258 lines
10 KiB
Plaintext
258 lines
10 KiB
Plaintext
Analogue Signalling Systems - An overview by NeonDreamer
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Why only analogue? Why not digital? Well let me tell
|
|
you now, the number of phreaks who know more than '.' about
|
|
digital signalling over ISDN lines is next to nothing. I
|
|
don't know much myself, let alone how to exploit it, so I'll
|
|
restrict my ramblings to what can realistically be played
|
|
with.
|
|
|
|
Firstly a note on naming conventions. Most of us are
|
|
used to dealing with American texts, and we are used to
|
|
signalling systems be referred to in terms of their CCITT
|
|
code. The UK has their own codes SSAC and SSMF for
|
|
describing signalling. For ease of use I'll stick to what
|
|
we are familiar with - CCITT conventions. If you need to
|
|
know the equivalent UK code refer to the table below.
|
|
|
|
CCITT UK
|
|
4 SSAC4
|
|
5 SSAC10/SSMF1
|
|
|
|
Non CCITT standards will be referred to in the UK style.
|
|
|
|
OK, before the good days of auto switching and
|
|
subscriber trunk dialling (STD) all trunk switching was
|
|
performed by operators on Strowger or related equipment.
|
|
Inter-exchange signalling was performed by the operators.
|
|
|
|
Obviously an automatic network needs to perform a
|
|
number of functions.
|
|
|
|
1) It needs to signal the exchange to connect caller A
|
|
to recipient B
|
|
2) It needs to supervise the call
|
|
3) It needs to give caller A feedback (ringing tone /
|
|
engaged tone)
|
|
4) It needs to bill the call
|
|
|
|
Signalling data can be transmitted as pulse breaks,
|
|
tones or binary. The following methods are still used
|
|
today:
|
|
|
|
1) Level and direction of current (in 2 wire DC
|
|
systems)
|
|
2) Pulse duration (DC)
|
|
3) Pulse combination (DC)
|
|
4) AC signal frequency
|
|
5) Frequency combination
|
|
6) Binary
|
|
|
|
Signalling across local lines has evolved from two-wire
|
|
DC systems - except ringing current and standard tones.
|
|
Tones were initially produced electromechanically as
|
|
follows:
|
|
|
|
Ringing tone 133Hz interrupted
|
|
Engaged tone 400Hz interrupted
|
|
Out of order 400Hz continuous
|
|
Ringing current 17Hz ( @ 75V )
|
|
|
|
Probably what we are all familiar with in the first
|
|
instance is called loop disconnect calling. Anyone who ever
|
|
used a rotary fone as a kid (and even on crappy payfones
|
|
now) will remember the 'click click click' that signalled
|
|
the numbers to the exchange. Remember when you first sussed
|
|
that the number of clicks indicated the number you had
|
|
dialled? Remember when you found out that by tapping the
|
|
handset rest you could dial a number without using the dial?
|
|
Did you ever wonder how it worked?
|
|
|
|
For the sake of completeness - here is the answer.
|
|
When a fone is off the hook, it allows DC current to flow
|
|
through it. When you dial, you interrupt this DC current
|
|
at 10 pulses / second (3 pulses for a 3, 10 for a 0 etc.) -
|
|
hence the term loop disconnect calling - you dial by
|
|
momentarily disrupting a DC current flow, only flowing off
|
|
hook. When your call is answered the recipients exchange
|
|
reverses the direction of current flow.
|
|
|
|
Correct dialling using this method is achieved by
|
|
disrupting the DC current for 66.7 ms with 33 ms between
|
|
pulses indicating the same number, and a >400ms of DC flow
|
|
between pulses indicating a different number.
|
|
|
|
DC signalling is limited distance wise due to the
|
|
resistance in copper wires. Consequently due to the
|
|
relatively high power requirements other signalling systems
|
|
have been developed.
|
|
|
|
DTMF dialling and electronic exchanges give a greater
|
|
signalling speed. The DTMF frequencies used are listed
|
|
below :
|
|
|
|
Digit Frequencies (Hz)
|
|
~~~~~ ~~~~~~~~~~~~~~~~
|
|
1 697 1209
|
|
2 697 1336
|
|
3 697 1477
|
|
4 770 1209
|
|
5 770 1336
|
|
6 770 1477
|
|
7 852 1209
|
|
8 852 1336
|
|
9 852 1477
|
|
* 941 1209
|
|
0 941 1336
|
|
# 941 1447
|
|
|
|
In payfone systems the call charging signal is a 50 Hz
|
|
common mode or longitudinal voltage in which both wires of a
|
|
two wire pair are driven in phase.
|
|
|
|
Blimey, we're only just on to analogue signalling. Hang
|
|
on and bear with me....
|
|
|
|
Between network switching centres parallel signalling
|
|
is used in the form of AC signals which may be single
|
|
frequency (1VF), dual voice frequency (2VF) or
|
|
multifrequency (MVF). The system has evolved from SSAC9
|
|
(1VF) in the 1950's the identically featured, but
|
|
transistorised 1980's version. Part of the adaptation has
|
|
been from 2-wire (metallic pair) to a 4-wire system.
