Click for homepage
Germany
ANT
Telefunken
Burst
HF-7000
SF
  
← DSU-5000
  
TCU-7000
Terminal Crypto Unit

TCU-7000 is a secure message unit for the HRM-7000 special forces (SF) manpack radio set, introduced in 1997 by Bosch in Backnang (Germany), formerly known as ANT Nachrichten­tech­nik. It was marketed by Telefunken System Technik (TST, later: Telefunken Racoms) and is similar to – but more advanced than – the Digital Storage Unit (DSU) of the FS-5000 stay-behind radio set.

The device measures 224 × 148 × 50 mm and weights 2.6 kg. It is connected to the HRM-7000 manpack radio via a single coaxiable cable and can be used to control the radio, as well as for sending and receiving encrypted text messages.

There is also a bi-directional optical inter­face for the connec­tion of peripheral equipment, such as a printer or a personal computer (PC). The user interface consists of a 2 × 40 character Liquid Crystal Display (LCD) and a 47 button tac­tile keyboard. This includes five soft keys (F1-F5) that are used for the menu driven operation.
  

The TCU-7000 was developed as part of the HF-7000 radio system, in particular as an accessory to the HRM-7000 manpack radio. The system was intended for use by the German Special Forces (SF) — known as Fernspäher. The TCU-7000 is approved for messages up to NATO Confidential. Development was started in 1994, hot on the heels of the modular FS-5000 field station that had been developed for NATO's Cold War clandestine stay-behind organisations (SBO), a.k.a. GLADIO.

There are several versions of the TCU-7000, that can be found under a variety of brand names. It is currently unknown how many units were produced over the years. It was approved by the BSI — the German national cypher authority — and the approval has been extended until 2025.

Left angle view
TCU-7000 made by ANT (Bosch) and marketed by TST (Telefunken)
Front panel
Bottom view
Batteries installed
Coaxial connection to HRM-7000 radio
Optical interface with transmitter (left) and receiver (right) and two locking threads
Operating the emergency button
A
×
A
1 / 8
Left angle view
A
2 / 8
TCU-7000 made by ANT (Bosch) and marketed by TST (Telefunken)
A
3 / 8
Front panel
A
4 / 8
Bottom view
A
5 / 8
Batteries installed
A
6 / 8
Coaxial connection to HRM-7000 radio
A
7 / 8
Optical interface with transmitter (left) and receiver (right) and two locking threads
A
8 / 8
Operating the emergency button

Features
The image below provides an overview of the features of the TCU-7000. The device is powered by four internal 3.6V AA-size batteries that form two separate 7.2V power banks. One bank is used for powering the microprocessor and the peripheral parts, whilst the other one is used for powering the battery-backed CMOS Static RAM and the CMOS Real-Time Clock (RTC). The latter is controlled by an internal a tamper switch, which cuts the power to the Static RAM as soon as the case is opened. This will instantly delete any cryptographic keys and messages held in memory.


The device has a 1-wire coaxial interface for connection to the HRM-7000 manpack radio, and a contact­less optical interface for connection of any further peripherals or personal computer (PC). It has a menu-driven user interface that consists of an LCD and a tactile keyboard. The keyboard holds the standard 26 characters of the Latin alphabet (A-Z) in US-order (QWERTY), plus the digits 0-9. In addition there is a SPACE key, a SHIFT-key and an orange emergency key. At the top, just below the display, are five context-sensitive soft-keys (F1-F5), of which the functions are displayed in the menu. Punctuation marks are available as a SHIFT-function of the digits 1-9.

Differences with DSU-5000
Compared to its predecessor the DSU-5000, the following differences are observed:

  • Larger enclosure with larger keys
  • Green rather than grey
  • 2 × 40 character display
  • 16-bit processor
  • Larger message buffers
  • 4 batteries (rather than 2)
  • Single-wire interface to radio
  • Optical interface for peripherals
  • Single PCB
Sleep mode
A fully initialised device will automatically go to sleep if no key has been pressed for 60 seconds. This puts the device in an extremely low-power state, whilst the contents of the Static RAM are retained. To wake the device up again, press the orange button briefly. After 1.5 seconds, the device will wake up and resume its operation.

Zeroizing
In case of an emergency, for example when security is compromised, it might be necessary to delete the encryption keys and the messages that are held in memory. This procedure is known as ZEROIZING. By convention it is implemented as a two-step procedure, which goes as follows:

  1. When in operation, briefly press the orange button, this interrupts the normal operation of the device and opens the Emergency menu.

