From: James M. Atkinson, Comm-Eng Date: Fri Jun 30, 2000 11:29pm Subject: Sub-Carriers "Dogs have fleas..." A Bomber Pilot, a Chaplain, and Stripper walk into a bar ... (oops, wrong message) ;-) Please allow me to shed a little illumination of the discussion about Sub-C signals and how they relate to TSCM. Before I start rambling on about the subject let me point out that it takes at least 2-3 days of classroom instruction to teach a TSCM'er to deal with Sub-C threats, this posting just barely addresses the subject. 1) A Carrier must first be demodulated first before extracting any SubCarrier 2) A SubCarrier is a secondary signal (or signals) CONCEALED inside the bandwidth of another signal. 3) The primary carrier may be modulated any number of ways including FM, AM, Pulse and so on. 4) Ditto on the SubCarrier 5) The most popular FM broadcast band "Sub Carriers" are based on the 19 kHz pilot signal. 6) The most popular TV broadcast band "Sub Carriers" are based on the horizontal retrace signals (15/15.734 kHz). 7) There are minor variations to the number 5 and 6, but they are limited, and may include fractional signals. 8) SubCarrier signals may be voice, data, telemetry, video or any number of other signals (ie: LoJack, water meters, alarm systems, weather reports, fax transmissions, Medical Paging systems, GPS correction signals, etc). 9) SubCarrier signals may (and often do) include tone masking or other signals to deceive the TSCM specialist. 10) Do not confuse a VLF or carrier current signal with a SubCarrier signal... the delineation is that a SubCarrier signal is WITHIN THE BANDWIDTH of another signal. Of course you can have a Carrier Current signal that contains a SubCarrier signal. 11) The "cleanest" way to handle SubCarrier is to use TWO spectrum analyzers, or a multi-channel SA. 12) Use the first spectrum analyzer to measure the bandwidth of the primary carrier (in the case of a typical FM radio station this would be +/- 75 kHz) 13) Next, place the first SA into zero span mode and demodulate the primary signal (the display on the SA will look like an O'Scope) 14) Grab the video signal (Y-Axis) coming out of the back of your SA and feed it to your second SA (or the second channel on your primary SA). Hint: Some spectrum analyzers used for TSCM have more then one frequency domain input. 15) Now display the demodulated signal from the first SA on the 2nd SA (in the Freq. domain), and the SubCarrier peaks should appear with no problem. 16) After you identify the SubCarrier you will find it helpful to filter out the primary signal. In the case of an FM/TV SubCarrier you would kill everything below 15 kHz or so by around 40 dB. 17) Also, once you identify the bandwidth of the SubCarrier you will find it helpful to filter everything outside the bandwidth of the signal. 18) Now place the 2nd SA in Zero Span mode, and observe the signal in the time domain and feed the Y axis into an O'Scope, audio amp (if audio) or RAID system (if the signal is repetitive) for further analysis. 19) Of course you can replace either or both SA's with a Sub-C receiver, but do so at your own risk, as you will miss hostile threats. On the other hand you can use a simple SubCarrier demodulator (on your primary SA Y-Axis output) to save copious time in lower threat situations. 20) If you like living dangerously you can use a scanner to pick up the primary signal, tie into the discriminator circuit (just before the low pass filter before the audio amp), and dump it into an SCD-5 (but make sure you get the right impedance input for your application). 21) Always keep in mind that a primary signal may actually have more then one SubCarrier signal. 22) Yes, a SubCarrier can have a SubCarrier. Always remeber... "Dogs have fleas upon there backs to bite um, and fleas have lesser fleas, and so on infinitum..." 23) I STRONGLY encourage people to check the entire bandwidth of the primary carrier, then check the entire bandwidth of any and ALL SubCarrier signals, and then carefully check the frequencies between all SubCarriers. 24) One thing to watch out for are SubCarrier inside ASYNCHRONOUS signals (as opposed to synchronous), and SubCarrier inside pulse modulated signals 25) Here is a good example of pulse modulated SubCarriers: A 30 mV pulse modulated signal riding on the AC mains in traverse mode (at 13 ohm impedance), the signal that comes out of a computer can contains an audio monitoring device/microphone. The device intercepted audio, converted it to a pulse modulated signal, and impressed that signal onto what looked like a "leaking" pulse modulated timing signal (from the video circuit). The results was a pulse modulated audio signal riding inside "the jitter" of another pulse modulated signal. 26) SubCarrier signals often are very narrow bandwidth, with 5 kHz or less being fairly popular. 27) "The bug" may actually impress the SubCarrier into a pre-existing broadcast signals. For example the spy could have his bug pick up a local FM or TV broadcast station, and simple re-transmit it, except with an extra signal inserted. 28) Remember to check all energy for any curiosities, and always investigate in at least the Frequency (SA), Time (O'Scope), Space (DF), and Code domain in addition to the Modulation domain. Just my humble opinion (grin) -jma PS: "Greets" and a hardy welcome to the 50+ .gov/.mil folks lurking on the list.