Reference / Paper · 2021
An Electromechanical Telephone Exchange (PoC||GTFO 21:08)
Hobbyist build of a small exchange from stepping switches, with circuits: a practical model for a small home PBX.
Reference / Paper · 2021
Hobbyist build of a small exchange from stepping switches, with circuits: a practical model for a small home PBX.
21:08 An Electromechanical Telephone Exchange by Anonymous Dear PML, This mechanism can count pulses coming from a phone and advances its moving contacts to the next position. Most stepping switches are unable to step backward; when reset is needed, they continue to step in full circle until they get home. A local telephone exchange office is described in the book as a set of stepping relays. A destination number is sent into the line as a series of pulses. Each relay on its stage processes one digit and then passes the remaining pulses to the next stage. Pauses between each pulse series serve as delimiters between digits. The last stage relay performs the connection to the destination phone. Easy, isn’t it? I was wondering how many stepping relays are actually needed to process each call, and how they can be shared, to keep the number needed. It is obvious that stepping relays require additional circuitry to distinguish between long and short pulses, handle reset, avoid busy lines and apply buzzer current to the target phone to make it ring. One day I got some stepping switches, namely two RR3 250 010 (one motion, 11-pole, 3plane) switches manufactured by VEF Valsts Elektrotehniskā Fabrika. I’m sure you will enjoy reading this article and you will remember the old times when rotary dial phones were in common use. You will also remember the pioneering phreaks who explored telephone exchange equipment so they could make calls for free. One could implement special switch that, when activated, put a phone in high impedance mode, allowing the phone owner to accept incoming calls without sending an off-hook signal. The buzzer current would still rush in every four seconds, but the voice circuit was also connected so that callers might talk to each other, free-of-charge. In order to share the knowledge, the phreaks started the first hacker magazines as we know them today, 2600: The Hacker Quarterly and Phrack. Mechanical step-by-step dial telephone exchanges are now obsolete, replaced by electronic switching solutions which have themselves been replaced by TCP/IP. Many people have asked me how to build small telephone exchanges with old mechanical parts, so here I am to share some working solutions. It’s always fun to read about technology which appears to be functional as far back as 1891. For easy circuits with telephones skip to page 32. For more complex design with two rotary stepping switches skip to page 37. Reprinted on page 41, this work was also described in Issue 3 of Paged.Out. Before we begin, we must recognize the contributions of Svoryen Rudolf Antolievich and his book, Electronics Step-by-Step,12 illustrated by S. Velitchkin and N. Frolov. This book first taught me about early telephone exchanges and stepping switches. Here’s how a stepping relay is depicted in the book: As well as a Tesla FN 935. Tesla was an electronic components manufacturer in Czechoslovakia, which made fine audio amplifiers and other audio equipment. It also developed special hardware for military use, including phone-line multiplexers, transmitters, and this 6-plane, 12-pole stepping switch. 12 http://library.lol/main/8a7d6e726175e2679823293d58848f27 # Электроника шаг за шагом: Практическая энциклопедия юного радиолюбителя. 31 ternating current to the phone in order to make it ring, as in this design where a relay coil is used to decrease the ring voltage a little. Another way to generate ring current is to use a pulse pair of two relays, like this: Connecting Two Phones A simple two-way phone line may be built like this: Coils are actually part of a relay. A special telephone relay with two coils and a single anchor can be used, but for now, it’s okay to use two separate 24V relays. T coils pass direct current to power the phones, but resist alternating voice current and force it to go through another phone, rather than back through the power supply. A phone handset shouldn’t be lifted during the ring cycle, as the voice circuit on newer phones can be damaged by the ring current. I blew up one of my phones this way. Also, direct voltage must be mixed with alternating voltage, it is required for some phones to operate correctly. A more sophisticated schematic is shown in Figure 8, with the marked region discussed extensively here. A single relay with two coils A1 and A2 is used to power the phone. One coil can be shorted to make relay operate slower. This relay ignores ring current, but will detect off-hook direct current and disable ring. Busy relay RB is used to detect long (on-hook) pulse from the phone and perform reset. An additional coil of power transformer is used to mix −60V with 50/60 Hz 48V ring voltage. 