  2. Select the required action
    DELETE
    (F1),
    ABORT
    (F2) or
    CANCEL
    (F3). and answer any further questions. In case you accidentally pressed the orange button, select END (F5) to resume normal operation.
Fresh startup
Selecting initialisation without CCU
Main menu
Strt and Emergency button
Operating the emergency button
Zeroize menu
TCU-7000 and DSU-5000
ANT logo cast in the two case shells
B
×
B
1 / 8
Fresh startup
B
2 / 8
Selecting initialisation without CCU
B
3 / 8
Main menu
B
4 / 8
Strt and Emergency button
B
5 / 8
Operating the emergency button
B
6 / 8
Zeroize menu
B
7 / 8
TCU-7000 and DSU-5000
B
8 / 8
ANT logo cast in the two case shells

History
During the Cold War many European countries had a so-called Stay-Behind Organisation (SBO) — a clandestine organisation that would activate itself in case of an invasion by the Soviet Union (USSR). The SBOs had been founded immediately after the end of World War II (WWII), in some countries as early as 1946. As each country's SBO used different (incompatible) equipment, it was decided in 1980 to develop a new high-end field station — the FS-5000, codenamed HARPOON. In 1985, the development contract was awarded to the German company AEG Telefunken, using the German intelligence service Bundesnachrichtendienst (BND) as the intermediary legend.

The FS-5000 – shown in the image on the right – had a modular design, which allowed it to be hidden more easily than a single bigger device. It also simplified repairs and allowed the radio to be used in a number of different configurations.

Development took three years, and in 1988 the FS-5000 (HARPOON) was ready for release. Between 1988 and 1991, all 854 radio sets of the initial order were delivered by Telefunken for the total sum of DM 130 million (EUR 65 million). It has meanwhile become known that additional sets were supplied between 1991 and 1995.
  

By 1991 however, following a series of incidents with the Italian SBO (GLADIO) and the discovery of several caches with weapons – for example in The Netherlands – the existence of the clan­des­tine organisations had become known to the public. This forced the governments of several European countries to admit their existence and eventually to dismantle them. As a result, the newly introduced FS-5000 saw little action and was shelved less than a year after its introduction. In Germany, the FS-5000 units were stored in the Army equipment depot in Lorch-Wispertal.

In the meantime, the FS-5000 had attracted the attention of the Fernspäher — the German Special Forces (SF) — who wanted a similar radio for operations behind enemy lines. Unlike the modular FS-5000 however, the Fernspäher wanted an all-in-one radio with a handheld control and message device. Telefunken was awarded the development contract of the new radio system, which was designated HF-7000. As the development would take several years, it was decided to take the unused German FS-5000 units from storage, and convert them for Fernspäher use.

In August 1993, the modified FS-5000 set – designated FS-5000M – was released. The firmware had been simplified and the menus translated to German. Many of the stay-behind-specific features, which were of little or no interest to the Fernspäher, had been removed.

In addition, the control unit (DSU) had been de­tached and was connected to the radio set by means of a 1 metre long multi cable. It allowed the Fernspäher to continue their training and prepare for the forthcoming HF-7000 (in par­ticular the HRM-7000 manpack radio with TCU).
  

Development of the HF-7000 system took several years, but the availability of newer components allowed the new manpack (HRM-7000) to be considerably smaller and less heavy than the FS-5000. The new control unit – TCU-7000 – was watertight and had an enhanced 2 × 40 character display, allowing intuitive menu-driven control. Rather than using a multi cable, the TCU-7000 is connected to the HRM-7000 radio by means of a single wire coaxial cable with TNC connectors.

Manufacturer
Although different brand names can be found on TCU-7000 units, they were all manufactured in the same factory in Backnang, albeit under different ownership. When development started in 1994, the company was known as ANT Nachrichtentechnik, a former subsidary of AEG Telefunken that had been sold in 1983 to a consortium consisting of Bosch, Mannesmann and Allianz. For this reason the name ANT is still cast inside the case shells. By the time the device was ready for production (1997), the company had meanwhile become a full daughter of Bosch, hence the name Bosch on the serial number label at the back. Production was later moved to Telefunken Racoms — the manufacturer of the HF-7000 radio — which was eventually taken over by the Israeli Elbit.


Interior
The TCU-7000 is housed in a watertight die-cast aluminium enclosure that consists of two parts: (1) the upper case shell that contains the printed circuit board (PCB), the display and the key­board, and (2) the bottom panel that contains the two battery compartments. Both parts are cast with the logo of ANT — the original developer of the device. The interior can be accessed by re­mo­ving 7 screws from the edges of the bottom panel, after which the bottom can be taken off.

