Pall
Expeditionary command post · 20 ft ISO
Eight minutes from a cold generator, because the generator is not in the critical path.
Design · no units built
Mission
A command post that assumes the reachback is gone
Put battalion-to-brigade mission command anywhere a 20 ft container can go, and have it commanding in eight minutes from a cold start, on one tactical generator, with no reachback.
PALL is deliberately not a bigger command post. It is a command post built on the assumption that the satellite link is down, the fibre is cut, the cloud is unreachable, and the generator has been sitting outside in the cold for nine hours. Everything about the electrical architecture follows from that one assumption, and the three headline numbers on this page — eight minutes, 3.2 kW, six hours — are all consequences of a single decision about the bus.
Inside: four compute sleds, a 2.4 TB resident mission cache, a separate append-only LEDGER appliance, four software-defined radio channels, a REVENANT LINK gateway into Link 16 and the crewed force, and six sunlight-legible operator positions. Outside: one 10 kW generator running at a third of its rating and a 9 m antenna mast that erects in four minutes.
Key figures
The hard claim, part one
Eight minutes, phase by phase
Master switch to the first track on the common operational picture, with the generator cold. The trick is architectural, not procedural.
The trick
The generator is not in the critical path. PALL's primary bus is a 400 V DC bus fed by a 19.2 kWh internal LFP pack. The genset feeds a rectifier onto that bus — it is a charger, not a source.
Press the master switch and the container boots entirely on battery while the generator cranks, warms and syncs behind it. Nothing waits for a diesel. The genset joins the bus at about T+1:30, well after PALL has already started booting, and takes over charging at T+3:00.
| 0:00 – 0:35 | Master switch. DC bus energises from the internal pack in 400 ms. Genset crank initiated in parallel — not gating. |
|---|---|
| 0:35 – 2:10 | Four compute sleds POST. UEFI on a server-class board is genuinely 60–90 s and no amount of engineering makes it ten. |
| 2:10 – 4:00 | REVENANT CORE mounts the resident mission cache from NVMe — plan, ROE, 2.4 TB of terrain, structures, route graph, last consolidated track file. No network is touched. |
| 4:00 – 5:30 | Four SDR channels key up. MESH neighbour discovery. REVENANT LINK associates on Link 16 / SINCGARS / TSM as available. |
| 5:30 – 6:40 | Crypto. Two-person HSM unlock on dual hardware tokens, key fill, LEDGER chain continuation from the last signed block. Deliberately not automated. |
| 6:40 – 7:35 | Six operator terminals up, workspaces restored to the state they were shut down in. |
| 7:35 – 8:00 | Mission command declared. First track renders on the common picture. |
The hard claim, part two
3.2 kW, itemised, with its conditions attached
Stated condition: 25 °C ambient, four operator positions manned, mission load. A single power figure for a sealed box in the sun is meaningless, so both the temperate and the hot number are published.
| 4 × compute sled | 860 W — 32-core ARM SoC (110 W TDP) + 60 W inference module + 32 TB NVMe each; 215 W measured per sled at mission load |
|---|---|
| LEDGER appliance | 140 W — write-once, dual-redundant, 96 TB |
| Network fabric | 185 W — 2 × 25 GbE switch, HSM, KMS, crypto |
| SDR suite | 415 W — 4 channels + 2 × 50 W power amplifiers, transmit duty averaged at 22 % |
| REVENANT LINK gateway | 250 W — Link 16 terminal, MADL bridge |
| Operator positions | 300 W — 6 × 32" 1,000 cd/m² sunlight-legible panels + KVM, four lit |
| Thermal management | 760 W |
| House loads | 80 W — lighting, intercom, door, BMS, environmental sensing |
| Conversion and distribution loss | 220 W — 7.3 % |
| Total | 3,210 W — 3.2 kW |
| Heat from electronics | 2,450 W — total draw less the cooling itself. All of it becomes heat inside a sealed box. |