50 Hz is a little fast for the phone, but still acceptable. Normal ring speed would be 25 Hz or so. The positive power pole may be connected to ground, this will decrease corrosion on wires though an effect called cathodic protection, especially when an underground line is used. Unlike switching-mode power supplies, a power transformer galvanically separates the line from the mains network. You might wonder why 48 VAC becomes 60 VDC Ringing the Phone Here is a simplified schematic of an old landline phone. The phone does not pass direct current while onhook, but it does pass alternating ring current. The ring capacitor value is typically 1µF @ 250V. Some old phones have ring and voice capacitors made as a single unit, like the one shown here, but they are two separate capacitors anyway. So we need to apply al32 after the rectifier? That’s because AC voltage is measured in RMS value. Peak voltage values can be derived from RMS when needed. Two-way Phone Line with Ring A normal single-coil relay can be modified to accommodate a second coil, simply by winding another coil up on top of factory coil, like this. In this design, relays A1 to A4 are separate 24V relays without shared coils. The other five are 12V logic relays. 48V DC can be drawn from four 12V lead-acid batteries, or from some other source. 1µF capacitors divide the voice line into two independently controllable parts. The busy relay RB is shared between two phones. When one phone goes off-hook, a ring cycle will be triggered in the onhook phone. The ring length is set by the value of the upper capacitor near the RB relay. This simple design is recommended for home use, as it requires little debugging effort. Manual Switching Almost all early manual telephone exchanges, both large and small, have parts in common. For each telephone there will be numbered socket on the board accompanied by line indication lamps. PBX operators would use connection kits to talk with customers and perform connections to other phones or trunks. Each connection kit has two wires with stan- Figure 8: A more sophisticated phone schematic. 33 dard 3-pole TT jacks at the end. Each wire has a corresponding tri-state switch for sending ring signals and for connecting an operator’s headset to the phone. Trunk lines are used to route call between exchanges. Customers were not allowed to talk to other exchange operator via trunk lines, it’s the operators who would have to talk to one another via the trunk to setup calls. Manual exchanges have poor scalability. One improvement was to implement an exchange with separate panels, A and B. The operator at panel A would ask the customer about the destination number, while the operator at panel B would perform the connection to the destination phone. Automatic Step-by-Step Switching I need to make a note about terminology. I have two reference books on my mind: first is a Soviet ATS-47 reference book,13 and the second is AT&T’s training course.14 There is no strict terminology in this article, but I’m going to use the terms “forward seeking” and “backward seeking” from ATS-47 to explain one thing. Each phone line usually has some fixed amount of equipment at the exchange office, a so called “line kit.” For 10,000 phone lines there will be 10,000 line kits. Yes, sometimes two phones may be connected to one phone line and share a line kit. (Only one phone may be active, depending on polarity.) The line kit will activate other equipment when a customer begins the call. The line kit must be relatively small, especially for a home-made telephone exchange. The Soviet ATS-47 setup uses forward seeking at the call pre-setup stage. This means that each line kit has a stepping switch which selects a free line for next dialing stage. After the call, it must return back to the home position to accept more incoming calls. Up to ten group-seekers can be connected to the outputs. This works faster than the backward seeking method, but it requires one rotating onemotion switch to be in each line kit, which can be expensive. 