Below are the SAQ videos of the transmitting on Alexanderson’s day (05.07.2020) on VLF 17.2kHz:

Two transmissions took place:

RX: SQ2BXI (Gdańsk Poland) and Ado (Kosice Slovakia)

TNX Ado!

Unfortunately the annual SAQ Christmas transmission has been cancelled in 2020.

We would like to wish the a Merry Christmas to the SAQ team and all of our readers. Stay in good health.

In 2019 i’ve written that the SQ5BPF grabbers will be  temporarily offline and should return in winter 2019. Unfortunately this “moment” got extended to august 2021.

Now, finally, I’m trying to reactivate them, The VLF antenna has been installed again. For now I’ve activated the ZEVS 82Hz and VLF 8270Hz grabbers. Because of changes in vlfrx-tools noiseblanker from versions 0.6 to 0.9, i will be trying to find the parameters for best reception, so please stay tuned, the grabbers might not be operating at their best right now.

The rest of the grabbers will be activated shortly.

As before, i’m recording the while 0-24kHz bandwidth, and keeping the recordings for a few days. They can be provided to interested parties upon request (for scientific reasons etc).

After a long period of inactivity the RSDN stations are active again. Right now (12 october 2021) three frequencies are active: 11.9kHz, 12.65kHz, 14.88kHz.

This is a hyperbolic navigation system, which broadcasts a periodic carrier. More information is avaliable here: http://www.vlf.it/alphatrond/alpha.htm

For people interested in VLF this is a great test signal, whch can be used to check receiving equipment.

RSDN 2021

Christmas transmission from SAQ on 17.2kHz, 24 December 2021 8:00 UTC

Received at SQ5BPF QTH Warsaw/Poland KO02md.

E-field active antenna, vlfrx-tools and Spectrum Lab receiver.

On the recording one can see a weak carrier between the symbols. This is because the keying circuit leaks a weak carrier. The leakage is about 2kW.

QTH Jacek / SQ5BPF Warsaw KO02md

The message was:

THIS IS GRIMETON RADIO STATION/SAQ IN A TRANSMISSION USING THE ALEXANDERSON 200KW ALTERNATOR ON 17.2KHZ. = WE WISH YOU ALL A MERRY CHRISTMAS AND A HAPPY NEW YEAR. = SIGNED WORLD HERITAGE GRIMETON RADIO STATION AND THE ALEXANDER GRIMETON FRIENDSHIP ASSOCIATION.= FOR QSL INFO PLEASE READ OUR WEBSITE ALEXANDER.N.SE. DE SAQ SAQ SK

We have published data from observations of the ELF spectrum 80-84Hz (ZEVS) over a period of a few months.

The data is avaliable here: https://klubnl.pl/zevs/

Russia uses radiocommunications in the ELF band to send messages to it’s  nuclear submarine fleet. This transmitter it called ZEVS, the frequency is 82Hz (yes: hertz, not kilohertz, not megahertz). For more info see here: http://www.vlf.it/zevs/zevs.htm

I’ve installed a grabber on the KLUBNL.PL page showing the spectrum around 82Hz. It is available here: https://klubnl.pl/wpr/index.php/klubnl-pl-grabbers/grabber-zevs-82hz/

This grabber calculates the spectrum in 80-84Hz every 60 seconds, and makes spectrograms out of it. The files with the spectrum information are not deleted, so out out of coincidence i have a history of data from 25 August 2021 until now (around 10 June 2022).

And since i have this data, it would be nice to do an analysis how the messages to the submarine fleet look like, and how often are they transmitted.

WHAT is ZEVS

ZEVS is a transmitter located on the Kola penisula in Russia. It transmits around 82Hz. For more info see here: http://www.vlf.it/zevs/zevs.htm

Radio waves can enter a conductor into a depth which is proportional to the wavelength (the “skin effect”). At a frequency of 82Hz the wavelength is around 3500km, so electromagnetic waves of this frequency can penetrate deeply into even a good conductor. An example of such well conducting medium is ocean saltwater, where the russian nuclear fleet is hidden.

