/p>\n

80.00000800 2.080809e-05 -6.614392e-06 1.543902e-05\r\n80.01667460 -9.690319e-07 -1.231563e-05 8.735385e-06\r\n80.03334120 -1.651825e-05 -1.124793e-05 1.413097e-05\r\n80.05000780 3.791154e-05 4.053642e-05 3.924593e-05\r\n80.06667440 -1.471637e-05 5.985279e-06 1.123377e-05\r\n80.08334100 -9.629256e-06 -3.050421e-05 2.261890e-05\r\n80.10000760 2.780673e-05 -5.441355e-05 4.320908e-05\r\n80.11667420 1.100251e-05 -1.696162e-05 1.429601e-05\r\n80.13334080 -9.189010e-06 9.730371e-06 9.463563e-06\r\n80.15000740 -1.405457e-05 1.576747e-05 1.493560e-05\r\n80.16667400 1.738760e-05 -1.409283e-05 1.582618e-05\r\n80.18334060 -1.262028e-05 1.509170e-05 1.391098e-05\r\n80.20000720 8.167513e-06 -4.741268e-06 6.677870e-06<\/pre>\n
The script parse_zevsdir.py parses these files and for each file shows the strongest frequency among the ZEVS frequencies (80.8Hz, 81.0Hz, 81.2Hz, 81.4Hz, 81.6Hz, 81.8Hz, 82.0Hz, 82.2Hz, 82.4Hz, 82.6Hz, 82.8Hz, 83.0Hz, 83.2Hz). The output columns are: unix time, frequency, frequency number, ratio between the magnitude of the signal at this frequency and average magnitude of the signals at all ZEVS frequencies. Below is a sample fragment of the zevs_freqs_sort.txt file produced by this software:<\/p>\n
1632377640 82.0 6 3.995966126481902\r\n1632377700 82.0 6 4.556940016791662\r\n1632377760 82.0 6 4.633025466806067\r\n1632377820 82.0 6 3.3868055060207185\r\n1632377880 82.0 6 4.740975119809921\r\n1632377940 82.0 6 5.11617772048708\r\n1632378000 81.8 5 4.459848476522538\r\n1632378060 81.8 5 4.015745251712207\r\n1632378120 81.8 5 4.694808175258413\r\n1632378180 81.8 5 4.106103048877824\r\n1632378240 81.0 1 3.5646719240089353\r\n1632378300 81.0 1 3.615036406798705\r\n1632378360 81.0 1 4.2008744417491215\r\n1632378420 81.0 1 5.590069419164877\r\n1632378480 82.2 7 3.146938764362389\r\n1632378540 82.2 7 4.295193254532285\r\n1632378600 82.2 7 4.868673065778755\r\n1632378660 82.2 7 4.732058527394183\r\n1632378720 80.8 0 4.15435113800186\r\n1632378780 80.8 0 4.522000216433235<\/pre>\n
The second script find_zevs_transmissions.py looks for a message sequence in this data. The sequence is: 82.0Hz , a message consisting of frequencies other than 82.0Hz, 82.0Hz. The result has the following columns: UTC time, number of symbols in the message, the symbol frequencies, a text representation of this message (each frequency is represented by one letter), the number of times this message appeared. Below is a sample fragment of the zevs_messages.txt file produced by this software:<\/p>\n
2021-08-26 04:08:00+00:00 | 7 tones: [81.8, 81.8, 81.8, 80.8, 81.8, 81.8, 81.8] fffAfff ( 1 )\r\n2021-08-26 04:40:00+00:00 | 7 tones: [82.4, 81.6, 81.4, 80.8, 82.4, 81.6, 81.4] IEdAIEd ( 1 )\r\n2021-08-27 06:04:00+00:00 | 7 tones: [81.4, 82.6, 82.6, 80.8, 81.4, 82.6, 82.6] djjAdjj ( 1 )\r\n2021-08-27 06:36:00+00:00 | 7 tones: [82.6, 82.8, 81.0, 80.8, 82.6, 82.8, 81.0] jKbAjKb ( 1 )\r\n2021-08-27 11:52:00+00:00 | 7 tones: [81.0, 81.0, 82.8, 80.8, 81.0, 81.0, 82.8] bbKAbbK ( 2 )\r\n2021-08-27 22:48:00+00:00 | 7 tones: [82.2, 82.2, 81.0, 80.8, 82.2, 82.2, 81.0] hhbAhhb ( 1 )\r\n2021-08-28 03:32:00+00:00 | 7 tones: [82.4, 81.0, 82.6, 80.8, 82.4, 81.0, 82.6] IbjAIbj ( 1 )\r\n2021-08-29 05:16:00+00:00 | 7 tones: [81.6, 81.4, 81.8, 80.8, 81.6, 81.4, 81.8] EdfAEdf ( 1 )\r\n2021-08-30 04:28:00+00:00 | 7 tones: [82.8, 81.0, 81.0, 80.8, 82.8, 81.0, 81.0] KbbAKbb ( 1 )\r\n2021-08-31 03:48:00+00:00 | 7 tones: [81.0, 81.4, 82.8, 80.8, 81.0, 81.4, 82.8] bdKAbdK ( 1 )\r\n2021-09-01 05:40:00+00:00 | 7 tones: [81.2, 83.0, 82.6, 80.8, 81.2, 83.0, 82.6] CljAClj ( 1 )\r\n2021-09-10 07:28:00+00:00 | 7 tones: [82.4, 81.6, 81.0, 80.8, 82.4, 81.6, 81.0] IEbAIEb ( 1 )\r\n2021-09-11 03:20:00+00:00 | 7 tones: [82.8, 83.0, 82.6, 80.8, 82.8, 83.0, 82.6] KljAKlj ( 1 )<\/pre>\n