13 http://library.lol/main/bbe9fc9ddf1be20fc491e8e4b997da70 14 http://library.lol/main/321ac6b297bd75792f318fed8da5928e 34 device is used to prevent multiple seekers from hunting the same phone. When all line hunters are busy, there will be no dial tone heard. Hot line phones, such as street phones and PBX trunks, may be connected to the first stage directly without the presetup stage, such phone will have one dedicated first stage device. Backward seeking is more like manual switching. The kit consists of two switches, with the first switch (the line hunter) navigating to the phone that needs to be served. The second switch accepts one digit and connects to the destination phone. Wires A and B are used for voice and pulses transfer and for reset signaling between group seekers. Wire C is used to mark the line as free or busy. Most Strowger switches have three arrays of outputs and three contact arms, sometimes two fields are sufficient. Switch operation may be driven by pulses coming from the phone, which is slow, or it may be free switching, where the switch quickly steps itself until it finds the right position. Strowger Switches and Trunk Lines It’s a good idea to use a Strowger switch with 100 outputs as an output switch. It will consume the two final digits of the phone number to drive its arm up and then around to the desired contact. If we have more than 100 phones we’ll use group seeking. A group seeker is a Strowger switch that accepts one digit to drive the arm up, and then seeks a free device from the next stage to continue dialing. Up to ten devices may be connected to the digit. If no free device is found, the arm will stop at the “trunk busy” contact at the end of the row. The group seeker must find the free line before more digit pulses begin to arrive, so all but the very oldest exchanges have a special mechanical feature to increase the pause between digits. The line hunter is a Strowger switch, too. It connects one of the phones to the first stage group seeker. A dial tone in the handset means that first stage seeker is waiting for its first digit. A special 35 Figure 9: First Timing Diagram Figure 10: Second Timing Diagram 36 In real-world systems, wire C is more complicated. One simplification was to use HIGH (12V) logic level on wire C as a busy signal, to keep the line kits small. Here every line kit contains one relay and one diode. (An optional indication bulb may be hooked to wire C.) This design can be joined with a manual exchange desk, provided that each socket will pull C high to prevent the line from automatic switching. ROH is an off-hook detection relay, it has 48V coil. The A1, A2 relays have 24V coils. All others are 12V logic relays with the other pole connected to logic ground. Some of them have capacitors to increase release time. Figure 9 is a timing diagram that will help you understand the logic. PoC Telephone Exchange Unit I’m going to show you a more complicated design, one that I’ve built. It has just two rotating switches, so only one pair of telephones may use the connection kit, and other telephones must wait their turn. Up to ten phones may be used total. There is no dial tone circuit, as that would require an additional coil on the A1-A2 relay. 37 RHM and RSW are stepping relay magnets. They draw current up to 1A, so protection diodes are there to reduce sparks on relay contacts. Both stepping relay and phones draw power from the same power transformer, but there are two diode bridges, one for voice circuit and one for the magnets. Without that, the RSW relay would cause brownouts on the −60V supply and the phone would be unable to send clear pulses. The second part of the circuit performs the line checking sequence. diagram for second part: This second timing diagram is shown in Figure 10. How to protect relay contacts? Inductive loads like relay coils, large electromagnets, and DC motors will generate inductive peak voltage when disconnected. This inductive current will generate sparks and degrade switching contacts that control inductive circuit, so a protection diode is needed. ATS-47 uses RC filters instead. Spark current can have high frequency components, and the filter will pass it around and decrease interference to other equipment. It’s okay to use both diodes and RC-filters, of course. What are values of those capacitors? Capacitors are used here to increase relay release time. When a relay is powered, the capacitor charges itself and accumulates a bit of energy. After power removal, the capacitor will power the relay for two seconds or so, and then discharge. The resulting delay time depends on the relay armature type, capacitor value and other things. A 1000µF capacitor with 12V relay coil will give 200 milliseconds delay or so. It’s suitable for the RB, RTIM1, RTIM2, RCHECK relays. 100µF is good for fast processes, like line hunters RH1 and RH2. 