PX-1000 was a small hand-held message terminal
with built-in encryption,
developed between 1979 and 1982 by
Text Lite
in Amsterdam (Netherlands). The device
was marketed as a Pocket Telex (portable teletypewriter) and was
sold by Philips1
and by others. Initially the device offered
strong DES encryption,
but this was replaced in 1984 by an
NSA-supplied
alternative algorithm.
Although different versions of the PX-1000 were available,
we will concentrate here on the Philips versions of the PX-1000 and
PX-1000Cr,
as they feature built-in cryptographic capabilities.
It was aimed at small companies and journalists, and was also used by
the Dutch Government 2 .
Furthermore it played a role in the international fight for
Nelson Mandela's release from prison.
The image on the right shows the PX-1000Cr version.
The extension 'Cr' is used to identify the crypto-version that features
the alternative NSA algorithm.
It is shown here with its display up.
In late 1983, the NSA expressed its concern about the
strong DES algorithm being available to the general public,
and asked Philips Usfa
to implement an alternative algorithm that they (the NSA)
would provide.
They also offered to buy the existing stock of DES-based PX-1000 units,
along with any ROMs that had already been manufactured.
Although Text Lite engineers were convinced that this would offer the NSA
a way in, no evidence of any backdoors was found at the time [14].
During the implementation of the NSA-supplied algorithm
with help from Philips,
an intermediate version of the PX-1000 – known as CALC –
was sold as a gap-fill solution. In this version, the encryption facility
had been replaced by a simple spreadsheet. At the same time, the red
CODE-button was replaced by a blue CALC-button.
In 1984, after the implementation of the NSA-supplied algorithm had been
completed, the PX-1000 was re-released as the PX-1000Cr (crypto), and
the red CODE-button was reinstated. The new product was marketed from
1985 onwards.
Both versions were adopted by
Philips Consumer Electronics,
who sold them as the PX-1000 and PX-1000Cr.
In 1985, two versions with C-Mail 5 capability
were released: one with a calculator and one with crypto.
Several other variants, such as the Family Doctor,
appeared worldwide under a variety of brand names
like Alcatel,
Siemens,
Ericsson and Commex.
The PX-1000 was followed by the slightly improved PX-1200 and finally
by the completely redesigned PX-2000.
Text Lite BV went out of business
in 1990, alledgedly due to lack of (promised) orders from Philips [10].
The PX-1000 was marketed by the Consumer Electronics division of
Philips,
and not by the crypto division of Philips Usfa,
although the latter was later involved with the implementation
of an alternative algorithm.
For use by the Foreign Office of the Dutch Government, a special (secret)
algorithm was developed by an undisclosed Dutch agency.
PSTN = Public Switched Telephone Network
➤ Wikipedia
Analogue PSTN is also referred to as
Plain Old Telephone System (POTS).
The NSA bought 12,000 original
PX-1000 units with DES, along with 50
PXP-40 printers and 20,000 ROMs that had already been produced, for the total
sum of NLG 16.6 million (EUR 7.5 million).
C-mail was an early variant of E-mail, developed by Text Lite for
small businesses. It was capable of sending and receiving SMTP-based
E-mail via the command line and required a Personal Computer (PC)
with suitable hard- and software.
The image below shows the positions of the controls on the Philips PX-1000Cr,
which are identical to those of the standard PX-1000.
Once the batteries are fully charged, the unit is turned ON by pressing
the orange ON/STOP button in the top right corner of the keyboard.
Short messages are stored in the PX-1000's static memory, that is
retained by the internal batteries (7400 characters max.).
Longer messages could be stored on an external audio cassette recorder,
by connecting a short 3.5 mm Jack cable to the
microphone input of the recorder. They could be loaded back into the
PX-1000, by connecting the same cable to the headphones output of the
recorder and playing back the message.
Another socket is used for charging the unit.
At the bottom is the acoustic modem, which consists of a single
transducer that is used as speaker and as microphone. It is
encapsuled in a rubber gasket that should be pressed
against the earpiece or
the microphone of the telephone's handset when
sending or receiving messages.
