EEVblog #547 - Dumpster Phone Teardown - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: November 13, 2013, 12:38:02 am
content: Dave tears down and salves some parts from old Panasonic, Telstra, Cisco, Nortel, and Polycom PABX and VOIP phones found in the dumpster.Are there any salvageable parts in them?

author: nitro2k01
author_rank: Frequent Contributor
timestamp: November 13, 2013, 01:06:19 am
content: What about look at that grill through a microscope? And if you're feeling adventurous, maybe an attempt to reverse engineer one of the graphical LCDs? (Like the one 10:40 in the video.)

author: NiHaoMike
author_rank: Super Contributor
timestamp: November 13, 2013, 02:42:00 am
content: The IP phones might be hackable, especially the ones that run Linux based firmware.

author: rain
author_rank: Newbie
timestamp: November 13, 2013, 04:23:15 am
content: The sidecar for the Polycom phones actually only transmits power over the 2 wire slide connector -- for some reason they decided to use IR to transmit between the phone and the sidecar. You can see the IR modules (one on each side) by Dave's hands at ~8:25Quote from: NiHaoMike on November 13, 2013, 02:42:00 amI'm pretty sure none of the IP phones featured run Linux -- they've got relatively wimpy processors since most of their life is spent playing a single 8000Hz audio stream

author: EEVblog
author_rank: Unknown
timestamp: November 13, 2013, 04:37:13 am
content: Quote from: rain on November 13, 2013, 04:23:15 amYes, in my hasty teardown I missed that completely.

author: Bored@Work
author_rank: Super Contributor
timestamp: November 13, 2013, 06:17:59 am
content: Small correction. At 5:15Quote from: EEVblogNo, Nortel are dead.Bankrupt in 2009, closed or sold most of their stuff piecemeal. The remains aren't worth to mention.

author: HamiltonHipster
author_rank: Contributor
timestamp: November 13, 2013, 07:13:28 am
content: Hi Dave,The speakers, especially the assembly with the bassport, look like a good opportunity to have a look at the frequency response and harmonic distortion of speakers...Would you use the DSA measure these things?

author: Kjelt
author_rank: Super Contributor
timestamp: November 13, 2013, 07:55:55 am
content: @5.34Quotewould that perhaps be a 1000uF 16V

author: chip273
author_rank: Contributor
timestamp: November 13, 2013, 08:13:25 am
content: I didn't know so many phones would use standard hitachi controller LCD boards. I always assumed they all would use some custom LCD's with no chance of reuse. Thanks for that info Dave !

author: daqq
author_rank: Super Contributor
timestamp: November 13, 2013, 08:44:35 am
content: Nice post.Minor correction: The encoders in phone #1 are not optical, they are mechanical such as these ones:http://www.sos.sk/a_info/resource/a/pdf/ec11.pdfFar cheaper, far easier to use.

author: nathanpc
author_rank: Unknown
timestamp: November 13, 2013, 03:56:28 pm
content: I really like these dumpster teardown/salvage videos, it's incredible the amount of stuff that you can get from the trash.Quote from: chip273 on November 13, 2013, 08:13:25 amI thought the same thing. It's incredible how popular they are.

author: DutchGert
author_rank: Frequent Contributor
timestamp: November 13, 2013, 04:42:38 pm
content: What are those rectangular pads on the Cisco board (from 14:17)? I also seen them on a Intel Ethernet board but what are they for? There are not grounded, no via's in them, just floating square pads with solder mask on them.

author: fcb
author_rank: Super Contributor
timestamp: November 13, 2013, 05:13:21 pm
content: Fiducial's for vision recognition.

author: DutchGert
author_rank: Frequent Contributor
timestamp: November 13, 2013, 05:27:56 pm
content: Quote from: fcb on November 13, 2013, 05:13:21 pmDont think so, whole board is covered with them and they have solder mask on them

author: NiHaoMike
author_rank: Super Contributor
timestamp: November 13, 2013, 05:29:41 pm
content: Quote from: rain on November 13, 2013, 04:23:15 amIt's pretty common to find $10 wireless routers running Linux.

author: killy
author_rank: Newbie
timestamp: November 13, 2013, 06:51:58 pm
content: Whoa! This episode became almost mike's-fastDave, can you put some board photos to flickr, please?

author: Kjelt
author_rank: Super Contributor
timestamp: November 13, 2013, 07:33:20 pm
content: Quote from: DutchGert on November 13, 2013, 04:42:38 pmyeah wondering the same thing, only thing I can think of is that this is cheaper for the pcb manufacturer because they don't have to edge all that copper away, if you produce hundreds of thousands of these pcb's that can save quite some money on the edging fluids. And if there is a mistake in the pcb you can add some fixes on these pads but then naaaaah.