Using this software we can automatically find all of the times when a message was transmitted, the message contents, and generate spectrograms of all messages. The spectrograms can be used to assess different types of ZEVS messages.<\/p>\n
ZEVS message types<\/h4>\n
The most common message starts with 82.0Hz (one symbol time – 4 minutes), then 7 symbols with frequencies other than 82.0Hz, and then 82.0Hz again usually for much longer than one symbol time (much more than 4 minutes). This type of message is the most frequent:<\/p>\n
\"\"<\/p>\n
Often the 82.0Hz is transmitted for much longer, sometimes many hours. The rest of the message structure is the same (82.0Hz, 7 symbols, 82.0Hz):<\/p>\n
\"\"<\/p>\n
In many systems<\/a> using MFSK there is an additional tone transmitted if the previous tone would be repeated (this is called the repeat tone). In case of ZEVS this is not used, and we can see one frequency repeating for the duration of two or even three symbol times. Below we can see three consecutive symbols with the same frequency:<\/p>\n
\"\"<\/p>\n
The messages can be sent immediately one after the other. In this case we see the 82.0Hz carrier, 7 symbols, short 82.0Hz carrier, another 7 symbols and 82.0Hz carrier:<\/p>\n
\"\"<\/p>\n
In some cases the 82.0Hz carrier between the messages is shortened to one symbol time. Below is an example of 3 messages being sent one after the other: long 82.0Hz carrier, 7 symbol message, 82.0Hz carrier with a length of 2 symbols, a second 7 symbol message, 82.0Hz carrier with a length of 1 symbol, a third 7 symbol message, and a long 82.0Hz carrier:\"\"<\/p>\n
Sometimes there are messages which have a different number of symbols than 7. Below a message with a 82.0Hz carrier, 2 symbols, 82.0Hz (1 symbol length), 7 symbols, and a 82.0Hz carrier.\u00a0 This shows that there are other valid message structures besides the 82.0Hz, 7 symbol message, 82.0Hz type. I don’t know it this is one message, or two messages (a 2 symbol message, and a 7 symbol message):<\/p>\n
\"\"<\/p>\n
There are also messages which don’t end with 82.0Hz. Below one 82.0Hz symbol, then a 4 symbol message, a long period of silence, and then a normal message (one 82.0Hz symbol, 7 symbol message, long 82.0Hz carrier). I don’t know if the first 4-symbol message is a valid message, maybe the propagation was suddenly worse and I didn’t receive all of it (doesn’t seem so), or maybe the message was cancelled mid-transmission, or maybe this is a valid message, and i can’t rely on the ending 82.0Hz carrier (in this case my software needs to be corrected):<\/p>\n
\"\"<\/p>\n
The second message can also be different than 7 symbols. Below we have a 82.0Hz carrier, a 7 symbol message, one 82.0Hz symbol, 8 well visible symbols, 2 less visible symbols at 80.8Hz (I’m not sure if this isn’t interference), and a 82.0Hz carrier:<\/p>\n
\"\"<\/p>\n
I’ve also seen the frequency jump to a frequency not normally used. Below we have a short jump at the beginning of the fourth symbol. I don’t know if this is very strong and short interference, a different encoding or operator error, some different message, or a means to cancel the message mid-transmission:<\/p>\n
\"\"<\/p>\n
How often are the same messages transmitted<\/h4>\n
The messages should be encrypted, so should seem random to an external observer. In my analysis a single message doesn’t repeat more than 3 times, with most of them are unique. Out of 401 detected messages 316 are unique.<\/p>\n
Summary<\/h4>\n
I’ve published a dataset from a period of 9 months (with approximately 2 months of breaks) from an ELF receiver monitoring ZEVS at 80.0-84.0Hz. I have also published (simple) software to automatically analyze this data:<\/p>\n