Encryption standards
The following encryption standards are known to have been used on the PX-1000:
DES encryption (1983)
The initial version of the PX-1000, introduced in 1983, allowed text to be
encryption with the Data Encryption Standard (DES),
which was considered
extremely powerful at the time. In fact it was so powerful that the NSA
intervened and managed to get it replaced with an alternative algorithm.
This version was sold under the Text Tell
brand.
No encryption (1984)
The intermediate version of the PX-1000, i.e. the one that was sold in between
the original PX-1000 (with DES) and the PX-1000Cr
(with the NSA algorithm),
did not feature text encryption. This version can be recognised by a blue button
at the right.
It was sold under the Text Tell
and Philips brands.
The PX-1000 was fully designed and developed by
Text Lite BV in
Amsterdam (Netherlands) in 1979 and 1980.
The enclosure was designed by company shareholder Hugo Krop [10],
who was also repsonsible for the functional specification of the device.
The actual manufacturing took place at Samwell
Electronics in Taiwan, whilst Text Lite Ltd. 1 in Ireland was
responsible for the final quality assurance and packaging.
The first units appeared on the European market in 1980.
The intellectual property rights (IP) of the firmware of the PX-1000 were
registered in Ireland, as the laws of that country offered better
protection of IP.
Furthermore, Ireland had lower tax rates [10].
DES encryption
From the outset, the PX-1000 was capable of sending and receiving
encrypted messages by using the DES encryption algorithm, which had
been obtained from the American Bureau of Standards for just US$ 8 [10].
By 1983 however, the US National Security Agency (NSA)
had become aware of the PX-1000 and its powerful encryption capabilities,
and got increasingly concerned with DES encryption being available
to the general public world-wide in such a small and affordable device.
The NSA then asked Philips Usfa to implement an
alternative algorithm
and see to it that the DES-based units were taken off the market.
Text Lite was told that the alternative algorithm was similar in
strength to DES, and their engineers were allowed to supervise the
implementation.
In the meantime, whilst the new PX-1000Cr was being developed,
the PX-1000 CALC was sold as an intermediate solution.
It did not support any encryption, but featured a calculator instead.
This version can be recognised by the blue key, marked CALC, instead
of the red CODE button.
The remaining stock of 12,000 'old' PX-1000 units was bought by Philips,
along with 20,000 firmware PROMs that had already been manufactured.
Philips later sold them on to the NSA 1 along with 50
PXP-40 printers,
for a total of NLG 16.6 million (more than EUR 7.5 million) [9].
Officially, the equipment was sold a company by the name of Reynolds
which is believed to be an NSA front.
NSA intervention
In The Netherlands,
Philips Electronics
had the exclusive distribution rights of the PX-1000 and was
probably the largest customer of
Text Lite BV.
After the NSA had expressed its concern
about the use of DES, Philips Usfa
was asked to implement an alternative (NSA-supplied) algorithm.
Philips Usfa then implemented the alternative algorithm
for the PX-1000, which took place at Philips' head office in
Eindhoven (Netherlands) under scrutiny of Text Lite
engineers who were concerned about possible
'backdoors'
[10].
As no backdoors
were found, the algorithm was approved for the
new PX-1000Cr. From then on, EPROMs were used to store the final
program, rather than ROMs. This made it possible to correct minor
mistakes in future releases and have different
software releases
for different customers.
The story above is corroborated by an article in the Dutch
newspaper De Volkskrant in April 1985 [14].
In this article, Text Lite director Hugo Krop explains how the PX-1000
initially featured DES, but that his British distributor was kindly asked by
GCHQ to replace DES by something else. At the same time, the Dutch
distributor (Philips) was
approached by an unnamed American security
service [NSA] with a similar request.
He also describes how Philips, on behalf of a third
party [Reynolds, an NSA or CIA front],
payed an undisclosed sum for compensation.
