← Back
Home › Systems › Defense and aerospace

tactical-radio

Carries voice and data between soldiers, vehicles and command posts without fixed infrastructure, using software-defined radios that run interchangeable waveforms.

L3Harris Falcon, Thales PR4G, Rohde & Schwarz SOVERON

Open the tactical-radio pagetactical-radio Hdr histogramdata-structures: Log-linear bucketed histograms with bounded relative error for latency percentilesDeterministic simulationtestingdistributed: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Primary-backup replicationdistributed: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Process supervisionhardware-os: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›Jitter buffermedia: A receiver-side buffer holds packets just long enough, a delay tracked from recent arrivals, to reorder them and hand out media at a steady rate.›Linear predictive coding (LPC)media: Predict each sample from the previous p; code only the small prediction error plus p coefficients. Core of FLAC, speech codecs and the Opus SILK layer.›IP multicastnetworking: Send each datagram once to a class D group address; the network copies it to every joined receiver, and sequence numbers let receivers find loss.›AEAD (AES-GCM,ChaCha20-Poly1305)security: Authenticated encryption that encrypts and detects tampering in one call; the only kind of symmetric encryption you should use.›Aes key wrapsecurity: AES Key Wrap (RFC 3394/5649) and AES-GCM-SIV for deterministic, authenticated wrapping of key materialCoverage-guided fuzzingsecurity: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.›Key rotationsecurity: Rotating keys without downtime: key ids, overlap windows, re-wrapping, JWKS publication, revocationMutual TLSsecurity: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›Secure memory zeroizationsecurity: Keep secrets in one locked, fixed-size, non-copyable region, erase them with writes the compiler must keep, and exclude them from dumps and swap.›Adaptive equalizationsignal-processing: LMS/RLS equalizer filters that invert channel distortion from training or decisionsAloha random accesssignal-processing: Pure/slotted ALOHA random access MAC: collisions, throughput limits, backoffChannel estimationsignal-processing: Pilot-based LS/MMSE channel estimation and interpolation across time and frequencyConvolutional codes and theViterbi decodersignal-processing: Streaming error-correcting code: each output bit is a parity of the last K input bits; the Viterbi decoder finds the most likely path through a 2^(K-1)-state trellis.›Frequency hopping spreadspectrumsignal-processing: Hop carrier frequency over a pseudorandom sequence shared by key and time so jamming and interception cover only a few hopsLdpc codessignal-processing: Low-density parity-check codes with soft-decision min-sum decoding, used in NAND flashLink adaptationsignal-processing: Choose modulation and coding from channel quality with outer-loop BLER controlMesh routingsignal-processing: Routing in low-power wireless meshes (RPL, Thread, mesh flooding) with link-quality metricsOfdm modulationsignal-processing: OFDM via IFFT/FFT, cyclic prefix, subcarrier mapping and PAPR handlingPhase-locked loop (digital)signal-processing: Feedback loop that locks a local oscillator to the phase and frequency of an input tone; the core of carrier recovery, clock recovery and GNSS tracking.›Ptt floor controlsignal-processing: Push-to-talk floor arbitration: grant one talker per group, with priority, pre-emption, queueing and talk-burst timeoutsReed-Solomon codessignal-processing: Byte-oriented MDS code: n-k parity symbols correct (n-k)/2 unknown symbol errors or n-k known erasures; the workhorse for bursts, QR codes, discs and storage.