The purpose of this page is to bring to light the methods that various systems use to scramble video and encode audio. It will also discuss the manner in which original manufacturer's equipment detects current scrambling modes to properly re-construct video and the methods/proposed methods to use with the 3Chip style of descramblers. Although rumored that all this information is available on the Internet, it has eluded me. There are a few excellent sources of information out there and I will make reference to and links where possible.
The information gathered here is from a multitude of origins. A lot came from some original Cable-FAQs that I have no idea who authored. I am on a GI/Jerrold system and therefore can only really comment on that system. Any other information may or may not hold true, but that itself opens to encourage dialog so that we can make this information accurate and available. If possible, credit to each of the sources will be made.
I strongly encourage everyone to participate in the creation of this page. I you have details about a specific scrambling method, please email me, Dave2. Even if you can confirm the correct assumptions made about a system, it would greatly help in maintaining accurate information. I will make every attempt to keep this page and the information on it up to date and correct.
General
Most analog systems today use sync suppression. This is where the Horizontal Sync Pulse is modified in a manner that renders the signal useless. Televisions can not synchronize the signal correctly and therefore the picture is wavey and rolls. As well, the colour control circuitry can not decode the picture properly and therefore produce a lot of strange colours. There are many methods of modifying the Horizontal Sync including suppression, inversion, all the way to completely removing it. The method used is determined by the manufacturer of the system. Here are two images which show the picture of a normal video image and a scrambled video image (from Steele). Both images are shifted to allow viewing of the Vertical Blanking Interval (VBI) and the Horizontal Syncs. The VBI is the line running across the image and the Horizontal Syncs form the line running from the top down to the bottom of the image. Notice on the scrambled image, the line created by the Horizontal Syncs is white, grey, and white. This shows that the DC level of the Horizontal Syncs is raised into the white level. In the normal image, the Horizontal Syncs appear as a dark grey and a definite black. These images appear to be from a Zenith SSAVI System as evident by the dark and light spots seen in the VBI (almost like upside down or backwards alpha-numerics). Also of interest (I've never really looked at video like this) but you can actually see the pre-equalizing pusles, vertical blanking serration pulses, and the post-equalizing pulses in the VBI.
Zenith SSAVI/ZTAC (NTSC)
Sync Suppression and Active Video Inversion (SSAVI) is the type of scrambling that Zenith employs in their systems. ZTAC is an acronym for Zenith Tiered Addressable Converter. Besides suppressing sync pulses in gated-sync fashion, video inversion is used to yield four scrambling modes (suppressed sync, normal video; suppressed sync, inverted video; normal sync, inverted video; and normal sync, normal video). The horizontal sync pulses of an SSAVI signal can be absent completely, at the wrong level, or even present, and can be varied on a field-by-field basis. Any decoder for a SSAVI or similar system has to be able to separate a video line into its two basic components-- the control and picture signals. In SSAVI, the horizontal sync is never inverted, even if the picture is.
A method of inverting the picture without inverting the control section is necessary. This is complicated by the fact that almost every line in an SSAVI signal has no horizontal sync information, making it difficult to perform the separation since the usual reference point, the horizontal sync pulse, is gone. In the older suppressed-sync system, the sync pulse could be recovered from the gating signal buried in the audio subcarrier, but SSAVI is pilotless. The key to this system relies on the strict timings imposed by the NTSC standard--if you can locate one part of the signal accurately, you can determine where everything else should be mathematically. Since the cable company is sending a digital data stream---the security and access-rights--during the VBI of the signal, the VBI makes a great place to find a known point in the signal. Obviously if the electronics in the cable box can locate this information, so can electronics outside the cable box!
The only constant in the SSAVI system are the horizontal sync pulses during the VBI (the first 26 lines of video), which are sent "in the clear". The pulses from the VBI can be used as a reference for a phase-locked loop (PLL) and used to supply the missing pulses for the rest of the video frame. With 20 or so reliable pulses at the beginning of each frame, you can accurately generate the missing 240 or so pulses. Of the 26 lines in the VBI, lines one through nine are left alone by request of the FCC, lines 10 to 13 are commonly used to transmit a digital data stream, line 21 contains closed-caption information, while other lines are used for a variety of stuff depending on the cable system and the channel you're watching. When you tune to a scrambled channel with a cable box, logic circuits in the unit count the video lines, read the transmitted data stream, and compare the transmitted data with the information stored in the box.
If the box is authorized to receive the signal with that particular data stream, the decoder is enabled and the scrambled signal becomes viewable. If not, the signal is passed through without being decoded, or more commonly, a barker channel (whose channel number is sent via the data stream) is automatically tuned instead. This prevents people from using the unit as a tuner for add-on descramblers.
In the SSAVI system, the video can be sent with either normal or inverted picture information. The descrambler needs a way to determine whether to invert the video or not. Originally this information could be found on line 20, but has since moved around a lot as the popularity and knowledge of the system increased. In any event, the last half of the line would tell the decoder whether to invert the picture or not. If the rest of the field was not inverted, the last half of the line would be black. If the video in the rest of the frame was inverted, the last half of the line would be white.