As an aside note, it is interesting to read in the 1985 newspaper article
[14] how Volkskrant journalist Wouter Klootwijk suggests that only criminals,
spies, diplomats and tax evaders would have a need for encrypted communication.
He also writes (translated):
There is a worldwide fear for eavesdropping, especially,
of course, amoungst people with bad intentions
Towards the end of the article he writes:
For normal decent people there is also a cheaper
version without encryption.
We wonder whether he would still say that
today (2016), in the light of the
Snowden revelations
about the NSA's worldwide mass-surveillance programs that affects nearly
everyone's (private) communications, such as e-mails, SMS-messages, Apps,
Skype conversations and webcams.
Security
Please note that unlike other Philips encryption devices,
the PX-1000Cr was not a product of
Philips Crypto BV.
Instead it was marketed and sold by the ELA Group of
Philips Netherlands
as a consumer product.
According to the instruction manual of the PX-1000Cr [A],
the number of possible cryptographic keys was calculated at a mere
18,446,744,000,000,000,000 (over 18 quintillion).
It would take the fastest computer
thousands of years to break it... [A p.16].
Although this might have been the case for the original DES version, it
definitely wasn't for the modified PX-1000Cr which contained the alternative
NSA algorithm. Although the Text Lite
engineers were not able to find any backdoors at the time,
there was a strong suspicion that the cipher
had delibarately been weakened by the NSA. In 2016, a Crypto Museum
investigation team successfully isolated the NSA algorithm from the
firmware and has partly analysed its properties.
Hacker Stefan Marsiske has since analysed the algorithm and has
demonstrated its weakness.
The PX-1000Cr was also used by some Dutch Government departments
during the 1980s.
For official government use however, the Philips software, and hence the
encryption algorithm, was replaced by a proprietary one, which
was developed by a specialized - undisclosed - agency. It contains a secret
encryption algorithm of which no details publicly known.
Operation Vula
On 11 February 1990, black activist Nelson Mandela was released from prison,
after serving nearly 28 years of his life-time sentence.
Mandela was the leader of the South African political organization
African National Congress (ANC).
During his imprisonment, many people from all over the world fought for his
release and for the abolishment of the South African Apartheid.
In 1986, a secret operation led by (then) ANC intelligence officer
Mac Maharaj was mounted, to smuggle freedom fighters back into the
country and prepare Mandela for his speculated release, known as
Operation Vula[2] (Eng: commence).
The Dutch chapter of Operation Vula was led by Connie Braam,
at the time head of the Dutch anti-apartheid movement.
Her work involved finding professional makeup artists for making
disguises, a KLM stewardess acting as a courier, and last but not least,
Philips PX-1000 units that were used to exchange encrypted messages
between London, Lusaka and South-Africa.
On 11 February 2010, the Dutch TV program Andere Tijden, aired a
25 minute special about Operation Vula [3]. In the interview,
Connie Braam explains how she contacted an engineer who worked for
Philips at the time. He suggested the PX-1000 for secure
communication, which was subsequently used to send messages to Nelson Mandela
via Amsterdam and the hub in London.
According to Braam, the system functioned well and was used throughout
the entire operation. Tim Jenkin however, the ANC's London-based
communications expert, tells a slightly different story [7].
According to him, the system worked well, except over the bad
South-African telephone lines, for which they used another system,
based on early home computers and external modems.
The latter system was developed by Jenkin himself and needed
cryptographic keys that were distributed on floppy discs. The discs
were smuggled into South-Africa by 'Antoinette', a KLM stewardess
who had been recruted by Conny Braam. During operation Vula,
London (UK) acted as the central communications hub, with links
to South-Africa, Lusaka (Zambia), Paris (France) and Amsterdam (Netherlands).
The PX-1000 was used on the Amsterdam - London - Paris link (red),
whilst Jenkin's own system was used between Lusaka, London and
South-Africa (blue) [15].
