Interpreting the Group 3 FAX Set-up Protocol

This tutorial describes the protocol used to set up voice-channel dial-up facsimile machines which operate in accordance with CCITT Group 3 specifications. This includes both the so-called “standard” protocols where only CCITT-acknowledged capabilities are evoked and the “nonstandard” configuration commands used to evoke proprietary capabilities in the machines built by certain manufacturers. As background, Section 2 describes the transactions conducted between two FAX machines to set up and confirm the transmission of an image. Section 3 then describes the signaling protocol specified by CCITT’s recommendation T.30. Section 4 outlines a program written at Applied Signal Technology for demodulating the protocol’s data sequence and interpreting the information contained within.

Figure 1 shows the timeline of a simple one-page facsimile document transmission between two “dial-up” FAX machines.

The progression goes as follows:

Figure 1. Timeline of the Transactions in a Simple One-document Transmission between two “dial-up” FAX Machines

This procedure is extended according to recommendation T.30 to include provisions for multipage messages, interworking with Group 1 and 2 FAX machines, paging of an operator, direction of the called machine to transmit, and others. They are all based on the simple procedure outlined here, however.

3.1 The Structure of Each Message

As described previously, essentially all of the control interactions between two FAX machines are conducted via a 300 b/s, half-duplex, synchronous serial data link. One machine transmits its control data according to a basic protocol and then removes its carrier. After a brief delay, the other machine then turns on its carrier and then transmits its response. This half-duplex handshaking approach was originally developed to allow reliable operation over two-wire telephone systems where simultaneous operation in both directions at the same frequency is not possible (before the advent of adaptive echo-cancellers).

The structure of the transmitted sequences draws heavily from the concepts used in the “high-level data link control” (HDLC) link-level protocol. The beginning and end of each message are marked with so-called “flag sequences” (specifically the binary sequence 01111110 is used as the “flag”). Each message is broken into one or more “frames” and these are also demarked by flag characters. Even though the message is sent serially, the flag sequences allow the received data to be organized as bytes and in fact the transmission can be thought of as containing a byte-oriented protocol.

Figure 2 shows the form of a FAX message. It consists of one or more frames of information. Only one frame is required for each transmission but others are often sent, particularly in the messages describing a machine’s capabilities. In the cases where extra frames are sent, the required one is always sent last. Figure 2 shows a message with three such frames. The message is begun with a preamble consisting of about one second of flag sequences. Immediately thereafter the first frame begins. There are three flags between frames and at least one following the last frame in the transmission.

Figure 2. The Decomposition of a FAX Control Message into its Constituent Frames (using the initial identification message as an example)

Each frame can be similarly decomposed into fields, including the following:

Thus each control frame consists of at least five bytes, the Address, Control, and FAX Control Field (FCF), at one byte each, and the Frame Checking Sequence (FCS), consisting of two bytes. Depending on the type of FCF, a FAX Information Field may also be included. Its length can be from two to nominally 20 bytes, depending on the particular FCF and on the manufacturer of the machine. At least two flags (01111110) will precede a frame and at least one will follow it.

At one step up in the hierarchy each message consists of one or more frames. There are no transmission gaps between the frames (i.e., V.21 carrier off) but the frames are demarked with flags. In addition at least one second of flags is transmitted at the beginning of each message to allow the receiver to detect the V.21 carrier and lock up to the bit and character clock.

At the highest level each of these messages carries the information needed to execute the “back-and-forth” procedures needed to assess capabilities, control configuration, and assess progress in a FAX transmission session.

The frame’s organization can also be viewed in terms of the more general “high-level data link control” (HDLC) structure commonly used in serial data links. The Address, Control, and Frame Checking Sequence form a “shell” in which an HDLC information field resides. In this case the HDLC information field consists of the FAX Control Field (FCF) and the FAX Information Field (FIF). The T.30 protocol employs another feature of the generic HDLC procedure as well, that of using transparency bits to avoid any confusion between the data patterns seen within the “shell” and information field and the flags used to demark the frames. The HDLC transparency bit scheme directs that a 0 be stuffed into the bit stream immediately after the detection of a string of five ones. As a pointed example consider the cases of the Address and non-final Control bytes, denoted by 1111111111000000. To avoid potential confusion with the flag sequence (01111110), zeros are stuffed in the locations marked by the asterisk (11111*11111*000000), yielding the 18-bit sequence 11111011111000000. Removal of these bits at the receiver is simply done by removing the 0 which follows each run of five ones.