|---|---|
| Temperate: crew | 480 W — four operators, sensible |
| Temperate: envelope | ~0 W — 66 m² skin, 50 mm PIR liner, U = 0.35 W/m²K, ΔT ≈ 0 |
| Temperate: reject | 2,930 W ÷ COP 3.6 = 814 W. Budgeted 760 W with the units modulating. |
| At 49 °C: crew | 720 W — six operators |
| At 49 °C: envelope | 624 W conduction at ΔT 27 K + 380 W roof sol-air + 150 W door cycling |
| At 49 °C: reject | 4,324 W ÷ COP 2.4 = 1,800 W of cooling |
| Hot total | 4,330 W — 4.4 kW at 49 °C with six operators |
| Below +5 °C ambient | No heater required. The envelope loses 1,270 W at −30 °C; the electronics make 2,450 W. The compute is the furnace. The only resistive heat in the design is a 900 W vestibule element and a 40 W battery pad, both on the ramp only. |
Why one generator
| Temperate | 3.2 kW → 32 % load → 1.4 L/h JP-8 → 34 L in 24 h |
|---|---|
| Hot | 4.4 kW → 44 % load → 1.9 L/h JP-8 → 46 L in 24 h |
| Generator dead | 6.0 h temperate / 4.4 h hot on the internal 19.2 kWh pack — a refuel, a filter change or a destroyed genset is not a command outage |
| EMCON | Generator off. Thermal and acoustic signature gone. Six hours of silent mission command. |
| Step loading | None. The battery sits between the genset and everything else, so the diesel never sees a step. Diesels do not like step loads. |
Specification
Parameters
Design targets, not measured results, unless the line says otherwise.
| Form factor | Single 20 ft ISO 1CC, 6,058 × 2,438 × 2,591 mm, standard corner castings |
|---|---|
| Mass, outfitted | 8,400 kg |
| Transport | C-130J (one), C-17 (six), CH-47F sling load, HEMTT-LHS / PLS flatrack, commercial chassis, rail, ship |
| Crew | 6 operator positions + 2 jump seats; 4-position minimum manning |
| Antenna | 9 m pneumatic roof mast + 4 masted whips, erects in 4 min |
| Shielding | MIL-STD-188-125-2 tactical HEMP; 60 dB SE from 10 kHz to 1 GHz; filtered power entry, waveguide-below-cutoff vents, RF-gasketed door |
| Acoustic | 48 dBA at 7 m from the container's own fans. The generator in its enclosure at 25 m is 62 dBA — the generator is the signature, not the box. |
| Environmental | −40 °C to +55 °C, MIL-STD-810H, IP65 sealed, 100 % RH |
| Ballistic protection | None as delivered. See the risks below. |
| Setup crew | 2 for the antenna mast and ground plane; 1 to boot |
| Unit cost target | $1.9M at 240/yr from FORGE-1 |
| Compute | 4 × sled, 128 cores aggregate, 4 × inference accelerator, 128 TB NVMe |
|---|---|
| Resident mission cache | 2.4 TB — plan, ROE, terrain, structures, route graph, last consolidated track file. Loaded from NVMe, not from a network. |
| LEDGER storage | 96 TB, append-only, dual-redundant, on its own silicon, its own key and its own power domain |
| Radios | 4 × SDR channels, 2 MHz – 6 GHz; REVENANT MESH; SINCGARS, TSM and Link 16 via REVENANT LINK |
| Primary bus | 400 V DC, battery-first. The genset is a charger onto the bus, never a source. |
| Internal battery | 19.2 kWh LFP, 125 kg, in its own vented compartment with an external thermal-runaway relief path and aerosol suppression |
| Generator | One 10 kW tactical quiet unit, 32–44 % loaded |
| Cold boot | 8 min to mission command, generator excluded from the critical path |
| Displacement | 19 min commanding-to-moving; the DC bus rides the move, so PALL is commanding again 90 seconds after it stops, not eight minutes |
| Autonomy | REVENANT CORE resident; every authorisation carries the authoriser's signed identity |
Concept of operations
Six phases
-
Phase 01 — Deliver
Sited by a driver, not an engineer detachment
PALL arrives on a flatrack, a chassis or under a helicopter. No pad, no levelling, no ground-rod farm beyond a single driven rod.
-
Phase 02 — Boot
One person, one switch, eight minutes
The crypto unlock is the only two-person step, and it is two-person on purpose. Everything else is a single soldier and a master switch.