|
|
SSAC9 uses the 'magic' 2280Hz signal frequency. This was
|
|
exploited by phreakers in the good old days and it is
|
|
nothing more than a historical curiosity now...
|
|
Multifrequency signalling is now the standard. In our
|
|
system an out of band signal of 3825Hz is used for
|
|
supervisory purposes - and enables continuous supervision.
|
|
This is due to a CCITT recommendation (Q351) and is
|
|
referred to as R2 signalling. This is the system of
|
|
signalling that '3l33t3' phreaks have taken to playing
|
|
with...
|
|
So here are the signals used :
|
|
|
|
| ______Direction______
|
|
Condition of circuit | Forward Return
|
|
---------------------------------------------------
|
|
Idle | Tone on Tone on
|
|
Seized | off on
|
|
Answered | off off
|
|
Clear back | off on
|
|
Released | on on or off
|
|
Blocked | on off
|
|
|
|
|
|
CCITT4 is an end 2 end signalling system using 2VF and
|
|
two tones : 2040Hz (from now on read 'x' [binary 0]) and
|
|
2400Hz (from now on read 'y' [binary 1]). It is used for
|
|
line signalling and interregister signalling (with serial
|
|
transmission in binary).
|
|
Consequently a 4 element code in binary gives 16
|
|
characters. 10 of these are for digits and four are
|
|
supervisory. These are given below...
|
|
|
|
1 2 3 4
|
|
|
|
1 y y y x
|
|
2 y y x y
|
|
3 y y x x
|
|
4 y x y y
|
|
5 y x y x
|
|
6 y x x y
|
|
7 y x x x
|
|
8 x y y y
|
|
9 x y y x
|
|
0 x y x y
|
|
|
|
Call operator code 11 x y x x
|
|
Call operator code 12 x x y y
|
|
Spare code x x y x
|
|
Incom. half echo sup. reqd. x x x y
|
|
End of pulsing x x x x
|
|
Spare y y y y
|
|
|
|
OK - now each line signal is prefixed with a signal
|
|
called 'P' followed by a control element ( x or y ). The
|
|
prefix is a combination of both frequencies and the control
|
|
element plays its constituent tones consecutively with the
|
|
durations as follows :
|
|
|
|
P = 150 +- 30ms (2040Hz/2400Hz)
|
|
x and y = 100 +- 20ms
|
|
|
|
There are more supervisory signals too which use X and
|
|
Y which are 350ms +- 70ms. So signalling in the forward
|
|
direction we have :
|
|
|
|
Terminal seizing PX
|
|
Transit seizing PY
|
|
Digits Shown in above table (are you
|
|
paying *no* attention?)
|
|
Clear forward PXX
|
|
Forward transfer PYY
|
|
|
|
and in the backward direction we have :
|
|
|
|
Proceed to send X
|
|
International transit Y
|
|
Engaged PX
|
|
Answer PY
|
|
Acknowledge P
|
|
|
|
Phew (that's all for CCITT4). To find better
|
|
explanations of the operator codes finish reading the next
|
|
section (CCITT5) and then go and get some deeper articles on
|
|
signalling (2600 have an excellent CCITT5 article - I'll
|
|
Xerox a copy for anyone who is interested).
|
|
|
|
CCITT5 is the system most abused by phreaks. This
|
|
system is generally abused over international 'country
|
|
direct' lines. 0800 numbers connecting you to a foreign
|
|
operator - which gives you the chance to break their trunk,
|
|
seize their line and control their system (yeah!). The
|
|
definitive guide to BlueBoxing CCITT5 is on my (growing)
|
|
list of projects, I have read the rest and will write the
|
|
best both technically and practically ;-)
|
|
|
|
CCITT5 is a 2VF system using 2400Hz / 2600Hz for line
|
|
signalling on a link by link basis. Interregister
|
|
signalling is 2MF (2 out of 6 frequency type). The 6
|
|
frequencies are spaced 200Hz apart from 700Hz to 1700Hz. In
|
|
the USA a similar, but not identical, system is used (R-1).
|
|
|
|
The CCITT5 code is :
|
|
|
|
Digit Frequencies
|
|
|
|
1 700Hz 900Hz
|
|
2 700 1100
|
|
3 900 1100
|
|
4 700 1300
|
|
5 900 1300
|
|
6 1100 1300
|
|
7 700 1500
|
|
8 900 1500
|
|
9 1100 1500
|
|
0 1300 1500
|
|
|
|
The supervisory tones (ie the useful ones!) are:
|
|
|
|
Prefix digit sequence 1100Hz 1700Hz
|
|
End of digit sequence 1500 1700
|
|
Operator code 11 700 1700
|
|
Operator code 12 900 1700
|
|
700 1100
|
|
Payfone coin control 1100 1700
|
|
700 1700
|
|
|
|
Final point - there is a modified CCITT5 system
|
|
floating around which uses a 2 out of 6 MF signal, but has
|
|
two different sets of frequencies for forward and return
|
|
signalling. The tones are spaced at 120Hz from 540Hz to
|
|
1980Hz.
|
|
|
|
NeonDreamer '95 (just)
|
|
|