|
|
|
|
|
|
|
Germany ANT Telefunken Burst HF-7000 SF ← DSU-5000
The device measures 224 × 148 × 50 mm and weights 2.6 kg. It is connected to
the HRM-7000 manpack radio via a single
coaxiable cable and can be used to control the radio, as well as for sending
and receiving encrypted text messages.
There is also a bi-directional optical interface for the connection
of peripheral equipment, such as a printer or a
personal computer (PC).
The user interface consists of a 2 × 40 character Liquid Crystal Display (LCD)
and a 47 button tactile keyboard. This includes five soft keys (F1-F5)
that are used for the menu driven operation.
|
|
|
The image below provides an overview of the features of the TCU-7000.
The device is powered by
four internal 3.6V AA-size batteries
that form two separate 7.2V power banks.
One bank is used for powering the microprocessor
and the peripheral parts, whilst the other one is used for powering the
battery-backed CMOS Static RAM and the CMOS Real-Time Clock (RTC).
The latter is controlled by an internal a
tamper switch, which cuts the power
to the Static RAM as soon as the case is opened. This will instantly
delete any cryptographic keys and messages held in memory.
The device has a 1-wire coaxial interface for connection to the
HRM-7000 manpack radio,
and a contactless optical interface
for connection of any further
peripherals or personal computer (PC).
It has a menu-driven user interface
that consists of an LCD and a tactile keyboard. The keyboard holds the
standard 26 characters of the Latin alphabet (A-Z) in US-order (QWERTY),
plus the digits 0-9. In addition there is a SPACE key, a SHIFT-key and an
orange emergency key.
At the top, just below the display, are five context-sensitive soft-keys
(F1-F5), of which the functions are
displayed in the menu.
Punctuation marks are available as a SHIFT-function of the digits 1-9.
|
|
|
Differences with DSU-5000
|
|
|
- Larger enclosure with larger keys
- Green rather than grey
- 2 × 40 character display
- 16-bit processor
- Larger message buffers
- 4 batteries (rather than 2)
- Single-wire interface to radio
- Optical interface for peripherals
- Single PCB
|
|
|
A fully initialised device
will automatically go to sleep if no key has been
pressed for 60 seconds. This puts the device in an extremely low-power state,
whilst the contents of the Static RAM are retained. To wake the device up
again, press the orange button briefly. After 1.5 seconds, the device will
wake up and resume its operation.
|
|
In case of an emergency, for example when security is compromised, it might
be necessary to delete the encryption keys and the messages that are held
in memory. This procedure is known as ZEROIZING. By convention it is
implemented as a two-step procedure, which goes as follows:
|
- When in operation, briefly press the orange button, this interrupts the normal operation of the device and opens the Emergency menu.
- Select the required action
DELETE (F1), ABORT (F2) or CANCEL (F3). and answer any further questions. In case you accidentally pressed the orange button, select END (F5) to resume normal operation.
|
|
During the Cold War many European countries
had a so-called Stay-Behind Organisation (SBO) —
a clandestine organisation that would activate itself in case of
an invasion by the Soviet Union (USSR).
The SBOs had been founded immediately after the end of
World War II (WWII),
in some countries as early as 1946.
As each country's SBO used different (incompatible) equipment, it was
decided in 1980 to develop a new high-end field station — the
FS-5000, codenamed HARPOON.
In 1985, the development contract was awarded to the German company
AEG Telefunken, using the German intelligence
service Bundesnachrichtendienst (BND)
as the intermediary legend.
|
The FS-5000 – shown in the image on the right –
had a modular design, which allowed it to be hidden
more easily than a single bigger device. It also simplified repairs and
allowed the radio to be used in a number of different configurations.
Development took three years, and in 1988 the
FS-5000 (HARPOON) was ready for release.
Between 1988 and 1991, all 854 radio sets of the initial order were delivered
by Telefunken for the total sum of
DM 130 million (EUR 65 million). It has meanwhile become known that
additional sets were supplied between 1991 and 1995.
|
|
|
By 1991 however, following a series of incidents with the Italian SBO
(GLADIO) and the discovery of several caches with weapons – for example in
The Netherlands
– the existence of the clandestine organisations
had become known to the public.