-
Phase 03 — Federate
Associate upward when there is an upward
REVENANT LINK reaches into Link 16, MADL, IBCS and NATO Link 22. This takes as long as it takes. PALL is already commanding by then.
-
Phase 04 — Command
Signed tracks in, signed authorisations out
VIGIL towers, CAIRN nodes, MARROW vehicles and VEIL-equipped dismounts push signed tracks into the resident picture. PALL fuses, deconflicts, applies the ROE and pushes authorisations back down, each carrying an identity.
-
Phase 05 — Survive
Cut anything. It keeps commanding.
Cut SATCOM: PALL commands on MESH and the resident model. Cut MESH: it commands its own sensors and hands the rest to the nodes, which hold their own copies of the same plan. Kill the generator: six hours. Kill PALL: every subordinate node continues to execute under its own ROE, and says so.
-
Phase 06 — Displace
Nineteen minutes out, ninety seconds back
Genset off, mast down, doors shut, twist-locks on. The DC bus rides the move on battery, so nothing reboots. A displaced PALL is commanding again ninety seconds after it stops.
Engineering rationale
Why it is built this way
DC-primary, battery-first
One architectural decision produces the 8-minute boot, the 6-hour generator-out endurance, the EMCON mode, step-load immunity, and the 90-second re-command after displacement. It costs 125 kg and about $34,000 of pack. Everything else on this page is downstream of it.
Four sleds, not two servers
Any one sled can be pulled and the post keeps commanding at a reduced fusion rate. Field-replaceable at the sled level with no tools and no reboot. The tradeoff: four smaller nodes are less efficient per core than two large ones, which costs roughly 90 W.
LEDGER on its own silicon
An append-only record that shares a root of trust with the thing being recorded is not a record. Separate appliance, separate key, separate power domain. The tradeoff: 140 W and a second thing to sustain, in exchange for an artefact that survives a board of inquiry.
Resident cache, not a cache of a cloud
2.4 TB of plan, terrain, structures, route graph and the last consolidated track file live on NVMe. Boot touches no network. The tradeoff: the picture is as fresh as the last sync, and PALL says how old it is rather than pretending it is live.
1,000 cd/m² panels
Command posts get worked with the door open. A 300-nit commercial panel is unreadable in that light, and then people start printing the picture, and then the picture is wrong. The tradeoff: 300 W and a real thermal contribution.
No armour
Armouring a container into something a helicopter cannot lift trades away the whole point. PALL goes behind revetments or inside a perimeter. The tradeoff: it is a soft target, we say so, and we sell a 1,900 kg appliqué kit for the crew end wall only.
Program candor
Open engineering risks
- Eight minutes is gated by UEFI POST, and we do not control UEFI. A firmware update from a board vendor can add forty seconds. There is no engineering answer except to qualify firmware revisions like they are flight software. We do. It is expensive and it makes us slow to adopt new silicon.
- The container is a soft target. It is 2 mm of Corten and 50 mm of PIR. Small arms go through it. The 1,900 kg appliqué kit gives Level III / B7 on the crew end wall only and costs C-130 margin. Protection, air transportability and container scale trade directly against each other; we take the transport penalty, armour one wall, and say which wall it is.
- HEMP shielding is only as good as the last person to shut the door. 60 dB SE assumes a clean RF gasket and a dogged door. In practice the door gets propped open. We monitor it and report shielding state to the network. The physics do not care.
- 19.2 kWh of LFP inside a manned, sealed, shielded box is a fire-safety problem that had to be engineered rather than assumed. Vented compartment, external runaway relief path, aerosol suppression. It adds 60 kg and it is the certification item most likely to slip.
- The 3.2 kW figure will be quoted without its condition. It always is. Every published instance of it here carries the ambient and the crew size, and we will keep restating it every time somebody drops the qualifier.
Related
What feeds it and what it commands
Contact
Tell us what your reachback actually is
Send us the ambient envelope, the crew size, the generators in your MTOE and the honest availability of your satellite link. We will send back the load table for your conditions and the number of hours you command without a generator.
Every figure on this page is a design target derived from first-principles analysis, not a measured result. No PALL has been built. Where a number here is later measured and comes out worse, we will publish the measured number. No export-controlled information is published on this site.