Click for homepage
USA
FILL
SINCGARS
  
MX-18290
ECCM Fill Device

MX-18290 is an electronic transport device, or fill device, developed in the late 1980s by the US National Security Agency (NSA) and manufactured by ITT. It was intended for loading Frequency Hopping tables and Transmission Security Keys (TSK) into compatible devices, such as SINCGARS radio sets. Frequency Hopping (FH) is a security feature that belongs to the category of Electronic Counter Counter-Measures (ECCM). It is specific to SINCGARS and protects radio traffic against eavesdropping and jamming. The MX-18290 fill unit is also known as NSN 5895-01-270-3935.

The device is housed in a green die-cast aluminium encosure that measures 180 × 87 × 40 mm and weights 632 grams (battery not included). It resembles the KYK-13 fill device, but is smaller and cannot be used for loading Traffic Encryption Keys (TEK) into an encryption device. Instead it is only suitable for loading Transmission Security Keys (TSK) and Frequency Hopping tables (FH-sets) into SINCGARS radios.

There are two 6-pin U-229 connectors (one male and one female) that allows the device to be connected to the FILL socket of the radio.
  

The device is powered by a standard military 6V battery that is installed behind a watertight lid at the right side. It must be renewed every year. The MX-18290 has storage space for 13 Frequency Hopping sets (FH) and 2 Transmission Security Keys (TSK). Once loaded, the data is retained in static memory (RAM) by the battery. It is compatible with the NSA's DS-102 interface standard. MX-18290 was introduced in the late 1980's and was in production during the early 1990s, after which it was superceeded by CYZ-10, which also replaces MX-10579, KYK-13 and KYX-15.

The KYK-13 in front of the MX-18290
MX-18290 fill device - right angle view
MX-18290 fill device - left angle view
Bottom - left angle view
MX-18290 fill device - straight up
Battery compartment
Inside battery compartment
FILL cable (6-pin U229)
A
×
A
1 / 8
The KYK-13 in front of the MX-18290
A
2 / 8
MX-18290 fill device - right angle view
A
3 / 8
MX-18290 fill device - left angle view
A
4 / 8
Bottom - left angle view
A
5 / 8
MX-18290 fill device - straight up
A
6 / 8
Battery compartment
A
7 / 8
Inside battery compartment
A
8 / 8
FILL cable (6-pin U229)

Features
The image below provides a quick overview of the controls and connections of the MX-18290. The device is shown here with its left side up. At the front and back are two U-229 conenctors — one male and one female — that are wired in parallel. Either one can be used to connect the device to a compatible radio. It is recommended however, to use a short fill cable at all times.


Once a battery has been installed, the unit is turned on with the MODE-selector towards the top. Towards the bottom is a rotory knob to select the desired storage compartment (1-13, T1, T2). At the center is the recessed INITIATE-button that must be pressed to start a data transfer. Above the button is a check light that will be lit when the parity check is successful. At the left side are 15 white fields that should be used to write the date for which a TSK or FH-set is validated.

Versions
The following versions are known to exist. The differences are currently unknown.

  • MX-18290
  • MX-18290A
Operation
The MODE-selector has three positions:

  • OFF
    The device is off, but the data is held in memory
  • ON
    The device is on and ca be used
  • ZA
    Zeroize All. This purges all TSKs and FH-sets.
The ADDRESS-selector selects the desired storage compartment. It has 16 positions:

  • 113
    13 compartments for Frequency Hopping sets
  • T1 and T2
    TSK (controls the order of an FH-set)
  • A (All)
    Load or fill all TSKs and FH-sets
To load data into a compatible radio, connect the device to the FILL port of the radio, select the desired compartment (ADDRESS) and set the MODE-selector to ON. Next, initiate a transfer from the radio. Set the ADDRESS-selector to 'A' to load all TSKs and FH-tables at once.

ZEROIZE
When the device is no longer used, or when it must be stowed for a longer period of time, or when security is compromised, it will be necessary to destroy all the data that is kept in the device. This is done by setting the MODE-slector to 'ZA" and pressing the INITIATE button.


Parts
SICGARS radio with ECCM capability
MX-18290 fill device
FILL cable
6V military battery BA-1372 (or equivalent)
SINCGARS radio
At the heart of the system is a SINCGARS radio, such as the RT-1439 shown in the image on the right. It operates in the VHF-L band beteen 30 and 88 MHz in FM, and provides ECCM by means of Frequency Hopping (FH).

 More about SINCGARS
 More about the RT-1439

  

FILL device
The MX-18290 featured on this page, is used to load the SINCGARS radio (see above) with Trans­mission Security Keys (TSK) and Frequency Hopping tables (FH-sets or hop-sets).

If the radio is also equipped with a KY-57 secure voice unit (or equivalent), a separate fill device like the KYK-13 is needed to load the Traffic Encryption Keys (TEK) into the KY-57. This means that two different fill devices must be used: one for FH and one for crypto.

  

FILL cable
When loading FH-sets and keys into a SINCGARS radio, such as the RT-1439, the MX-18290 must be connected to the FILL port of the radio by means of a short fill cable, such as the one shown in the image on the right.

The cable has 6-pin U-229 connectors at both ends and is wired straight through (i.e. 1:1), although in most cases the center contact (F) will not be used by the FILL device itself.

  

Battery   BA-1372
The MX-18290 is powered by a single 6V military battery type BA-1372. This battery is also used to retain the keys and FH-sets in the device's static memory (CMOS RAM).