3.2 Interpretation of the FAX Control Field

The CCITT T.30 recommendation lists 21 different allowable frame types as specified by the bits in the FAX Control Field (FCF). These can be divided into three basic classes:

The actual bits used to denote each allowable FCF are shown in Figure 3 along with a simple procedure for decoding the FCF efficiently. Each box contains all of the frame types which can be legally included in the message. Inspection will show that the names of the boxes (e.g., initial ID) correspond to the transactional steps discussed in “The Transactions Associated with Transmission of a Group 3 FAX Image”. for example, the called machine reveals its capabilities with an “initial ID” message consisting of at least a DIS frame (marked with an asterisk as mandatory) but perhaps also a Called Subscriber ID (CSI) frame and/or a Non-standard Facilities (NSF) frame. The caller responds with either a “command to receive” message, telling the called machine to receive and in what mode, or a “command to transmit” message, telling the called machine the caller’s capabilities and transferring control to the called party. After training the receiver sends a “pre-message response” consisting of a single frame, either a “confirm for receive” (CFR) frame or a “failure” to train (FTT) frame. Similarly, after the image transmission, short post-message commands and responses provide status, shift control, solicit operator assistance, and/or terminate the procedure.

Figure 3. Interpretation of the FAX Control Field (FCF)

Thus the frames in each box comprise the messages needed to carry out the transaction discussed in “The Transactions Associated with Transmission of a Group 3 FAX Image”. The capability and configuration command messages may consist of several frames, even though one type of frame (marked with the asterisk) is required for each “capabilities message,” which the “pre- and post-message” messages (meaning actually pre- and post-image transmission messages) consist of only one frame. An example of the former can be seen by re-examining the diagram shown in Figure 2. This is an “initial identification” message. It has one mandatory frame, the Digital Information Signal, which identified CCITT-recognized capabilities of the called FAX machine. Two optional frames are also shown, both of which precede the DIS. The first is the Non-standard Facilities (NSF) field which identifies capabilities of the called machine or procedures used by the machine which are at variance with those recommended by CCITT. (Non-standard operations are discussed in “Specification of capabilities not recognized by CCITT.”) The second optional field available for use in an initial ID message is the Called Subscriber Identification (CSI) frame which allows the transmission of the called machine’s telephone number. Having this number at the caller’s machine allows, for example, the caller to confirm that he has reached the intended machine. This is equivalent to the Who are you? query and response in teletype machines.

The last observation needed about the FCF concerns the leading bit in the byte, marked as x in Figure 3. Generally speaking the x-bit is set to 1 for all frames (and hence messages) from the machine sending the FAX image to the one receiving it. Conversely “pre-message” and “post-message” responses from the receiver to the transmitter set that bit to 0. When control is shifted from one machine to the other (with the “command to send” message) then the machines change roles and the x-bits are changed in their messages to each other. the exception to this rule comes at the initiation of the FAX call. At this point the x-bit defines the difference between the initial ID message and the command-to-send message. Once the initial handshake is complete (ID then command-to-send, or ID then command-to-send then command-to-receive), then the identity of the transmitter and receiver are known and the x-bit is set as originally discussed.

3.3 Interpretation of the FAX Information Field

There are three basic types of FAX Information Fields:

As mentioned earlier the other twelve allowed frame types do not use the FAX Information Field (FIF).

The format of each of these information fields is described in the following subsections.

3.3.1 CCITT-Recognized Capabilities

As explained above, this information field describes the CCITT-recognized capabilities of a FAX machine or directs its configuration into a CCITT-recognized state. Frame types using this information field include the Digital Information Signal (DIS), the Digital Transmit Command (DTC), and the Digital Control Signal (DCS). This field uses three or four bytes and the meaning of each control bit is specified in Table 2/T.30 of CCITT recommendation T.30. It is reproduced as Table 1 in this technical note. The first byte concerns the capabilities of the machine to operate as a CCITT group 1 or 2 machine, as specified in CCITT recommendations T.2 and T.3. When indicating capabilities (the DIS and DTC frames) only bits 2, 3, and 5 can be set to 1. The Digital Control Signal (DCS), however, can set bits 1 and 4 to evoke the use of the Group 1 and Group 2 transmitter if the receiving machine has indicated a capability. Bytes 2 and 3 indicate the capabilities for Group 3 operation, indicating the modem types available for image transmission, vertical line resolution (100 or 200 lines/inch), 1- or 2-D image encoding, and the maximum height and width of an image. The DCS frame uses this same format, but its bits are interpreted as configuration commands instead of capabilities. This distinction can be seen, for example, in the “data signaling rate” subfield where (11) indicates the capability to operate in either V.27 or V.29 modes while the (11) for the DCS frame commands the use of the 7200 b/s mode of V.29.