How does the ZEVS transmission look like

ZEVS uses MFSK modulation (multiple frequency shift keying). The messages are transmitted as 4 minute symbols on the following frequencies around 82Hz every 0.2Hz: 80.8Hz, 81.0Hz, 81.2Hz, 81.4Hz, 81.6Hz, 81.8Hz, 82.0Hz, 82.2Hz, 82.4Hz, 82.6Hz, 82.8Hz, 83.0Hz, 83.2Hz. The symbol time is 4 minutes.

A typical message starts with a signal at 82.0Hz which lasts at least 4 minutes (the symbol time). Then usually 7 symbols are transmitted (with a frequency other than 82.0Hz).  Then a 82.0Hz signal is transmitted for a duration of at leat one symbol time (usually longer). After this another message may be transmitted.

The transmission speed is very low. One symbol takes 4 minutes, so the transmission speed is 0.00416 baud. One symbol can have 12 possible values (frequencies), so the resulting transmission speed is 0.05 bit/s.

With this low transmission speed, only short messages are possible, like “go to the surface and start radio contact” (transmission on higher frequencies, possibly via satellite) etc.

Analysing ZEVS messages

Grabber ZEVS uses vtnspec from the excellent vlfrx-tools software package. My scripts produce a file containing the amplitude and phase of signals at 80-84Hz. These files are produced every 60 seconds, and are not deleted afterwards, so i have a dataset from 25 August 2021 (when the grabber was started).

I’ve published the analysis software on github: https://github.com/sq5bpf/zevs-analysis , and the raw dataset on  https://klubnl.pl/zevs/ .

The file names are named after the unix time (seconds since January 1st 1970). Every file has 4 columns, we will use the 1st (frequency) and the 4th (RMS signal magnitude). Below is an example fragment of such file:

80.00000800 2.080809e-05 -6.614392e-06 1.543902e-05
80.01667460 -9.690319e-07 -1.231563e-05 8.735385e-06
80.03334120 -1.651825e-05 -1.124793e-05 1.413097e-05
80.05000780 3.791154e-05 4.053642e-05 3.924593e-05
80.06667440 -1.471637e-05 5.985279e-06 1.123377e-05
80.08334100 -9.629256e-06 -3.050421e-05 2.261890e-05
80.10000760 2.780673e-05 -5.441355e-05 4.320908e-05
80.11667420 1.100251e-05 -1.696162e-05 1.429601e-05
80.13334080 -9.189010e-06 9.730371e-06 9.463563e-06
80.15000740 -1.405457e-05 1.576747e-05 1.493560e-05
80.16667400 1.738760e-05 -1.409283e-05 1.582618e-05
80.18334060 -1.262028e-05 1.509170e-05 1.391098e-05
80.20000720 8.167513e-06 -4.741268e-06 6.677870e-06

The script parse_zevsdir.py parses these files and for each file shows the strongest frequency among the ZEVS frequencies (80.8Hz, 81.0Hz, 81.2Hz, 81.4Hz, 81.6Hz, 81.8Hz, 82.0Hz, 82.2Hz, 82.4Hz, 82.6Hz, 82.8Hz, 83.0Hz, 83.2Hz). The output columns are: unix time, frequency, frequency number, ratio between the magnitude of the signal at this frequency and average magnitude of the signals at all ZEVS frequencies. Below is a sample fragment of the zevs_freqs_sort.txt file produced by this software:

1632377640 82.0 6 3.995966126481902
1632377700 82.0 6 4.556940016791662
1632377760 82.0 6 4.633025466806067
1632377820 82.0 6 3.3868055060207185
1632377880 82.0 6 4.740975119809921
1632377940 82.0 6 5.11617772048708
1632378000 81.8 5 4.459848476522538
1632378060 81.8 5 4.015745251712207
1632378120 81.8 5 4.694808175258413
1632378180 81.8 5 4.106103048877824
1632378240 81.0 1 3.5646719240089353
1632378300 81.0 1 3.615036406798705
1632378360 81.0 1 4.2008744417491215
1632378420 81.0 1 5.590069419164877
1632378480 82.2 7 3.146938764362389
1632378540 82.2 7 4.295193254532285
1632378600 82.2 7 4.868673065778755
1632378660 82.2 7 4.732058527394183
1632378720 80.8 0 4.15435113800186
1632378780 80.8 0 4.522000216433235