The original BA-1372 battery is no longer in production as it contained Mercury. It has been replaced by the BA-5372, which is a Lithium-Manganese variant (LiMnO2).

 More information

  

MX-18290 fill device - right angle view
MX-18290 fill device - left angle view
Bottom - left angle view
MX-18290 fill device - straight up
Battery compartment
Inside battery compartment
BA-5372 backup battery
FILL cable (6-pin U229)
B
×
B
1 / 8
MX-18290 fill device - right angle view
B
2 / 8
MX-18290 fill device - left angle view
B
3 / 8
Bottom - left angle view
B
4 / 8
MX-18290 fill device - straight up
B
5 / 8
Battery compartment
B
6 / 8
Inside battery compartment
B
7 / 8
BA-5372 backup battery
B
8 / 8
FILL cable (6-pin U229)


Interior
The interior of the MX-18290 can be access by removing 6 screws from the left side panel (the panel with the 15 note pads), after which the side panel can be removed. This reveals the solder side of the printed circuit board (PCB). The PCB is held in place by another 5 screws around its edges and two mounting posts holding the PCB in a 30-pin receptacle inside the enclosure.

After removing the 5 screws and releasing the two mounting posts, the PCB can be lifted from the enclosure, as shown in the image above.

A 30-pin socket in the corner of the PCB con­nects it to the controls and con­nections, which remain inside the enclosure. Note the use of flex wiring inside the enclosure, which connects the 30-pin plug to the controls and to the U-229 plug. This saves on weight, simplifies manufac­tu­ring and also improves the device's reliability. Regular wiring is used for the connection of the U-229 socket at the other end of the enclosure.
  

The PCB holds 15 integrated circuits (ICs), only one of which carries a regular identification. The other parts are marked with unique codes issued by the US Department of Defense (DoD). Luckily, US collector Brooke Clarke was able to convert the DoD codes into the actual part numbers [1].

Most of the ICs appear to be regular CMOS logic circuits, but the heart of the device is formed by the CDP 1802 microprocessor shown in the image on the right. It is accompanied by a 2KB ROM which holds the firmware, and two RAM chips providing a total of 1KB of static memory.

The static memory is volatile and is used for the program variables as well as the TSKs and hop-lists. It is retained by a 6V backup battery, held in a separate compartment of the enclosure. The memory contents can only be purged by remo­ving the battery or by ZEROIZING the device.
  

Compared to the more common KYK-13 fill device, the MX-18290 is much more complicated. It contains a complete micropcessor platform, wheras the KYK-13 contains just discrate logic. The reason for this is the fact that the MX-18290 has to store various types of data, whereas the KYK-13 is only suitable for 128-bit cryptographic keys, like the ones used with VINSON and SAVILLE.

MX-18290 with cover removed
Interior
PCB removed from the interior
Inside enclosure (PCB removed)
PCB right angle view
PCB component side
PCB solder side
PCB detail
C
×
C
1 / 8
MX-18290 with cover removed
C
2 / 8
Interior
C
3 / 8
PCB removed from the interior
C
4 / 8
Inside enclosure (PCB removed)
C
5 / 8
PCB right angle view
C
6 / 8
PCB component side
C
7 / 8
PCB solder side
C
8 / 8
PCB detail


Components
Below is a tear-down of the components found on the main PCB, based on the work of Brooke Clarke [1]. For further details about the components, check out the information on this website. From the date codes on the parts it is likely that the device featured here was made in late 1990.

IC DoD ID Part Manufacturer Description
1 A3012591-1 74LS174 Motorola, RCA Hex D-flip-flop
2 A3012588-1 4011 Harris Quad NAND
3 A3012592-1 74LS367 Motorola Hex 3-state buffer
4 A3012580-1 4011 Harris, Motorola Quad NAND
5 A3012589-1 40109 Harris Quad level shifter
6 A3012568-1 CDP 1802 Harris, RCA Microprocessor
7 14069A/BCAJC 4069 Motorola Hex inverter
8 A3012591-1 74LS174 Motorola. RCA Hex D-flip-flop
9 A3012589-1 40109 Harris Quad level shifter
10 A3012646-4 2532 Harris. RCA ROM
11 A3012571-2 2114 Harris 1K × 4 RAM
12 A3012592-1 74LS367 Motorola 6 × bipolar buffer
13 A3012592-1 74LS367 Motorola 6 × bipolar buffer
14 A3012592-1 74LS367 Motorola 6 × bipolar buffer
15 A3012571-2 2114 Harris 1K × 4 RAM
Connections
The MX-18290 has two U-229 connectors: a plug-type one at the bottom end and a socket-type one at the top. These connectors are wired in parallel, so that either one can be used to fill the equipment. Although the device can be fitted directly to the fill connector on the radio, it is recommended to use a FILL cable at all times. Below is the pin-out of the U-229 connectors.

  1. GND
    Ground
  2. SWG
    Switched ground (via MODE-selector)
  3. REQ
    Fill request
  4. DATA
    Fill data into KY-99
  5. CLK
    Fill clock into KY-99
  6. -
    unused
Specifications
Compatible equipment
Datasheets
  1. CDP1802 CMOS 8-bit Microprocessor
    Intersil, March 1997.
References
  1. Brooke Clarke, MX-18290/VRC Fill Device, ELEK CCM
    2001-2009.
Further information
Other websites
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Wednesday 21 March 2012. Last changed: Monday, 29 April 2024 - 09:29 CET.
Click for homepage