Once in South-Africa, the messages were smuggled in and out of
Mandela's prison cell by his lawyer, using concealed compartments
in book covers. It allowed Mandela to communicate with key ANC
officials in Lusaka and lead the negotiations with the South-African
government. It also ensured that he was well-informed on the day of
his release from prison in February 1990. After the first multiracial
elections of 1994, he became South-Africa's first black president [12].
In the light of the use of the PX-1000 by a political movement
during the 1980s and 90s, it would be interesting to know what impact
the involvement of the NSA had, and which version of the PX-1000
was used for communication with Mandela; the DES one or the one
with the NSA algorithm.
On 20 April 2019, the Dutch investigative radio program Argos, aired a
one-hour special about the PX-1000, Mandela, Philips
and the NSA, in which they demonstrate how the NSA – through
Philips – managed to swap the cryptographic algorithm of the
PX-1000 for a weaker one.
Many people were interviewed during the three-year research for this broadcast,
including former Text Lite directors, former Philips personnel,
security and crypto experts and writer Marcel Metze.
Although it is uncertain whether the Dutch goverment was involved in
the NSA-operation, the
Dutch General Intelligence and Security Service AIVD
(at the time known as the BVD)
refused to release any documents related to the case,
as these could potentially harm the national security and/or the modus-operandi
of the agency. A Wiv1 request by Argos was dismissed
[16].
Wiv = Wet op de Inlichtigen en Veiligheidsdiensten
(Intelligence and Security Act) — equivalent to the
Freedom of Information Act (FOIA) in the US.
Clyde Lee Conrad
Another documented case about the use of the PX-1000 in intelligence,
is that of American spy Clyde Lee Conrad (1948-1998), a US Army
non-commissioned officer working in Germany.
From 1974 until his arrest on 23 August 1988, Conrad sold top secret
classified NATO information to Hungary, which at that time was still part
of the Warsaw Pact. The information eventually landed
in the hands of the Soviet Union (USSR)
and appeared to be extremely damaging for NATO[24].
In his book Traitors amoung us, former US Army counterintelligence
officer Stuart A. Herrington gives a thrilling and informative account of this
case, which was one of the most damaging and delicate cases ever committed
against the United States. Conrad provided the Hungarians with detailed plans
of NATO movements and storage locations of nuclear weapons, that would
have been most valuable in case of a war between the
Warsaw Pact/Soviet Union and NATO[25].
The Hungarians had provided Conrad with a Textlite PX-1000 pocket
telex, that he could use to send them encrypted messages,
'immune from interception and decryption'.
All he had to do, is type the message into the device,
encrypt it, dial a phone number in Budapest (Hungary), hold the PX-1000
in front of the telephone's handset and send the message as a burst. 1
Observed by counterintelligence officers of the US Army, CIA and
FBI, Conrad was arrested in his Bosenheim home by the German Criminal Police (BKA) on 23 August 1988. In 1990, a German court sentenced him to life
imprisonment [24].
Conrad was one of only five American spies 2 thought to have earned
US$ 1 million or more with his spying activities. Most of these revenues were
never recovered. Investigators believe that the money was stashed abroad and
that Conrad's wife had access to it,
but were unable to prove this. Conrad died of a heart attack at the
age of 50 on 8 January 1998 in Diez prison (Germany) [24].
From the book [25] it is unclear exactly when Conrad received his PX-1000
from the Hungarians, and whether it was the earlier DES-based version
or the one with the backdoored NSA algorithm.
In the book, the PX-1000 is described as a
data-encryption-burst-transmitter-receiver that could send a message
in a microsecond. In reality the transmission took several seconds, as the
device has an acoustic modem that transmits the message at a speed of 600 or
1200 baud.
The others being Aldrich Ames, Larry Wu-Tai Chin, Robert Hanssen and
John Walker.
The packaging was provided by manufacturer Text-Lite, but was printed
with the name of the supplier — Philips in this case. A list of features
is printed on the carton.