›Symbol timing recoverysignal-processing: Gardner/Mueller-Muller timing error detectors with interpolators for symbol synchronizationTdma schedulingsignal-processing: Time-slot scheduling of shared radio links among users/beamsPoint-in-time recoverystorage: Periodic base backups plus a continuously archived change log let you rebuild the state as of any instant, then branch from there.›Graceful drainingsystems: On a termination signal, stop taking new work, finish in-flight work until a deadline, tell clients to reconnect elsewhere, then exit; clients resume from a token.›Priority and preemptionsystems: Priority classes, quota and evicting lower-priority work to admit higherCooperative schedulingconcurrency: Green threads/coroutines yielding at await points on a user-space schedulerFault injectiondistributed: Inject latency, errors, kills and partitions via proxies, netem or hooksRecord replaydistributed: Record every nondeterministic input (time, randomness, I/O, model and tool outputs, per-tick player input) and re-execute deterministically for debugging, replays and state rebuildLeasesdistributed: A lock that expires on its own: bounded-time ownership that survives crashes and partitions, given bounded clock drift and fencing tokens on writes.›Health checkingsystems: Decide per backend whether to route to it using probes and real-traffic errors, with consecutive-count hysteresis, capped ejection and a panic fallback.›A/V sync and media clocksmedia: How audio and video stay lip-synced: per-stream timebases, PTS/DTS, PCR and RTCP clock mapping, and a master clock that slave streams chase by dropping, repeating or resampling.›Packet loss concealmentmedia: Synthesize missing audio frames from prior signal (pitch repetition, neural PLC)RTP and RTCPmedia: RTP stamps each media packet with sequence number, media-clock timestamp and source ID; RTCP reports loss, jitter, round trip and clock mapping within a bandwidth cap.›PRNGs (PCG, xoshiro)numerics: Small, fast, statistically strong non-cryptographic generators: PCG32 and xoshiro256**, with seeding, parallel streams and unbiased ranges.›Scalar quantizationsearch-sort: Per-dimension int8/binary quantization of vectors with rescoringIIR and FIR filterssignal-processing: Two ways to shape a sampled signal's spectrum: FIR (finite taps, always stable, exact linear phase) or IIR (feedback, a few coefficients, cheap but phase-distorting).›Constant time codesecurity: Writing secret-dependent code without branches or memory lookups on secrets; constant-time compare and select+ 24 moreTransparent interceptionnetworking: Redirect traffic to a local proxy (iptables TPROXY/REDIRECT, eBPF) without app changesSyscall interceptionsecurity: Intercept syscalls via ptrace, seccomp user notify or a user-space kernelFencing tokensdistributed: A number that grows with every lock grant and is checked by the protected resource, so a paused ex-holder's late write is rejected.›Media containersmedia: MP4/ISO BMFF, fragmented MP4/CMAF, Matroska and MPEG-TS mux/demuxRecurrent networksmachine-learning: GRU and LSTM cells for streaming sequence modelsBiquad filterssignal-processing: Second-order IIR sections (RBJ cookbook): low/high pass, peaking EQ; stable cascades+ 7 moreEbpfhardware-os: Verified in-kernel programs on hooks (kprobes, XDP, tc) with mapsPtrace process controlhardware-os: Ptrace: attach, read and write registers and memory, single-step, intercept signalsSeccomp bpfsecurity: Syscall filtering with seccomp BPF programs+ 6 more