The second script find_zevs_transmissions.py looks for a message sequence in this data. The sequence is: 82.0Hz , a message consisting of frequencies other than 82.0Hz, 82.0Hz. The result has the following columns: UTC time, number of symbols in the message, the symbol frequencies, a text representation of this message (each frequency is represented by one letter), the number of times this message appeared. Below is a sample fragment of the zevs_messages.txt file produced by this software:

2021-08-26 04:08:00+00:00 | 7 tones: [81.8, 81.8, 81.8, 80.8, 81.8, 81.8, 81.8] fffAfff ( 1 )
2021-08-26 04:40:00+00:00 | 7 tones: [82.4, 81.6, 81.4, 80.8, 82.4, 81.6, 81.4] IEdAIEd ( 1 )
2021-08-27 06:04:00+00:00 | 7 tones: [81.4, 82.6, 82.6, 80.8, 81.4, 82.6, 82.6] djjAdjj ( 1 )
2021-08-27 06:36:00+00:00 | 7 tones: [82.6, 82.8, 81.0, 80.8, 82.6, 82.8, 81.0] jKbAjKb ( 1 )
2021-08-27 11:52:00+00:00 | 7 tones: [81.0, 81.0, 82.8, 80.8, 81.0, 81.0, 82.8] bbKAbbK ( 2 )
2021-08-27 22:48:00+00:00 | 7 tones: [82.2, 82.2, 81.0, 80.8, 82.2, 82.2, 81.0] hhbAhhb ( 1 )
2021-08-28 03:32:00+00:00 | 7 tones: [82.4, 81.0, 82.6, 80.8, 82.4, 81.0, 82.6] IbjAIbj ( 1 )
2021-08-29 05:16:00+00:00 | 7 tones: [81.6, 81.4, 81.8, 80.8, 81.6, 81.4, 81.8] EdfAEdf ( 1 )
2021-08-30 04:28:00+00:00 | 7 tones: [82.8, 81.0, 81.0, 80.8, 82.8, 81.0, 81.0] KbbAKbb ( 1 )
2021-08-31 03:48:00+00:00 | 7 tones: [81.0, 81.4, 82.8, 80.8, 81.0, 81.4, 82.8] bdKAbdK ( 1 )
2021-09-01 05:40:00+00:00 | 7 tones: [81.2, 83.0, 82.6, 80.8, 81.2, 83.0, 82.6] CljAClj ( 1 )
2021-09-10 07:28:00+00:00 | 7 tones: [82.4, 81.6, 81.0, 80.8, 82.4, 81.6, 81.0] IEbAIEb ( 1 )
2021-09-11 03:20:00+00:00 | 7 tones: [82.8, 83.0, 82.6, 80.8, 82.8, 83.0, 82.6] KljAKlj ( 1 )

Using this software we can automatically find all of the times when a message was transmitted, the message contents, and generate spectrograms of all messages. The spectrograms can be used to assess different types of ZEVS messages.

ZEVS message types

The most common message starts with 82.0Hz (one symbol time – 4 minutes), then 7 symbols with frequencies other than 82.0Hz, and then 82.0Hz again usually for much longer than one symbol time (much more than 4 minutes). This type of message is the most frequent:

Often the 82.0Hz is transmitted for much longer, sometimes many hours. The rest of the message structure is the same (82.0Hz, 7 symbols, 82.0Hz):

In many systems using MFSK there is an additional tone transmitted if the previous tone would be repeated (this is called the repeat tone). In case of ZEVS this is not used, and we can see one frequency repeating for the duration of two or even three symbol times. Below we can see three consecutive symbols with the same frequency:

The messages can be sent immediately one after the other. In this case we see the 82.0Hz carrier, 7 symbols, short 82.0Hz carrier, another 7 symbols and 82.0Hz carrier:

In some cases the 82.0Hz carrier between the messages is shortened to one symbol time. Below is an example of 3 messages being sent one after the other: long 82.0Hz carrier, 7 symbol message, 82.0Hz carrier with a length of 2 symbols, a second 7 symbol message, 82.0Hz carrier with a length of 1 symbol, a third 7 symbol message, and a long 82.0Hz carrier:

Sometimes there are messages which have a different number of symbols than 7. Below a message with a 82.0Hz carrier, 2 symbols, 82.0Hz (1 symbol length), 7 symbols, and a 82.0Hz carrier.  This shows that there are other valid message structures besides the 82.0Hz, 7 symbol message, 82.0Hz type. I don’t know it this is one message, or two messages (a 2 symbol message, and a 7 symbol message):

There are also messages which don’t end with 82.0Hz. Below one 82.0Hz symbol, then a 4 symbol message, a long period of silence, and then a normal message (one 82.0Hz symbol, 7 symbol message, long 82.0Hz carrier). I don’t know if the first 4-symbol message is a valid message, maybe the propagation was suddenly worse and I didn’t receive all of it (doesn’t seem so), or maybe the message was cancelled mid-transmission, or maybe this is a valid message, and i can’t rely on the ending 82.0Hz carrier (in this case my software needs to be corrected):

The second message can also be different than 7 symbols. Below we have a 82.0Hz carrier, a 7 symbol message, one 82.0Hz symbol, 8 well visible symbols, 2 less visible symbols at 80.8Hz (I’m not sure if this isn’t interference), and a 82.0Hz carrier:

I’ve also seen the frequency jump to a frequency not normally used. Below we have a short jump at the beginning of the fourth symbol. I don’t know if this is very strong and short interference, a different encoding or operator error, some different message, or a means to cancel the message mid-transmission:

How often are the same messages transmitted

The messages should be encrypted, so should seem random to an external observer. In my analysis a single message doesn’t repeat more than 3 times, with most of them are unique. Out of 401 detected messages 316 are unique.

Summary

I’ve published a dataset from a period of 9 months (with approximately 2 months of breaks) from an ELF receiver monitoring ZEVS at 80.0-84.0Hz. I have also published (simple) software to automatically analyze this data:

• automatically find the ZEVS transmit frequency
• automatically find the ZEVS messages
• analyze and visualize this data
• automatically generate spectrograms of these messages, to assess the performance of this software

I hope that other may be published from  hobbyists, geophysical monitoring stations etc, so that we can compare results.

By publishing this i hope for some peer review. I hope that others will critically analyze this data and software, and will try to take the analysis further, or try to invalidate it.  The algorithms used are quite naive, the spectrum could be glanced over by a human to see if there aren’t some completely different message types which were not caught by this software.

If you use this work, or have any comments, please send me an email

Author: Jacek Lipkowski SQ5BPF 

This article is published under the Attribution 4.0 International (CC BY 4.0)
https://creativecommons.org/licenses/by/4.0/

In the last article i’ve written about a method of automatically finding ZEVS trasmissions, and an analysis of it’s messages: Analysis of ZEVS messages

Luckiny i have data from 25 August 2021 until now. Using it i can check if anything has changed during the Russian invasion of Ukraine in 2022.

These are encrypted military messages. So there is no reason to analyze them, right?

Is there any sense to analyze ZEVS?

Such an analysis should not be feasible at all. These types of transmissions are encrypted, so we can’t analyze their contents anyway.

Additionally the number of messages in any time period should be more or less the same, do that traffic analysis is not possible. In case when there are no meaningful messages to transmit, dummy messages should be sent, do that the adversary sees the same amount of messages every time period.

So, from the above description one can clearly see that analyzing this traffic is pointless.

But what if the number of messages sent is an average of 2 per day, and there is a need to urgently send more?

Traffic analysis of ZEVS messages

It is very easy to count the amount of messages sent each day.