Note that the bottom panel is connected to the PCB by means of a 4-wire cable with a con­nec­tor at the centre of the bottom panel. Separate the connector to allow the bottom panel to be re­moved. Inside the case shell is the printed circuit board (PCB) of which the bottom side is imme­dia­tely visible, To remove the PCB from the case shell, disconnect the single-wire interface, re­lease the keyboard flex wiring and desolder the legs of the optical transmitter and receiver, held in the right side panel. Next, remove 8 screws from the edges of the PCB. The PCB can now be lifted from the case shell. The image below shows the top side, which holds the LCD display.


This side of the PCB holds most of the parts, in particular the MC68302 processor — a combi­nation of a Motorola 68000 and a multiprotocol communication unit — flash memory (EEPROM) and static RAM. The latter is used for storing sensitive data, such as the encryption keys, which are retained by the main battery. A tamper switch at the centre of the board, cuts the power to the static RAM as soon as the bottom of the case is removed, which then purges the keys. The tamper switch is normally engaged by a metal stub at the centre of the bottom panel's inside.


The bottom side of the PCB, i.e. the side that is visible after removing the bottom panel, holds the keyboard and display connectors, some additional logic, two large capacitors and a large 64K 16-bit EPROM that holds the firmware. Also on this side are the I2C interface and the real-time clock (RTC). The latter is a low-power CMOS device that keeps running when the device is unpowered.

Bottom view
Bottom panel separated from case shell. Note the battery cable.
Case shell with PCB, and bottom panel with batteries
Case shell with PCB
Top side of the PCB
Bottom side of the PCB
PCB - top
PCB - bottom
Tamper switch
Microprocessor, EEPROMs and static RAM
Internal power supply unit (PSU)
Battery wiring detail
Single wire interface
Keyboard flex wiring
Data label for next battery change
Military 3.6V batteries (AA-size)  in battery compartment
C
×
C
1 / 16
Bottom view
C
2 / 16
Bottom panel separated from case shell. Note the battery cable.
C
3 / 16
Case shell with PCB, and bottom panel with batteries
C
4 / 16
Case shell with PCB
C
5 / 16
Top side of the PCB
C
6 / 16
Bottom side of the PCB
C
7 / 16
PCB - top
C
8 / 16
PCB - bottom
C
9 / 16
Tamper switch
C
10 / 16
Microprocessor, EEPROMs and static RAM
C
11 / 16
Internal power supply unit (PSU)
C
12 / 16
Battery wiring detail
C
13 / 16
Single wire interface
C
14 / 16
Keyboard flex wiring
C
15 / 16
Data label for next battery change
C
16 / 16
Military 3.6V batteries (AA-size)  in battery compartment

Restoration
When we found the TCU-7000 featured here on a flea market in Germany in June 2024, it was not in a very good state and it was uncertain whether it would ever work again. Part of the exterior was badly corroded, which suggests that the device had been exposed to water for some time.

Opening the device appeared to be a challenge, as two of the screws in the bottom panel didn't come loose as a result of the corrosion. These two screws were drilled out and their remains were removed from the treads with special tools.

Once the bottom panel was removed, we were able to inspect the interior. The image on the right shows that most of the corrosion is con­cen­trated around the area of two optical inter­face ports. Apparently these ports are not as watertight as they should have been, as a result of which water had gradually been able to enter.
  

After desoldering the optical transmitter and receiver from the PCB, the gold-plated legs of these components immediately fell off. As this cannot be fixed, they will have to be replaced. Luckily, the device can be used without the optical interface. After removing the PCB, the two case halves were thoroughly cleaned after which the corrosion of the interior and exterior was scraped off.

The damaged parts of the exterior where then repainted with a carefully mixed paint that mat­ches the original colour. Next, both sides of the PCB were thoroughly cleaned with special sub­stances, especially around the optical interface.

It turned out that electrolyte had been leaking from the large 1000µF capacitor at the bottom of the PCB, which had caused minor damage to the PCB. It was replaced by a modern alternative and the PCB was cleaned and preserved. The PCB was then re-seated in the case, after which key­board and 1-wire interface were reconnected.
  