The 3Chip Revision 7 code looks for data on lines 10-16 (image from MagicBoxes). If data is found on at least 4 of these lines then this is a Zenith video signal. If data is found on line 10, then check line 20 for the invert decision(image from MagicBoxes). If data is NOT on line 10, then check line 22 for the invert decision.
Zenith SSAVI/ZTAC (PAL)
I'll simply redirect here to a very well written document by Pekka Ala-Mäyry of Helsinki, Finland. The document describes the PAL SSAVI(TM) pay-tv scrambling system implemented by the his cable company Tampereen Tietoverkko Oy (TTV).
GI/Jerrold (NTSC)
The GI/Jerrold systems use sync suppression at 3 attenuation levels (0, 6, and 10dB), video inversion, and audio encoding. One of the last posts from MagicBoxes concluded that all this information was transmitted during the first field on line 18. The difficult part here is that the information on line 18 could also be used for other purposes besides scrambling mode (such as autorization codes). Therefore the correct data packet must be interpretted. From MagicBoxes (a little cleaned up):
Well, here for the first time ever is a a short summary of how GI protects their entire analog line:
1. The data determining invert, sync supp. level, audio privacy is totally located on HL 18
2. The data is in the form of a start bit followed by CRC, then the scrambling level.
3. The bits are 2.2uS wide
4. Only packets with a start bit should be processed.
5. Valid packets appear on every second field, packets without a start bit are random junk.
6. Only packets with a valid CRC are to be considered a mode change packet.
7. A mode change only OCCURS after 2 fields.
8. The packet data is encoded on Line 18 with 3.58Mhz bursts (2.2uS wide)
9. The moment you have been waiting for, the valid mode change packets:
If a mode change packet below is received then mode is changed in 2 fields
Sync Supp. Level Inverted Video Audio Privacy Mode Packet
0db (clear) No No 8A18
0db (clear) Yes No 8838
0db (clear) No Yes 8298
0db (clear) Yes Yes 80B8
6db No No 8B08
6db Yes No 8928
6db No Yes 8388
6db Yes Yes 81A8
10db No No 8610
10db Yes No 8430
10db No Yes 8A90
10db Yes Yes 88B0
* The mode change packet includes the start bit.
The packet dissambled:
[start bit] 0 0 0 [CRC - 4 bits] [audio privacy] 0 [invert bit] [6db bit] [10db bit]
If [audio privacy] = 1 then audio privacy is being used
If [invert bit] = 1 then video will be inverted
Level 6db 10db
0db 1 1
6db 0 1
10db 1 0
Illegal 0 0
Above is the entire scrambling data which can be used to descramble any GI analog system. Notice that the data is NOT encrypted. This data stream (as the authorization stream) are both unencrypted.
Audio (from me Dave2) is usually simply encoded on to a higher carrier frequency than is normally expected by a receiver. On my system (CFT 2014) it is 31.5kHz higher, on others CFT 550 (from jpb) it is 25kHz. Because the audio is still completely in tact, it can't be called scrambling, it is simply modulated at a different frequency. This technique is widely known as SCA or SCS. It is the same manner that Second Audio Program (SAP) on televisions and how stereo FM primarily works. To retrieve the audio, all that needs to be done is to take the audio signal from the FM detector of an IF chip, prior to the de-emphasis circuit, and do an FM detect at the sub-carrier frequency. A simple PLL circuit using a MC14046B or LM/NE565 tuned to the sub-carrier frequency has been shown to work adequately.
Another method I've heard rumors of is identical but is used for stereo encoding. The audio is apparently FM modulated to 250kHz. I've seen US patent information on this one (US 4956862) but haven't had any confirmations yet.
Tocom (NTSC)
Tocom systems perform sync suppression, invert the colour burst (blue people), and have active video invert.
This was pulled from a FAQ, but an obvious mistake was the reference to data being a 53ms (milli seconds) burst. As we all know, one horizontal line (NTSC) only lasts 63.5us (micro seconds).
The Tocom system is similar to the Zenith system since it provides three levels of addressable baseband scrambling: partial video inversion, random dynamic sync suppression and random dynamic video inversion. Data necessary to recover the signal is encrypted and sent during lines 17 and 18 of the VBI (along with head-end supplied Teletext data for on-screen display). The control signal contains 92 bits, and is a 53us burst sent just after the color burst. Up to 32 tiers of scrambling can be controlled from the head-end. Audio is not scrambled.
Jim had stated the 3Chip Revision 7 had code to perform this but it does make itself apparent.
Tocom (PAL)
I believe that all systems from a particular manufacturer will be similiar for both NTSC and PAL. Although not confirmed, the data is believed to be similar to NTSC lines 17 and 18, however on PAL the data is situated on lines 21 and 22. Thanks to Max, we have a hand drawn view of what the Tocom VBI appears like on six different channels. Notice the data situated on lines 21 and 22 of each of the images. Max also drew how Tocom Inverted Video appears.
Dave2