This forced the governments of several European countries
to admit their existence and eventually to dismantle them.
As a result, the newly introduced FS-5000
saw little action and was shelved less than a year after its introduction.
In Germany, the FS-5000 units were stored in the Army
equipment depot in Lorch-Wispertal.
In the meantime, the FS-5000 had attracted the attention
of the Fernspäher — the German Special Forces (SF) —
who wanted a similar radio for operations behind enemy lines.
Unlike the modular FS-5000 however,
the Fernspäher wanted an all-in-one radio with a handheld control
and message device. Telefunken was awarded the development contract
of the new radio system, which was designated
HF-7000. As the development would
take several years, it was decided to take the unused German
FS-5000 units
from storage, and convert them for Fernspäher use.
|
In August 1993, the modified FS-5000 set
– designated FS-5000M – was released.
The firmware had been simplified and the menus translated to German.
Many of the stay-behind-specific features, which were of little or no
interest to the Fernspäher, had been removed.
In addition, the control unit (DSU)
had been detached and was connected to
the radio set by means of a
1 metre long multi cable.
It allowed the Fernspäher to continue their training and prepare for
the forthcoming HF-7000
(in particular the HRM-7000 manpack radio
with TCU).
|
|
|
|
Development of the HF-7000 system
took several years, but the availability of
newer components allowed the new
manpack (HRM-7000)
to be considerably smaller
and less heavy than the FS-5000.
The new control unit – TCU-7000 – was
watertight and had an enhanced 2 × 40 character display, allowing intuitive
menu-driven control. Rather than using a multi cable, the TCU-7000 is connected
to the HRM-7000 radio by means of a single wire coaxial cable with TNC
connectors.
|
Although different brand names can be found on TCU-7000 units, they were
all manufactured in the same factory in Backnang, albeit under different
ownership. When development started in 1994, the company was known as
ANT Nachrichtentechnik, a former subsidary of AEG Telefunken
that had been sold in 1983 to a consortium consisting of
Bosch, Mannesmann and Allianz.
For this reason the name
ANT is still cast inside the case shells.
By the time the device was ready for production (1997), the company had
meanwhile become a full daughter of Bosch,
hence the name Bosch on the
serial number label at the back.
Production was later moved to Telefunken Racoms
— the manufacturer of the HF-7000 radio —
which was eventually taken over by the Israeli Elbit.
|
The TCU-7000 is housed in a watertight die-cast aluminium enclosure
that consists of two parts: (1) the upper case shell that contains the
printed circuit board (PCB), the display and the keyboard, and (2)
the bottom panel that contains the two battery compartments. Both parts
are cast with the logo of ANT — the original developer of the device.
The interior can be accessed by removing 7 screws from the edges
of the bottom panel, after which the bottom can be taken off.
Note that the bottom panel is connected to the PCB by means of a
4-wire cable with a connector
at the centre of the bottom panel. Separate the
connector to allow the
bottom panel to be removed.
Inside the case shell is
the printed circuit board (PCB) of which the
bottom side is immediately
visible, To remove the PCB from the case shell,
disconnect the single-wire interface,
release the keyboard flex wiring
and desolder the legs of the optical transmitter and receiver,
held in the right side panel.
Next, remove 8 screws from the edges of the PCB.
The PCB can now be lifted from the case shell.
The image below shows the top side,
which holds the LCD display.
This side of the PCB holds most of the parts,
in particular the
MC68302 processor — a combination of a Motorola 68000 and a multiprotocol
communication unit — flash memory (EEPROM) and static RAM. The latter is
used for storing sensitive data, such as the encryption keys, which are
retained by the main battery. A tamper switch
at the centre of the board,
cuts the power to the static RAM as soon as the bottom of the case is
removed, which then purges the keys.
The tamper switch is normally engaged by a metal stub at the centre of the
bottom panel's inside.
The bottom side of the PCB,
i.e. the side that is
visible after removing the bottom panel,
holds the keyboard and display connectors, some additional
logic, two large capacitors and a large 64K 16-bit EPROM that holds the
firmware. Also on this side are the I2C interface and the real-time clock (RTC).