At this point it was decided to leave the optical interface unused for now, as suitable replacement parts had not yet been located. After reconnecting the battery compartment, the bottom panel was mounted in place again. Next, four military 3.6V AA-size lithium batteries were installed in the two battery compartments. They provide two separate 7.2V supply voltages; one of which is only used to power the Static RAM chips and the RTC. After pressing the orange button on the keyboard, the device gradually came to life with an initialisation message and a memory test.

Problems
  • Two screws binding
  • Exterior badly corroded
  • Interior partly corroded
  • PCB partly corroded
  • Optical interface broken
  • 100µF capacitor leaking
Fixed
  • Two binding screws drilled out, thread cleared
  • Interior cleaned, corrosion removed
  • Exterior cleaned, corrosion removed, partly repainted
  • Opto transmitter and receiver removed
  • Both sides of PCB thoroughly cleaned
  • 1000µF capacitor replaced
  • Four 3.6V Lithium batteries fitted
Corroded case shell
TCU-7000 in corroded enclosure
Corroded ports of the optical interface
Corroded inside of the case shell
Leaking capacitor
Corroded coaxial connector
Corrosion of the bottom panel
Four 3.6V AA-size batteries installed in the two battery compartments
D
×
D
1 / 8
Corroded case shell
D
2 / 8
TCU-7000 in corroded enclosure
D
3 / 8
Corroded ports of the optical interface
D
4 / 8
Corroded inside of the case shell
D
5 / 8
Leaking capacitor
D
6 / 8
Corroded coaxial connector
D
7 / 8
Corrosion of the bottom panel
D
8 / 8
Four 3.6V AA-size batteries installed in the two battery compartments

Specifications
  • Device
    Terminal control unit
  • Purpose
    Secure messaging and control of HF-7000 radio
  • Model
    TCU-7000
  • Manufacturer
    ANT, see below
  • Reseller
    TST, see below
  • Year
    1997
  • Classification
    NATO Confidential
  • Display
    2 × 40 characters
  • Keyboard
    47 buttons (including 5 soft keys)
  • Interfaces
    TNC (HRU, CCU), Optical (peripherals)
  • Power
    2 × 7.2V (internal)
  • Batteries
    4 × 3.6V AA-size Lithium
  • Tempest
    AMSG 784 B
  • EMC
    VG 95332
  • EMP
    VG 95373, VG 95903
  • Approval
    BSI-Z-0004-2004, BSI-VSA 10281 [2]
  • Temperature
    -20°C to +55°C
  • Dimensions
    205 × 120 × 38 mm
  • Weight
    990 g (with batteries)
Versions
  • TCU-7000
    Initial version (1997), developed by ANT, sold by Bosch
  • TCU-7000L
    ?
  • TCU-7000XP
    Combination of TCU-7000 and TCU-7000L (R&S, 2004)
  • TCU-7000E
    Elbit version (2022)
Manufacturer
Reseller
Datasheets
  1. MC68302, Integrated multiprotocol processor
    Motorola, 1995.

  2. µPD43256B, 32KB CMOS Static RAM
    NEC Corporation, 1990. Version May 1997 N.

  3. X28C256, 5 Volt, byte-alterable EEPROM
    Xicor, 1991. Version 1 August 1997.

  4. PCF8583, Clock and calendar with 240 byte RAM
    NXP (formerly: Philips), version 6 October 2010.

  5. PCF8584, I2C-bus controller
    NXP (formerly: Philips), 1997.

  6. AM27C1024, 1 Megabit (65K × 16 bit) CMOS EPROM
    AMD, May 1998.

  7. MAX635, Inverting Switching Regulator (-5V)
    Maxim, 1991.

  8. VP2206, P-Channel enhancement-mode vertical DMOS FET
    Spupertex Inc., 2013.
Documentation
  1. Telefunken Racoms, HF Gerätefamilie 7000
    12-page full-colour brochure (German). April 2006. Retrieved May 2013.

  2. Telefunken Racoms, HF Gerätefamilie 7000
    12-page full-colour brochure (German). April 2009. Retrieved August 2010.
References
  1. Anonymous donor, TCU-7000 - THANKS !
    Crypto Museum, June 2024.

  2. BSI-Schift 7164: Liste der zugelassenen IT-Sicherheitsprodukte und -systeme
    List of approved IT security products and systems (German).
    BSI. Visited 6 July 2024.

  3. Telefunken Racoms, History
    Timeline -> 1985, SY5000 adaptive HF system to NATO special services.
    Telefunken website. Retrieved May 2009.
Further information
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Sunday 07 July 2024. Last changed: Tuesday, 16 July 2024 - 09:10 CET.
Click for homepage