The fourth byte appears only if bit 24 is set to one. This fourth byte also has an “extended bit” as bit 32, but the ability to extend the frame to a fifth byte is not discussed in the T.30 recommendation.

Table 1. Table 2/T.30 of CCITT Recommendation T.30: Interpretation of the FAX Information Field for the DIS, DTC, and DCS Frames.

Bit No	DIS/DTC	DCS
1	Transmitter - T.2 operation
2	Receiver - T.2 operation	Receiver — T.2 operation
3	T.2 IOC = 176	T.2 IOC = 176
4	Transmitter - T.3 operation
5	Receiver - T.3 operation	Receiver — T.3 operation
6	Reserved for future T.3 operation features
7	Reserved for future T.3 operation features
8	Reserved for future T.3 operation features
9	Transmitter - T.4 operation
10	Receiver - T.4 operation	Receiver — T.4 operation
11, 12 (0, 0) (0, 1) (1, 0) (1, 1)	Data signaling rate V.27 ter fallback mode V.27 ter V.29 V.27 ter and V.29	Data signaling rate 2400 bit/s V.27 ter 4800 bit/s V.27 ter 9600 bit/s V.29 7200 bit/s V.29
13	Reserved for new modulation system
14	Reserved for new modulation system
15	Vertical resolution = 7.7 line/mm	Vertical resolution = 7.7 line/mm
16	Two-dimensional coding capability	Two-dimensional coding
17, 18 (0, 0) (0, 1) (1, 0) (1, 1)	Recording width capabilities 1728 picture elements along scan line length of 215 mm ± 1%1728 picture elements along scan line length of 215 mm ± 1% and 2048 picture elements along scan line length of 255 mm ± 1% and 2432 picture elements along scan line length of 303 mm ± 1%1728 picture elements along scan line length of 215 mm ± 1% and 2048 picture elements along scan line length of 255 mm ± 1%Invalid (see Note 7)	Recording width 1728 picture elements along scan line length of 215 mm ± 1%2432 picture elements along scan line length of 303 mm ± 1% 2048 picture elements along scan line length of 255 mm ± 1% Invalid (see Note 7)
19, 20 (0, 0) (0, 1) (1, 0) (1, 1)	Maximum recording length capability A4 (297 mm) Unlimited A4 (297 mm) and B4 (364 mm) Invalid	Maximum recording length A4 (297 mm) Unlimited B4 (364 mm) Invalid
21, 22, 23 (0, 0, 0) (0, 0, 1) (0, 1, 0) (1, 0, 0) (0, 1, 1) (1, 1, 0) (1, 0, 1) (1, 1, 1)	Minimum scan line time capability at the receiver 20 ms at 3.85 1/mm; T7.7 - T3.85 40 ms at 3.85 1/mm; T7.7 - T3.85 10 ms at 3.85 1/mm; T7.7 - T3.85 5 ms at 3.85 1/mm; T7.7 - T3.85 10 ms at 3.85 1/mm; T7.7 - 1/2 T3.85 20 ms at 3.85 1/mm; T7.7 - 1/2 T3.85 40 ms at 3.85 1/mm; T7.7 - 1/2 T3.85 0 ms at 3.85 1/mm; T7.7 - T3.85	Minimum scan line time 20 ms 40 ms 10 ms 5 ms 0 ms
24	Extend field	Extend field
25	2400 bit/s handshaking	2400 bit/s handshaking
26	Uncompressed mode	Uncompressed mode
27	Unassigned
28	Unassigned
29	Unassigned
30	Unassigned
31	Unassigned
32	Extend field	Extend field

3.3.2 Called and Calling Subscriber ID

This information field is used to carry telephone number information about the called or calling party. Frames carrying this information field are the Called Subscriber Identification (CSI), Calling Subscriber Identification (CIG), and the Transmitting Subscriber Identification (TSI) frames. According to recommendation T.30, this field will be the international telephone number including the telephone country code, area code, and subscriber number, and it shall have 20 numeric digits. In actual practice this field appears to be as long as is needed to transmit the phone number (i.e., no fill characters are used to inflate the total to twenty) and no effort is made to force the use of the country code.

The digits are coded into bytes in accordance with Table 3/T.30, which is reproduced as Table 2 in this document, even though the digits and space character conform exactly to their ASCII representations (e.g., space = 20H). The least significant bit of the least significant digit is transmitted first. Thus reading the phone number from left to right corresponds to reading the information field from the end to the beginning. An example is shown in Appendix A.

Table 2. Table 3/T.30 of CCITT Recommendation T.30: Interpretation of the Phone Number Digits used in the CSI, TSI, and CIG Frames.