3300µF will power the RRING relay, giving 600 milliseconds of ringing. An alternative way to slow down a relay is to short-circuit one of its coils or add a copper disc near the coil. This increases the inductance of the relay, and therefore also its release time. 15 unzip Audio! I’ve made a small audio recording.15 Listening to it, you can hear my telephone exchange unit in action. Various phone rings and rotary dial sounds follow starting from 0:37. The ring sound will differ depending on buzzer current frequency, I’ve tried both fast (50Hz) and slow (using relays). How can we trace a call? On the ATS-47 all switches used in a call cannot be released until the recipient phone goes back on its hook. This can be used to track the originating phone, even if the caller has gone back on the hook. Having received a call, the recipient might dial a special digit to signal an operator, who can then be asked to track the circuit back to the originating phone. During this time, the caller is unable to make another outbound call. Wires A and B between switches are used to transfer signals about answered phone and reset, along the voice. These signals activate the successful calls counter, which is used for billing. A first stage seeker may swap the originating phone line polarity when the other phone is answered. Manual exchanges use this as an additional indication that recipient is ready to talk. Street phones will grab the coin when the line polarity is reversed. A customer often forgets to place his handset on-hook. There is a special circuit to detect such phones, with a delay of one or two minutes. pocorgtfo21.pdf phones3.mp3 38 Greetings for the neighbors! I’m not alone in building relay-based devices. In fact, there is whole Hackaday thread about this.16 There’s also Artyom Kashcanov aka Radiolok (Hi!) and his BrainfuckPC. There is Harry Porter and his HPRC ; Harry made a very nice introductory video about relay logic.17 And Michael whose demonstration setup using five Strowger switches is well documented at his homepage.18 Em Lazer-Walker uses small PBX switchboard as a front-end for her videogame. Frankfurt’s Museum of Communication also has a large working demonstration setup. 16 https://hackaday.io/project/11798-relay-based-projects 17 http://web.cecs.pdx.edu/~harry/Relay/VideoTutorial/index.html 18 https://www.seg.co.uk/telecomm/automat4.htm 39 + Do-It-Yourself: - - + Stepping Telephone Exchange Lesson 1. Connect two phones: Rectifier diode bridge Power transformer 48 volts AC output Fuse 1A Coils pass supply current to phones and keep voice current away from power supply Relay coil - 24 volts 2200μF 100V 2200μF 100V Mains plug МБМ 100V 1μF МБМ 100V 1μF - mains plug Long low pulse causes line reset -60v 48v 2200μF 100V + r1 r3 r2 r4 Line indication lamps 1μF 100V TA1 Spring rtim1 relay sends ring signal after digit is done TA1 24V coil from relay rtim1 +12 Capacitors increase relay release time Coil Desired Capacitor Relay voltage release value (μF) name (volts) time (sec) rb rtim1 rrin roh rh1 rh2 rtim2 rcheck 12 12 12 48 12 12 12 12 0.3 0.3 0.6 N/A 0.08 0.08 0.3 0.3 1000 1000 2200 100 100 1000 1000 rb Ratchet gnd60 rsw rst pulses wire +12 Diode pass self-induction current and reduces sparks on rst relay rinv voice supply with independent rectifier and supply filter -60 volts rb relay distinguishes long and short pulses +12 -60v +12 rrin r1 Home position finder Contacts Magnet (rsv, rhm) Angle adjustment +12 TA1 Wire A r2 Dial number on this phone Brushes Moving brushes TA5 48v voice ground This circuit does not detect off-hook, so don't pick headset during ring cycle Capacitor's values are relay-type-dependent Wire B Wire C Lesson 4. Off-hook line hunter, line probing, timing circuits: rdi4 roh hunter lamp voice -60 +12 voice voice ground +12 -60 -60 Here high level on wire C means line is busy, however, in real-world it must be low - busy, to prevent errors when wire C fails +12 rhold rcansel cancel output enable wire C rhold +12 r1 +12 r3 voice -60 This is single relay with two 24V coils voice gnd on one anchor r2 rout rcancel 1μF 100V rrin 48v +12 voice -60 wire A r4 rnoring 1μF 100V TA8 rinv +12 wire c rhold rnostep r3r4 relay becomes slower when r4 coil is shorted to gnd. It ignores ring current, but still detects off-hook See also: International Journal of Proof of Concept or GTFO issue 0x21, long article about phones wire B no ring Another coil of power transformer Two stepping switches are located near and all outputs are paralleled -> pagedout.institute <- issue #3 2020 41 gnd60 rsw rst +12 line probing gnd60 +12 rhm pulses wire TA5 rdi8 rhome rh1 +12 -60v +12 rhm Line probe current rdi5 rh2 rb wire C wire A wire B TA4 rhold rcheck voice gnd Hunter timing relays rprobe +12 Wire A home Diode prevents backflow Phone busy lamp Skip busy line rtim2 roh relay coil is 48 volts. roh and r1 must not clobber and be triggered together by one phone current. roh current needs to be small Wire B +12 rhome 48v TA2 1μF 100V Need to add one more always-on 12 volts relay that will discharge power capacitors at power down. Connect it after 12 volts fuse and make it also disconnect 48 AC wire before the bridge Lesson 3. Connect phone to Stepping Switch (easy way): Press here mains plug ta2 ta1 Rectifier diode bridge Time Lesson 2. Ring the phone: +12v supply Line relay 10 ohm 3W rtim1 Line Current Phone consumes little current while on-hook Non-polar capacitors pass voice current Supply filter removes hum Fuse Short low pulses encode the digit Soviet TA-68 phone