How it is built

Architecture overview

A tactical radio carries voice and data between soldiers, vehicles and command posts with no fixed infrastructure. Modern sets are software-defined: one hardware platform (RF front end, converters, processors, crypto module) runs a waveform, and the waveform is the software that defines modulation, coding, hopping, medium access and networking. A transmission goes through a fixed chain: voice or data is compressed, encrypted, protected with an error code, spread or hopped, and modulated; the receiver synchronises to it, estimates the channel, equalises, decodes, decrypts and plays out. Several radios form a net or a mesh in which every node is also a router. The one idea that makes it work is a stack of loops that each repair what the radio channel breaks: timing and phase loops keep the receiver locked, the equaliser undoes the multipath, the code corrects what is left, link adaptation chooses a rate the channel supports, and the routing layer finds another path when a link is lost. The platform around them is built like any long-running embedded service: supervised processes, replicated management, tested in simulation and fuzzed at the air interface. This page stays at the level of public literature: architecture, data flow and standards, not the performance of any fielded equipment.

Parts:

 microphone ─► vocoder (LPC) ─┐                                                       ┌─► vocoder ─► speaker
 data / IP ───────────────────┼─► encrypt (AEAD) ─► FEC encode ─► (interleave) ─► modulate (hop / OFDM / ...) ─► RF
                              │            ▲                                                ▲
              key store ──────┘            │ OTAR (wrapped keys)                  MAC: TDMA slot / random access
              (zeroize on tamper)          │                                      routing: mesh, multicast, precedence
 ──────────────────────────────── air interface (lossy, shared, contested) ──────────────────────────────
 RF ─► sync (PLL, timing, hop) ─► channel estimate ─► equalise ─► FEC decode ─► decrypt ─► jitter buffer ─► voice / IP
                                                  │
                         link adaptation ◄── quality report ──► control channel / net management (mutual TLS)

How the parts fit together

Synchronisation

A receiver cannot decode until it knows the carrier phase, the symbol clock and the start of the frame. The carrier and symbol clocks are recovered by feedback loops: a Phase-locked loop tracks carrier phase and frequency offset (oscillator error and Doppler between moving vehicles), and Symbol timing recovery (no page yet) tunes the sampling instant so the samples fall at the eye opening of the pulse. Frame sync uses a known preamble. In hopping and TDMA waveforms there is a second kind of synchronisation, network time: all radios in a net must agree on the current slot or hop within a fraction of its length, so one node is the time reference and others acquire and track it, and late joiners acquire it from a sync message. This is the same problem as Clock synchronization in a data centre, without a network to run NTP over.

Channel handling

Radio paths reflect, so symbols smear into each other (multipath) and the channel changes as the radios move. Channel estimation (no page yet) sends known training symbols, compares what arrives with what was sent, and gives the receiver a model of the channel. Adaptive equalization (no page yet) uses that model, or runs decision-directed, to undo the smear; for single-carrier waveforms the equaliser works in the time domain, and OFDM modulation (no page yet) is the alternative for wideband waveforms: split the band into many narrow carriers that each see a flat channel, add a guard interval longer than the delay spread, and equalise with one multiplication per carrier. OFDM costs a higher peak-to-average power ratio, which matters on a battery-powered amplifier; single-carrier waveforms are common at lower rates for that reason.

Error control

Whatever the equaliser leaves is corrected by a code. The classical combination for a noisy channel is a convolutional code decoded by the Viterbi algorithm (Convolutional codes and the Viterbi decoder) as the inner code, with a Reed-Solomon code as the outer code that mops up the bursts the Viterbi decoder produces when it fails; an interleaver between them spreads bursts over many code words. Newer waveforms use LDPC codes (no page yet), decoded iteratively, which come closer to the channel capacity at larger block sizes. The block size is a design choice: long blocks correct better but add latency, which voice cannot afford, so voice and data usually use different code rates and block lengths.

The same channel quality estimates feed Link adaptation (no page yet): choose the modulation, code rate and power the channel supports, step down when errors rise, step up when it is clean. A frequency-hopping waveform (frequency-hopping-spread-spectrum, no page yet) changes carrier frequency in a pseudo-random pattern known to the radios in the net: it is a spread-spectrum technique (Pickholtz, Schilling and Milstein 1982) that shares the band and reduces the effect of narrowband interference and of a single bad channel, and it ties back to synchronisation, because the pattern is generated from a key and the network time. Only these architecture-level facts belong on a public page.

Medium access

Many radios share one channel. TDMA scheduling (no page yet) divides time into slots that are assigned to nodes: no collisions and bounded delay for the slot owner, at the cost of needing network time and a scheduler (a master or a distributed algorithm) that reallocates slots as nodes join and leave. ALOHA random access (no page yet) is the simple counterpart: send when you have something, retry after a random wait on collision. Pure ALOHA reaches at most about 18 % channel use and slotted ALOHA about 37 % (Abramson 1970; Roberts 1975), so tactical designs use random access only for the small, bursty traffic, such as net entry and slot requests, and keep scheduled slots for voice.

Networking

In a mesh every radio forwards for others. Mesh routing (no page yet) chooses paths over links that appear and disappear: proactive link-state (OLSR, RFC 3626), distance-vector with loop avoidance (Babel, RFC 8966) and reactive (AODV, RFC 3561) protocols exist for mobile ad hoc networks, and the link metric matters as much as the protocol: expected transmission count (De Couto et al. 2003) measures delivery probability, not just hop count. Group voice and position reports go to many receivers, and IP multicast fits because a radio broadcast already reaches all neighbours; the multicast tree must follow the mesh. Priority and preemption (no page yet) decides what is sent first when capacity is short and lets a high-precedence message displace a lower one; in military voice networks the precedence levels are standardised and a flash-priority call can drop others.

