retronetcall - Nokia TCSM2, a bank of TRAUs with E1 interfaces: Part 1, initial examination of the h

Go inside a vintage Nokia GSM transcoder unit from the 1990s. Deep-dive examination reveals DSP chips, boot code, interface specs & potential for firmware hacking.

Key takeaways

The device is a Nokia TCSM2 transcoder unit used in GSM networks for speech encoding/decoding between BSC and MSC
Contains TR-16 board with 16 DSP transcoder channels for handling E1 circuits
Features Intel 186 processor, Lattice CPLD, and AM29F010B flash memory chips
Two versions available: ET2A (ANSI/T1) and ET2E (ETSI/E1) with different physical interfaces
Has RS-232 port for configuration and debugging purposes
System timing is synchronized across all interfaces using TCXO/OCXO oscillators
Documentation refers to optional features like TFO (Tandem Free Operation) which may require firmware hacking to enable
Power supply runs on 48V DC with custom connectors
Uses DIN 41-612 backplane connectors (3x32 pins) for interfacing
Requires exchange terminal module (2XT1/2XT1) in separate chassis for E1/T1 physical interface
Boot code stored in one-time programmable (OTP) PROM
PCM highways on backplane for routing speech channels between cards
HDLC controllers handle control communications between components
Hardware designed with focus on recoverability and serviceability

retronetcall - Nokia TCSM2, a bank of TRAUs with E1 interfaces: Part 1, initial examination of the h

More talks