Storage case
The bare PX-1000, without the mains adapter, could be carried
in the tight-fit leatherette storage case shown in the image
on the right. The interior is pre-shaped
for the body of the PX-1000 and is covered with a velvet-like lining.
The case is closed with a zipper.
With most surviving PX-1000 units, the artificial leather of the
storage case has completely or partially decomposed.
Portable telex
PX-1000
Inside the storage case is the PX-1000 portable telex.
It measures 225 x 85 x 29 mm and weighs just 450 grams,
batteries included.
All that is needed to operate the device, is to open the hinged
top lid and press the ON button. Further instruction are in the
manual.
The PX-1000 is powered by internal NiCd batteries that should be
charged regularly by means of the mains power adapter shown in the
image on the right. Depending on the country in which the PX-1000
was sold, it came with a continental adapter,
or with the universal adapter shown here.
At the end of the 12V line is a 3-pin 3.5 mm jack that should be connected
to the socket at the left side of the device.
This small thermal printer could be used to printed encrypted or
decrypted messages directly from the PX-1000. It can be
attached to the left side of the PX-1000
and prints 40 characters per line.
The device has a serial (RS232) interface
that is provided via
the 3-pin 3.5 mm jack socket on the left side of the device.
Apart from the serial DATA OUT signal, this socket is also used
for connection of the mains adapter.
Apart from the PXP-40 printer shown above, it was also
possible to use virtually any other printer with a serial RS232
interface. For this purpose, the short cable shown here was
supplied with the device.
Instructions for connecting it to the 25-pin DB25/S receptacle
of the printer, are provided in the manual, along with
instructions on how to alter the ASCII table, should that be
necessary.
Text in the internal memory of the PX-1000 could be saved to an
(analogue) tape cassette recorder, using the cable shown in the
image on the right.
Likewise, the recorded message could be transferred from the cassette
to the internal memory of the PX-1000.
The cable has a 3-contact plug that should be connected to the PX-1000,
and a 2-contact plug for the input or output of the cassette recorder.
Operating instructions
Each PX-1000 came with a small A5 booklet in which all features are
explained in detail, complete with real-life examples.
Several different versions of the PX-1000 are known to exist. They were
sold under a variety of brand names, but this was not a simple matter of
rebadging the product, as there are some significant differences between the
various versions. In order to obtain the firmware version number of the
PX-1000, use the following key combination whilst the device is switched on:
In the initial version (1983), the copyright message can be
read by pressing the LIST/PRINT and ON/STOP keys simultaneously.
In later versions, the above combination is used.
This will display a copyright message, consisting of the name of the
manufacturer, the year and a version number. Globally speaking, there were
three versions, but there are variants with additional features.
Many thanks to Cees Jansen for explaining the differences [1].
Text Tell PX-1000
The standard version was a simple text terminal,
that allowed messages to be entered, stored and transmitted over a standard
analogue telephone line PSTN.
It had built-in encryption and decryption based on the
Data Encryption Standard (DES) [13].
It was developed in 1980 and can be recognized by its
red MODE-button.
Please note that this version is different
from the Philips variants listed below.
Firmware (ROM):
COPYRIGHT TEXT LITE 1983
Text Tell PX-1000 CALC E
In this version, the text encryption/decryption feature has been dropped
in favour of an arithmetic calculator.
It can be recognized by a blue MODE-button.
The packaging was modified by sticking an adhesive label over part of the text,
but the image of the PX-1000 with the red button, remained on the
outer sleeve of the box.
Firmware (EPROM):
COPYRIGHT 1984 WEST-TEC PX CALC E
Philips PX-1000
This was basically a rebatched version of the standard
Text Tell PX-1000 CACL E with the built-in
arithmetic calculator (identical to the one above).
The only difference is the
Philips logo on the
product and the packaging.
Firmware (EPROM):
COPYRIGHT 1984 WEST-TEC PX CALC E
Philips PX-1000Cr
This was the Philips implementation of the
cryptographic version of
the PX-1000. The arithmetic calculator was dropped again in favour of
a new encryption algorithm that had been supplied by the NSA.