3.3.3 Specification of Capabilities Not Recognized by CCITT

This type of information field is used to specify the capabilities of the FAX machine not recognized by the CCITT and to set up the machine in one of those modes. Frames using this information field are the Non-standard Facilities (NSF), the Non-standard Capabilities (NSC), and the Non-standard Set-up (NSS) frames. Recommendation T.30 states that the information field must be at least two bytes long, with the first corresponding to the FAX country code of the machine’s manufacturer. Otherwise the contents of the field are completely unspecified. The presumption is that within each country of manufacture a scheme is developed for adding bits to the field which identify the manufacturer and then the manufacturer assigns bits to the field to indicate or command the non-standard capabilities available in the machine. The presumption continues that once the capabilities of a machine are known and the bits associated with each capability are known, then the NSF/NSC/NSS messages can be parsed and interpreted with little more difficulty than that required for the Table 2/T.30 interpretation discussed above.

The first byte of this field is the FAX country code. These codes are listed in Annex A to Recommendation T.35 although the most useful one is probably the one denoting Japan, specifically 00000000.

While not mentioned in the T.30 recommendation it has been observed that some FAX machines will transmit two non-standard frames per message, for example, (NSF NSF CSI DIS) in an initial ID message and (NSS NSS) in a command-to-receive message. the T.30 recommendation indicates that only one such frame will be present. As is shown in Appendix A, the second non-standard frame in the message can be used to send an alphanumeric identification of the called or calling party. Though not documented, it has been found that most of the data in these frames can be interpreted in ASCII using the same rules as those used for the phone number information in the CSI/TSI/CIG frames, that is, the least significant bit of the least significant character is transmitted first. While ASCII decoding has been observed to work in the cases seen so far, the conversion table in use is probably that shown in Figure 1/T.51 of CCITT recommendation T.51—the “primary set of graphical characteristics for telematic services.” It deviates from ASCII in only small ways.

More knowledge about the formats used by the various manufacturers for the non-standard modes must await more analysis. Examination of several machines is planned for the March 1988 time frame at APSG.

A piece of FORTRAN software has been written at Applied Signal Technology for quickly analyzing the messages used to control a FAX image transmission. This section discusses the modules of that code and provides some examples of the demodulated, parsed, and interpreted message data.

4.1 Program Organization

The structure of the FAX protocol analysis programs are shown in Figure 4.

Figure 4. Structure of FORTRAN Programs used to Process and Interpret FAX Control Messages.

Examples of the control messages are obtained by digitizing the waveform and placing them in a disk file. The second program, called V21_FAX, accepts this sampled data and executes the following steps:

The output of V21_FSK is a disk file containing two types of information. The first is the actual data itself, less the transparency bits and augmented with tags showing the start of messages and frames. The second type is a table of statistics which describe the number of messages, the number of frames per message, the number of bytes per frame, and the starting point of each frame in the data stream. This statistical information allows the data in any specific frame to be directly extracted.

The third program, called INTERP_FAX, uses the data stored on the disk to develop a printed report which interprets each of the frames received. For each frame of each message, this program checks the address and control bytes, interprets the FAX control field (using a subroutine called DECODE_FCF which mechanizes the flow graph shown in Figure 3), and then interprets, to the degree possible, that data found in any FAX information fields (FIFs).

4.2 An Extended Example of Frame Interpretation

For this example the transactions between two Ricoh model Rdpicom 200 FAX machines, one located in Sunnyvale, CA and the other located in Herndon, VA, were digitized. While the complete exchange between the two machines took about a minute, only the first 10 seconds of data is described here.

Figure 5a shows the binary stream obtained from the V.21 demodulator for the first four seconds of the digitized data. This string contains ones and zeros, the meaning of which is obvious, but also contains dashes, which indicate that the power level of the FSK signal fell below a threshold during that bit interval. A visual inspection of this data reveals several 01111110 flag sequences. Figure 5b shows the same data record after passing through the FIND_FLAG subroutine. This routine locates the 01111110 flags and replaces them in the data array with the marker “ $ flag # .” In addition the transparency bits (always zeros) are located and replaced with asterisks (*). With the flags marked in this way it is easy to locate the start of the first message and the demarkation between frames.

Figure 5. Binary V.21 Data Processed by the V21_FAX Program.
(a) Raw demodulator bit decisions.
(b) Bit decisions after HDLC flags and transparency bits are locked and tagged.

With the data tagged in this way the subroutine STRIPPER extracts the frames in each message and gathers required housekeeping statistics, such as the number of frames in the message. Figure 6 shows the extracted, tagged bit stream for the first message. All flags have been removed and replaced with markers such as “message” and “frame >.” Also deleted from this bit stream are all the bits not identified as being part of some message.