Voice

Voice must fit a few kilobits per second. Linear predictive coding (LPC) is the family of vocoders behind that: model the vocal tract as a filter, send its coefficients plus the excitation, and rebuild speech at the receiver. NATO standardises a mixed-excitation LPC vocoder (STANAG 4591); an open low-rate vocoder from the same family, Codec 2, is listed below. Over IP meshes the packets arrive with variable delay, so a Jitter buffer trades a small added delay for smooth audio. Radio nets are half-duplex: one talker at a time. ptt-floor-control (no page yet) is the arbitration: a request, a grant, a release, a queue or preemption by priority; 3GPP's mission-critical push-to-talk specification (TS 24.380, media plane control) is the public reference for the protocol.

Security

Traffic is encrypted at the link or end to end with an AEAD cipher, which also authenticates, so tampering is detected. The hard part is keys. Keys are loaded by a fill device, then changed over the air (OTAR) with the new key wrapped under a key-encryption key (AES key wrap, no page yet, RFC 3394) and replaced on a schedule or after a compromise (Key rotation, no page yet). A captured radio must not give up its keys: Secure memory zeroization wipes key memory on a tamper signal or an operator command, and the wipe must be real (volatile memory cleared, not just freed). The management plane (net planning servers, gateways, key management) talks over IP, authenticated both ways with Mutual TLS. Which algorithms a given radio uses is decided by national authorities; the architecture is the same.

Platform and management

The software platform follows the pattern of long-running services. Process supervision restarts a crashed waveform or voice process in place, without rebooting the radio, and applies backoff so a crash loop does not drain the battery. Graceful draining is how a node leaves a mesh or changes waveform: stop accepting new traffic, finish the queued, and announce departure so neighbours reroute early. The net-management servers that hold plans, keys and configuration run as Primary-backup replication with Point-in-time recovery of the database. Voice quality is a latency story, so push-to-talk to audio and per-hop delay are measured with an HDR histogram (no page yet), which keeps the tail visible where an average hides it.

Verification

Protocols with timers, retries and many nodes are hard to test on air. Deterministic simulation testing runs the real MAC and routing code in a simulator with a virtual clock and a seeded random source, injects losses and partitions, and replays any failure exactly. The air interface is also an attack surface: every received frame is parsed, so Coverage-guided fuzzing feeds malformed frames and management messages to the parsers until crashes stop.

Data and control flow

One voice transmission in a TDMA net:

  1. The user presses push-to-talk; floor control grants the talker the net or the slot owner is already the talker.
  2. The vocoder produces a frame every 20 to 30 ms (order of; the exact frame length depends on the vocoder).
  3. The frame is encrypted and authenticated, then encoded and interleaved.
  4. At the start of the node's slot the modulator transmits, on the current hop frequency if hopping.
  5. The receivers acquire timing from the preamble, track the carrier, estimate the channel, equalise and decode.
  6. Decrypted frames enter a jitter buffer, are decoded to speech and played; relays forward the frame in their own slot.
  7. Quality measurements feed link adaptation for the next frames.

One key change (OTAR): the management system wraps the new key under the key-encryption key, sends it over a protected channel to each radio, each radio unwraps and stores it, confirms, and all switch at an agreed time.

One node leaving the mesh: drain queues, send a departure message, neighbours expire the routes, and routes converge on the remaining links.

Scaling

  1. Spectrum. Capacity per net is fixed by bandwidth and SNR; the levers are better coding, adaptation, lower voice rates and spatial reuse (separate nets on separate channels or hop sets).
  2. Hops. Each hop in a mesh divides throughput and adds delay; the levers are fewer hops through higher-power backbone nodes, link-metric routing, and multicast instead of repeated unicast.
  3. Net size. TDMA needs scheduling that grows with nodes; the levers are hierarchical nets (sub-nets joined by gateways) and distributed slot allocation.
  4. Processing. Waveform signal processing sets the power budget; the levers are fixed-function blocks for decoders, fixed-point code, and offloading to a DSP or FPGA behind the waveform interface.
  5. Management. Key and plan distribution to thousands of radios; the lever is staged, signed, wrapped distribution and replicated management servers.