The latter is a low-power CMOS device that keeps running
when the device is unpowered.
|
|
When we found the TCU-7000 featured here on a flea market in Germany
in June 2024, it was not in a very good state and it was uncertain whether
it would ever work again. Part of the exterior was
badly corroded, which suggests that the device had
been exposed to water for some time.
|
Opening the device appeared to be a challenge, as two of the screws in the
bottom panel didn't come loose as a result of the corrosion. These two screws
were drilled out and their remains were removed from the treads with special
tools.
Once the bottom panel was removed, we were able to inspect the interior.
The image on the right shows that most of the corrosion is
concentrated around
the area of two optical interface ports.
Apparently these ports are not as watertight as they should have been,
as a result of which water had gradually been able to enter.
|
|
|
|
After desoldering the optical transmitter and receiver from the PCB, the
gold-plated legs of these components immediately fell off. As this cannot be
fixed, they will have to be replaced. Luckily, the device can be used without
the optical interface. After removing the PCB, the two case halves were
thoroughly cleaned after which the corrosion of the interior and exterior
was scraped off.
|
The damaged parts of the exterior where then repainted with a carefully mixed
paint that matches the original colour. Next, both sides of the PCB
were thoroughly cleaned with special substances,
especially around the optical interface.
It turned out that electrolyte had been leaking from the
large 1000µF capacitor at the bottom of
the PCB, which had caused minor damage to the PCB. It was
replaced by a modern alternative and the PCB was cleaned and preserved.
The PCB was then re-seated in the case, after which keyboard
and 1-wire interface were reconnected.
|
|
|
|
At this point it was decided to leave the optical interface unused for now,
as suitable replacement parts had not yet been located. After reconnecting the
battery compartment, the bottom panel was mounted in place again. Next,
four military 3.6V AA-size lithium batteries were installed in the two
battery compartments. They provide two separate 7.2V supply voltages;
one of which is only used to power the Static RAM chips and the RTC.
After pressing the orange button on the keyboard,
the device gradually came to life with an
initialisation message and
a memory test.
|
Two screws binding Exterior badly corroded Interior partly corroded PCB partly corroded - Optical interface broken
100µF capacitor leaking
|
- Two binding screws drilled out, thread cleared
- Interior cleaned, corrosion removed
- Exterior cleaned, corrosion removed, partly repainted
- Opto transmitter and receiver removed
- Both sides of PCB thoroughly cleaned
- 1000µF capacitor replaced
- Four 3.6V Lithium batteries fitted
|
Device Terminal control unit Purpose Secure messaging and control of HF-7000 radio Model TCU-7000 Manufacturer ANT, see below Reseller TST, see below Year 1997 Classification NATO Confidential Display 2 × 40 characters Keyboard 47 buttons (including 5 soft keys) Interfaces TNC (HRU, CCU), Optical (peripherals) Power 2 × 7.2V (internal) Batteries 4 × 3.6V AA-size Lithium Tempest AMSG 784 B EMC VG 95332 EMP VG 95373, VG 95903 Approval BSI-Z-0004-2004, BSI-VSA 10281 [2] Temperature -20°C to +55°C Dimensions 205 × 120 × 38 mm Weight 990 g (with batteries)
|
TCU-7000 Initial version (1997), developed by ANT, sold by Bosch TCU-7000L ? TCU-7000XP Combination of TCU-7000 and TCU-7000L (R&S, 2004) TCU-7000E Elbit version (2022)
|
- MC68302, Integrated multiprotocol processor
Motorola, 1995.
- µPD43256B, 32KB CMOS Static RAM
NEC Corporation, 1990. Version May 1997 N.
- X28C256, 5 Volt, byte-alterable EEPROM
Xicor, 1991. Version 1 August 1997.
- PCF8583, Clock and calendar with 240 byte RAM
NXP (formerly: Philips), version 6 October 2010.
- PCF8584, I2C-bus controller
NXP (formerly: Philips), 1997.
- AM27C1024, 1 Megabit (65K × 16 bit) CMOS EPROM
AMD, May 1998.
- MAX635, Inverting Switching Regulator (-5V)
Maxim, 1991.
- VP2206, P-Channel enhancement-mode vertical DMOS FET
Spupertex Inc., 2013.
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Sunday 07 July 2024. Last changed: Tuesday, 16 July 2024 - 09:10 CET.
|
 |
|
|
|