It was not compatible with the earlier DES-based PX-1000.
Firmware (EPROM):
COPYRIGHT 1984 WEST-TEC PX V2
Philips PX-1000 C-mail version
This was an adapted version of the standard PX-1000 that allowed messages
to be sent via Cmail; an early protocol to read SMTP-based e-mail via the
command-line.
There were at least two variants, both in EPROM
one of which had a crypto fuction:
- Calculator
COPYRIGHT 1985 WEST-TEC PX CALC H
- Crypto
COPYRIGHT 1985 WEST-TEC PX CRYPTO I
Dutch Government version
For use by the Dutch government, a special version of the Philips PX-1000Cr
was used. It contained an improved (secret) encryption algorithm,
which was not developed by Philips, but by an undisclosed
government agency in The Netherlands.
TextLite PX-1000 C and PX-1000 F
This version was made in 1993 by TextLite Ireland, long after the Dutch
operation had been dissolved. It contains a 32KB EPROM (rather than 8KB)
marked PX-1000/F, and supports encrypted text via telephone, a V.23 modem,
a calculator, C-mail via telephone, Hamming parity error correction,
sending records of a form, storing text on tape, PXP-40
and other printers [18][19]. The following variants are known
(all in EPROM):
PX-1000 variants were also sold by other companies as rebatched
products, for example:
Family Doctor (C-mail)
This version of the PX1000 was sold in the USA as an aid to send and read
ECGs (Electro-Cardiograms). The terminal had a
rebatched display panel
with the words 'Family Doctor' at the top.
It supported the C-Mail message protocol
(E-mail via the command-line). 1
This variant is also used as the basis for the Russian version of
the PX-1000 (see above).
TELI The Contact
'The Contact' was probably a variant of the PX-1200 that was marketed by
Teli in the UK. As the PX-1200 contains a larger EPROM, the software
supports both crypto (CODE) and calculations (CALC). Calculator
is activated by using the key combination C + ON/STOP.
Firmware:
COPYRIGHT 1988 WEST-TEC PX1000S/A TELI
Ericsson
For Ericsson, a variant of the PX-1200 was produced in 1986.
It was housed in a cream coloured enclosure.
Although it is currently
unknown what kind of encryption it provides, it was probably issued
with DES or with a Ericsson proprietary algorithm.
Siemens
Also in 1986, a special variant of the PX-1200 was produced for
Siemens
in Germany. Although the instructions on the display panel say it is a
Text Lite PX-1200 C, it has a red MODE button
which is marked (CALC) rather than CODE.
The button allows selection between the built-in
calculator and data encryption.
Alcatel
It is known that the French firm
Alcatel also supplied a crypto-capable
version of the Text Lite PX-1000 in 1987. It was used, for example,
by the Austrian Armed Forces during the 1980s and 90s and was marked PX-1000F.
Olympia
According to former Text Lite director Hugo Krop in a newspaper article
of 1985 [14], the PX-1000 was sold in Germany under the Olympia brand
(in addition to Siemens).
It was available at the time for a price of DM 2000 (approx. 1000 Euro) [20].
➤ Example of the Olympia version (off-site)
Burroughs
According to former Text Lite director Hugo Krop in a newspaper article
of 1985 [14], the PX-1000 was sold in other countries under the Burroughs
brand. So far we have never seen this variant.
CE21
In France, the initial version of the PX-1000 was distributed in France
under the name Communication Electronique du 21e Siècle (CE21).
A device has been found with the original firmware:
This was found in a PX-1000C, manufactured by TextLite Ireland, long
after the Dutch operation was dissolved. It has a 32KB EPROM
(instead of 8KB) which is marked PX-1000F [18].
Found in a PX-1000 F, which has an EPROM marked PX1000 VIP[21].
PLEASE HELP —
At present we don't have any further information about the
Russian version of the PX-1000. If you known what this variant
was used for and/or what the purpose of the additional PCB is,
please contact us. Any further information would be
much appreciated.