All is documented in the github repository: https://github.com/sq5bpf/zevs-analysis i the runme.sh script. The amount of messages per day is in the zevs_messages_perday.txt file. The first column is the date, and the second colums is the number of messages sent this day. Below is a sample framgent of this file:

2021-08-26 2
2021-08-27 4
2021-08-28 1
2021-08-29 1
2021-08-30 1
2021-08-31 1
2021-09-01 1
2021-09-10 1
2021-09-11 1
2021-09-12 1
2021-09-13 1
2021-09-14 1
2021-09-15 1
2021-09-19 1
2021-09-20 3

We can use gnuplot co conviniently make a graph of the data in this file. This is done by the plot.sh script. The while graph is avaliable here:: https://raw.githubusercontent.com/sq5bpf/zevs-analysis/main/zevs_messages_perday.pdf

We can see that usually the script detects around 1-3 messages per day. In the days when there are 0 messages either the grabber was down, or the antenna was disconnected (because of thunderstorms etc).

There are quite few days with more than 3 messages detected:

2021-08-27 4
2021-12-11 5
2021-12-15 5
2022-01-19 4
2022-01-29 7
2022-02-09 4
2022-02-10 5
2022-02-11 6
2022-02-12 4
2022-02-13 4
2022-02-21 4
2022-02-23 4
2022-02-24 7
2022-03-01 4

It’s interesting that the peak of activity is a few weeks before the russian invasion of Ukraine in 2022-02-22:

It’s also interesting that beginning march 2022 they were back to sending 1-3 messages per day, so it was back to “business as usual”.

Summary

OI’ve published the spectrum in 80-84Hz in 1 minute intervals from a period of about 9 months (with some pauses in the data): Data from ELF 82-84Hz observations over a few months has been published

I’ve published an analysis of the ZEVS messages: Analysis of ZEVS messages

It seems from this analysis that a short time before the russian invasion of Ukraine in 2022-02-22 more messages were being sent to the russian nuclear submarine fleet.

I hope that others will analyze this data and will try to extend or criticise this analysis. The algorithms used are a quite naive. It would be benifical to manually glance over the data and to see if other messages haven’t been missed by this software.

If you use this work, or have any comments, please send me an email

Author: Jacek Lipkowski SQ5BPF 

This article is published under the Attribution 4.0 International (CC BY 4.0)
https://creativecommons.org/licenses/by/4.0/

In previous articles i’ve shown some typical ZEVS messages , and an analysis of the amount of messages per day .

This repository has all of the scripts used during the analysis: https://github.com/sq5bpf/zevs-analysis

So what more could we get out of the opublished ZEVS dataset ?

Analyzing the 82.0Hz carrier

Before and after the message an 82.0Hz carrier is transmitted. Sometimes it’s transmitted only for a while:

And sometimes it is transmitted for much longer:

So i did an analysis how many minutes the carrier is on each day. The analysis is done by the find_zevs_activity.py script.

A large pdf file with the analysis is here: https://raw.githubusercontent.com/sq5bpf/zevs-analysis/main/zevs_activity.pdf

It seems that the amount of minutes that i receive the 82Hz carrier each day is more or less the same (where there are 0 minutes, it usually means a problem with the receiver). But i can observe periods when ZEVS transmits much less of the 82.0Hz carrier:

2021-11-30 - 2021-12-09
2022-03-07 - 2022-03-13
2022-05-17 - 2022-06-10

These dates don’t seem to match any historical events that i know of (maybe someone else has an idea what they might be?).

During these periods the normal 1-3 messages per day is transmitted. The amount of messages per day can be seen here:: zevs_messages_perday

Interrupted carrier on 82.0Hz

On 2021-10-26 at 9:00 ZEVS transmitted an interrusped carrier 82.0Hz:

The same repeated on 2021-10-27 at 9:00:

I found this while manually looking over parts of the spectrum.

Amateur radio operators will often send dots (short carrier, break, short carrier, break etc) as a test signal. Maybe someone is also testing the ZEVS transmitter.

If you use this work, or have any comments, please send me an email

Author: Jacek Lipkowski SQ5BPF 

This article is published under the Attribution 4.0 International (CC BY 4.0)
https://creativecommons.org/licenses/by/4.0/