Failure modes

FailureSymptomCauseFix
Loss of lockgarbled audio, link dropsPLL or timing loop slips, Doppler outside the loop rangewider acquisition mode, preamble re-sync, frequency search
Multipath errorshigh error rate that coding cannot fixdelay spread longer than equaliser or guard intervallonger guard, re-estimation, link adaptation to a robust mode
Burst errorsdecoder failure in burstsfades, interferenceinterleaving, outer code, hop away from the bad channel
Time driftnode out of slots or hopsoscillator drift, lost time referencere-acquire from sync message, backup time master
Collision stormnet entry fails under loadrandom access overloadedbackoff, reserved slots, access classes
Mesh oscillationroutes flap, loopspoor link metricssmoothed metrics, hysteresis, loop avoidance
Voice latency tailwords clipped, cross-talkjitter, slow floor releaseadaptive jitter buffer, floor timeout, measured p99
Key mismatchradios hear each other as noiseOTAR not received by allacknowledged distribution, key epoch numbers, fallback key
Key exposurecaptured radio reveals keysmemory not wiped, power loss before wipezeroization on tamper, volatile key store
Process crashsilent radiowaveform bugsupervision with backoff, watchdog, crash dump for later
Malformed framecrash or hangparser bugfuzzing, bounds checks, safe language
Management server lostno new keys or planssingle serverprimary-backup, point-in-time recovery

Real implementations

namewhat it isrepolicencenotes
L3Harris Falcon familycommercial tactical SDR radiosn/aproprietarynamed in the system brief; internals not public
Thales PR4Gcommercial tactical VHF radio familyn/aproprietaryinternals not public
Rohde & Schwarz SOVERONcommercial tactical SDR familyn/aproprietaryinternals not public
GNU Radioopen signal-processing toolkit for building modemsgnuradio/gnuradioGPL-3.0prototyping waveforms; many modem blocks
REDHAWKopen framework for component-based SDR applicationsRedhawkSDR/redhawksee repo (COPYRIGHT file)component and waveform application model
Codec 2open low-bitrate speech codecdrowe67/codec2LGPL-2.1the open counterpart of low-rate LPC vocoders
FreeDVopen digital voice over HF using Codec 2 and an OFDM modemdrowe67/freedv-guiLGPL-2.1 (see repo for BSD parts)an end-to-end low-rate voice link
olsrdOLSR routing daemon for ad hoc networksOLSR/olsrdBSD-style (see repo)RFC 3626 lineage
babeldBabel routing daemonjech/babeldMITRFC 8966

Fielded military waveforms and crypto are not public; this page describes published methods and standards only.

Sources

  • R. L. Pickholtz, D. L. Schilling, L. B. Milstein, Theory of spread-spectrum communications - a tutorial, IEEE Transactions on Communications 1982. doi
  • N. Abramson, The ALOHA system - another alternative for computer communications, AFIPS Fall Joint Computer Conference 1970 (doi 10.1145/1478462.1478502).
  • L. G. Roberts, ALOHA packet system with and without slots and capture, ACM SIGCOMM Computer Communication Review 1975 (doi 10.1145/1024916.1024920).
  • D. S. J. De Couto, D. Aguayo, J. Bicket, R. Morris, A high-throughput path metric for multi-hop wireless routing, MobiCom 2003 (doi 10.1145/938985.939000).
  • IETF RFC 3626 (OLSR) rfc, RFC 8966 (Babel) rfc, RFC 3561 (AODV) rfc, RFC 3394 (AES key wrap) rfc.
  • 3GPP TS 24.380, Mission Critical Push To Talk (MCPTT) media plane control. archive
  • NATO STANAG 4591 (MELPe vocoder), named as the standard; the document is not openly published.
  • GNU Radio site, REDHAWK site, Codec 2 and FreeDV repositories as linked above.

Similar systems

Share the most building blocks with this one.

land-mobile-radio 58 %secrets-kms 29 %full-disk-encryption 26 %hdd 26 %optical-transceiver 25 %