In the same way as the firmware version can be read (see above),
it is possible to test the memory of the device. Use the following
key combination whilst the device is running. If there are no
memory problems found, the display will show 'MEMORY OK'.
Built-in self test
ZEROIZE
In software version V2 and later (i.e. from 1984 onwards) some additional
self-test facilities have been built into the PX-1000. Below is an overview
of the key combinations that should be used to activate the self-test.
Hold down ON/STOP, then press the letter key, then release ON/STOP.
This key combination is equivalent to a cold start of the PX-1000.
The device behaves like it is switched on for the first time.
Text memory is cleared and a copyright messages displays the software version,
whilst the device performs a self-test. For crypto-aware users, this
key combination can also be used as a ZEROIZE function.
The following responses are possible:
One beep and one LED flash
All tests OK.
Two beeps and two LED flashes
RAM test was successful, but the LCD is faulty.
Three beeps and three LED flashes
The unit tries to write and then read back each memory location,
including the locations needed by the program itself. This error indicates
that it does not read back what it has written to some (or all) memory locations.
When activated, the key combination D + ON/STOP causes the LCD to be cleared,
whilst the modem transmits a continuous mark/space signal at 1200 baud
without a header. This signal can be useful when adjusting the
input signal with potentiometer P2 on the logic board of another unit.
The signal can be stopped again by pressing the ON/STOP key.
This key combination causes the display to be cleared, whilst the modem
transmits a continuous mark signal for 10 seconds, followed by a
10 second space signal, each time without a header. It can be used
to check the quality of the modem output (i.e. amplitude and frequency).
The signal can be stopped again by pressing the ON/STOP key.
This test performs a WRITE/READ operation on each location of the
text area (in RAM). If the test is successfully conpleted, the text
'MEMORY OK' will appear on the display. If one or more memory locations
are faulty, the display will show 'MEMORY ERROR'.
In addition, the 1988 version of the firmware (e.g. TELI Contact)
supports the following key combinations. It is possible that some of these
combinations can also be used on other versions.
The beep (key click) on or off.
Enter CALC mode.
Clears all previously converted character codes.
Convert ASCII character codes.
Switch line and text numbers ON or OFF.
Switch the PX-1000 off.
Display the number of free bytes in memory.
Display the unit's software version (without self-test).
Perform a display test.
Receive text via serial port at 1200 baud, regardless of header.
Remove empty files between used files.
Insert empty file between used files.
Interior
The PX-1000 was extremely well built for its time. It was also very compact and
light weight, which made it ideal for portable applications. It was among the
first devices to use an advanced microcontroller with integrated memory and I/O:
the Hitachi HD6303RP.
The image on the right shows the PCB inside the PX-1000. The small
circuit board is very well layed out and carries the
processor (in DP-40 packaging) right at the center.
The controller is compatible with the Motorola 6800 series,
and has a built-in serial interface (SCI), parallel I/O,
timers and 128 bytes of RAM.
Memory is further extended by using a HM6264 external static RAM (right).
This adds 8KB of RAM to the design, 7.4KB of which is available for storing
the text messages.
The software is stored in an 8KB EPROM (left of the RAM).
The modem of the PX-1000 is implemented as so-called
thick film circuit.
It consists of a number of SMD components (transistors, diodes)
and vapor deposited resistors, on a white ceramic substrate. It has two
rows of pins, one at either side, for connection to the motherboard.
In the image above, the thick film circuit is located on the left half of the PCB.
A separate audio pre-amplifier (Toshiba TA7330P),
with automatic level control (ALC), is present to the left of the thick
film circuit, in between the two potentiometers [6].
Inside the PX-1000 are 5 Varta 170 DK NiCd battery cells. As each NiCd cell
has a nominal voltage of 1.2V, the PX-1000 is normally powered by 6V DC.