Figure 6. An Example of the Refined Bit Stream provided by the program V21_FAX.

The program INTERP_FAX decomposes this refined bit stream. A manual example is shown in Figure 7 where the fourth frame of the message shown in Figure 6 is analyzed.

Figure 7. Manual Interpretation of a Digital Information Signal Frame.

The first byte (11111111) is a valid address and the second byte (11001000) is a valid final control byte. The third byte (00000001), the FAX control frame (FCF), indicates a Digital Information Signal (DIS) which implies the presence of a FAX information field (FIF). These bits, interpreted according to Table 2/T.30, indicate the capability to use V.27 and V.29 modems, 2-D image encoding, and 200 lines/inch resolution. The two frame checking sequence bytes follow the four bytes of the FAX information field (FIF).

Appendix A shows the actual output of INTERP_FAX in response to the first ten seconds of the transactions between these two FAX machines. Three messages are seen, the first tells the capabilities of the called machine, the second directs the set-up of the called machine as a “non-standard” receiver, and the third confirms readiness for image reception (the CFR frame) by the receiver after the modem training sequence is sent by the image transmitter.

Sampled data file name: astl:[rossin.data]grp3_1.jrt
FAX control message #: 1
	Frame #: 1
		Valid FAX address
		Valid FAX control byte - Non-final frame
		Non-standard facilities (NSF)
			Called to calling subscriber
			FAX machine of Japanese manufacture
			Control bits for non-standard modes:
			Bits 12345678 : 00000000
			Bits 12345678 : 10100100
			Bits 12345678 : 00000000
			Bits 12345678 : 11111111
			Bits 12345678 : 01111111
			Bits 12345678 : 01001000
			Bits 12345678 : 00001000
			Bits 12345678 : 10110000
			Bits 12345678 : 00000000
			Bits 12345678 : 00000000
			Bits 12345678 : 00000000
			Bits 12345678 : 00000000
			Bits 12345678 : 00000000
			Bits 12345678 : 00001100
			Bits 12345678 : 00000000
		Normal frame termination
	Frame #: 2
		Valid FAX address
		Valid FAX control byte - Non-final frame
		Non-standard facilities (NSF)
			Called to calling subscriber
			FAX machine of Japanese manufacture
			Control bits for non-standard modes:
			Bits 12345678 : 00000000
			Bits 12345678 : 10100100
			Bits 12345678 : 10000000
			ASCII string: AST VIRGINIA
			Normal frame termination
	Frame #: 3
		Valid FAX address
		Valid FAX control byte - Non-final frame
		Called subscriber identification (CSI)
			Called to calling subscriber
			Identification number: 703 471 8915
		Normal frame termination
	Frame #: 4
		Valid FAX address
		Valid FAX control byte - Final frame
		Digital information signal (DIS)
			Called to calling subscriber
			Table 2/T.30 translation:
			Receiver - T.4 operation (Group 3) Capable of V.29 and V.27 ter operation Vertical resolution = 200 lines/inch Two-dimensional coding Recording length - A4 page
			Extend field present
		Normal frame termination
FAX control message #: 2
	Frame #: 1
		Valid FAX address
		Valid FAX control byte - Non-final frame
		Non-standard facilities setup (NSS)
			Transmitter to receiver
			FAX machine of Japanese manufacture
			Control bits for non-standard modes:
			Bits 12345678 : 00000000
			Bits 12345678 : 10100100
			Bits 12345678 : 00000000
			Bits 12345678 : 00000000
			Bits 12345678 : 00000000
			Bits 12345678 : 01000000
			Bits 12345678 : 00001000
			Bits 12345678 : 10110100
			Bits 12345678 : 00000000
			Bits 12345678 : 00000000
			Bits 12345678 : 00000000
			Bits 12345678 : 00000000
			Bits 12345678 : 00000000
			Bits 12345678 : 00001100
			Bits 12345678 : 00000000
			Normal frame termination
	Frame #: 2
		Valid FAX address
		Valid FAX control byte - Final frame
		Non-standard facilities setup (NSS)
			Transmitter to receiver
			FAX machine of Japanese manufacture
			Control bits for non-standard modes:
			Bits 12345678 : 00000000
			Bits 12345678 : 10100100
			Bits 12345678 : 10000000
			ASCII string: APPLIED SIGNAL TECH
		Normal frame termination
FAX control message #: 3
	Frame #: 1
		Valid FAX address
		Valid FAX control byte - Final frame
		Confirmation to receive (CFR)
			Receiver to transmitter
		Normal frame termination