PAACS Encryption Upgrades: CPUs, Radios or ACE3600

Three Starting Points

The encryption work on an existing PAACS depends on what is already installed. In the Air National Guard contract GDS completed across 19 bases in 2021 and 2022, the sites fell into three groups. Bases whose radios already met the Air Force's spectrum requirements needed only new security-enabled ACE3600 CPUs loaded with Motorola's encryption software. Bases with older radios needed new CPUs and new Motorola APX radios. Bases still running Motorola MOSCAD controllers, such as Ellington Field, Gulfport, Jacksonville and Sioux City, needed a full conversion to ACE3600.

Eight of the 19 bases were in the first group, seven in the second and four in the third. Across all of them, the contract covered 45 barrier systems, 146 CPUs and 88 radios.

What a MOSCAD Conversion Adds

A MOSCAD site can't just take a new CPU. The contract for those bases called for replacing the system components at every station so they would work with the ACE3600: the wiring harnesses in the pits, tower, shop and fire station, the antennas, and the air-quality, water and fire sensors in each barrier pit.

At four to six hours per controller, one barrier at a MOSCAD base would likely be out of service overnight.

Sequencing Around the Runway

While the tower equipment is being upgraded, the whole system is out of service, so the order of work matters. GDS's plan for the program started with one control pit, then the tower, then the other control pit, followed by the non-control pits, shop and fire station. At bases that needed only new CPUs, each location (tower, pit, shop or fire station) was planned at about two hours; adding radios made it about two and a half.

Hardening and Acceptance

The encrypted configuration also closes off the equipment: unused USB ports are disabled, and modems are disconnected and powered down. Acceptance under the contract required three raise-and-lower cycles from the tower at each control location. Where a base could not cycle its barriers, the program office accepted a timestamped ping test between the CPUs instead. Each base also received a network drawing, an equipment inventory and training, and the contract allowed no more than five working days per base.

Two Things to Plan For

Encrypted controllers are sensitive to clock drift. On encrypted ACE3600 CPU3680 modules, drift over time interrupted communications between stations until Motorola supplied a configuration change, so controller timing is one of the first things to check when an encrypted system loses a station.

Motorola's encryption software is exported from Israel, which requires an end-user certificate signed by the government customer. Start that paperwork at award, or it can hold up the schedule later.

Where GDS Fits

GDS manufactures PAACS and is named in the Air Force's 2017 configuration-control memorandum as the manufacturer of each qualified configuration. We plan and install encryption upgrades and MOSCAD conversions and support the systems afterward. See our PAACS engineering page for the part numbers and NSNs.