As the PX-1000 was built somewhere around 1985, the NiCd batteries of most
of the surviving devices will have died by now. Furthermore, NiCd batteries
have the tendency to start leaking after so many years, causing permanent
damage to the interior of the PX-1000. This is clearly visible below.
If you want to bring an old PX-1000 back to life, you first need to remove
the old batteries and clean the interior. Next, you'll need to examine any
damage caused by the leaking batteries and repair that if possible.
Finally, you need to find a suitable replacement for the batteries.
One possibility is to bring the wires out, and feed the PX-1000 with an
external 6V DC power supply.
A better solution however, is to replace the 5 cells by the newer
Varta V250H NiMH cells.
These cells have been designed especially to replace the old 170DK NiCd
cells.
Replacing the cells is a clean solution that doesn't require any
modifications to the PX-1000 itself. One has to bear in mind though,
that the replaced batteries should be used (discharged) and charged
regularly, in order to keep them healthy. This also applies to
the PXP-40 printer.
The image on the right shows what happens to the interior of the PXP-40
printer, once the batteries start leaking. In this case, the swollen batteries
have caused permament damage to the printer mechanism. The leaking batteries
have also caused corrosion to the main PCB.
The PXP-40 is powered by 7.2V. The 6 NiCd cells of 1.2V each, are bound
together as a pack, positioned aside the printing mechanism on top of the
PCB. They pack is connected to the main PCB by 2 wires that also keep it
in place. The batteries are easily replaced.
Bringing a PXP-40 printer back to life, might be a bit more work than getting
a PX-1000 to work. As the batteries are located aside the printing mechnism,
the cog wheels are easily damaged by the swollen batteries. Carefully cleaning
and reparing of the broken parts may be necessary to bring it back to life.
Leaking batteries may also cause secundary damage to the PCB. As a result
of the swollen batteries, the cog wheel mechanism can be blocked, causing
excessive currents in the motor driving electronics. This may cause a
56 ohm safety resistor on the PCB to break.
The PX-1000 was supplied with its own transit case, a mains power adapter
and a manual, stored in a rectangular carton box with a photograph of
the device on the sleeve. Inside the box was a polystyrene placeholder
with a layer of dark blue artificial velvet (see below).
The packaging could be tailored for each reseller,
but always contained the TEXT TELL logo.
There were small differences in the typeface
and in the text printed on the carton.
The image on the right shows the packaging of the Philips
PX-1000Cr. It contains the Philips brand name in the
top right corner and the TEXT TELL logo at the bottom.
Other (but similar) cartons can be found in the thumbnails below.
On the left side of the device is a socket for a 3.5 mm stereo jack, that can
be used for connection of a power adapter (which also charges the internal
NiCd batteries) or a printer. The wiring is as follows:
Technical specifications
Device
Portable telex
Purpose
Sending (encrypted) messages over an analogue telephone line
Our call for documentation of the PX-1000 in mid-2011 has generated a new flow
of information about this device. The original user instructions were found
rather quickly, but we were really surprised when we received the original
service manual and the circuit diagrams. We have now made them available for
download below in the hope that they may prove useful when repairing a broken
PX-1000. Many thanks to all who have contributed.
If you like the information presented here, please consider making a
donation to Crypto Museum.
Tim Jenkin, Talking to Vula
The story of the Secret Underground Communications Network of Operation Vula.
ANC website. ANC's Montly Journal Mayibuye, May 1995 - October 1995.
Hugo Krop, Personal correspondence and interview
Former technical director of Text Lite BV.
Crypto Museum, 25 August 2013, 15 December 2013.
Conny Braam, Operatie Vula
1992, Dutch. ISBN 978-9029083362. p. 66.
Reprinted 2006, Dutch. ISBN 978-9045700465.
English version 'Operation Vula', April 2005, ISBN 978-1919931708.
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
Crypto Museum. Created: Friday 22 April 2011. Last changed: Wednesday, 05 November 2025 - 11:52 CET.
![Clyde Lee Conrad in 1965. Photograph obtained from Wikipedia [24].](img/conrad_1965_large.jpg)