author: NickS
author_rank: Unknown
timestamp: November 13, 2013, 10:53:21 pm
content: Quote from: NiHaoMike on November 13, 2013, 05:29:41 pmActually virtually every consumer router is Vxworks or Linux.As for phones it depends on the complexity of the phone if they would go for Linux or not.I'm pretty sure my Gigaset VoIP phones use Linux (or equivalent) however they have a full web interface where some of these phones would not.

author: jh15
author_rank: Frequent Contributor
timestamp: November 14, 2013, 12:15:57 am
content: How do I get started firing up those standard LCDs? I have some arduinos kicking ariund.Tutorials and data sheets links anyone?

author: calexanian
author_rank: Super Contributor
timestamp: November 14, 2013, 12:28:37 am
content: At some point a friend of mine had something to do with the audio quality at polycom. I have no idea if this was one of his designs with the seperate enclosure and the fancy bit over the mic, but I would not dobut it. He specialized in that sort of thing and whoever took over after he left kept on going with some good stuff.

author: Atreidae
author_rank: Contributor
timestamp: November 14, 2013, 12:53:42 am
content: Quote from: rain on November 13, 2013, 04:23:15 amLooks like Rain beat me to it, Poly continued this trend even on their newer colour sidecars too.. We always assumed it was some sort of isolation thing but it doesnt make much sense does it?Ill add too that the order Dave reviewed the phones in was not the order they were produced in.. I didnt get a good look but the handsets looked like anIP 301. a lower end early IP Phone from PolycomIP 330 or 331, Midrange "current" generation phone there were also more powerfull processor and audio wise supporting a massive 22khz!IP 501 High end phone of the same series as the 301Dave's commend about "they learned their lesson" re the double sided load wouldn't apply as the 501 is an older unit than the 33xJust realized, I'm apparently a phone naziInteresting fact the early x01 series were notorious for rebooting whist using speakerphone and powering them via 802.3af (Normal PoE)Quote from: NickS on November 13, 2013, 10:53:21 pmThe Polycoms are actually pretty complicated from a software prospective, upon bootup they will grab provisioning details via DHCP option 66, connect to an FTP/TFTP server and download their firmware, flash themselves, reboot, download their config and register to whatever PABX / SIP provider you are using (most commercial sip phones do this regardless) The Polycoms also have multiple stages of firmware, suggesting an OS + app so perhaps something like Vxworks or a linux kernel. They also have a built in webserver for reconfiguration and the ability to change VLAN tagging in the switch.. so alot of stuff to program from scratch.I could go on about these phones for hours but I need to get some work done

author: Rasz
author_rank: Super Contributor
timestamp: November 14, 2013, 01:53:08 am
content: Quote from: NiHaoMike on November 13, 2013, 05:29:41 pmCheapest router boards start at ~$15 for really low end, and cheapest routers start at $20.Cisco phones run VxWorks, there are many attack vectors for them including using one as a remote listening device over the network.

author: Atreidae
author_rank: Contributor
timestamp: November 14, 2013, 04:05:47 am
content: Quote from: Rasz on November 14, 2013, 01:53:08 amI remember when I was trialing large Multifunction printers for a government department we had one of the devices malfunction in weird ways.. When the engineer came out and plugged his laptop into the console I't kept printing ascii art instead of debug info. Turns out it was a Virus targeted towards Vxworks

author: Stonent
author_rank: Super Contributor
timestamp: November 14, 2013, 10:38:55 am
content: Quote from: jh15 on November 14, 2013, 12:15:57 amPretty easy:http://arduino.cc/en/Tutorial/LiquidCrystalMartin's video (the first one) talks more about serial LCDs but the parallel ones are more common and cheaper. The second video by Derek Malloy focuses on parallel displays which are most like what Dave salvaged from the phones.As long as they LCD are using the Hitachi style interface, they're pretty easy. The third video by Jeremy Blum is pretty good also. Jeremy's videos are what got me started with Arduino.

author: rsjsouza
author_rank: Super Contributor
timestamp: November 14, 2013, 10:02:46 pm
content: The TMS320VC5472 (Orion) is an ARM7 + C54x DSP designed for IP phones (some news releaseshereandhere). It probably runs uCLinux or maybe Nucleus, QNX or VxWorks RTOS.TheTNETV1055is a newer generation device with a MIPS and a C55x DSP and a boatload of peripherals.The TMS320VC5402 is a DSP-only device...

author: mariush
author_rank: Super Contributor
timestamp: November 14, 2013, 10:09:48 pm
content: QuoteIn addition to Stonent's comment, see newbiehack.com's series of videos about microcontrollers and lcd displays :http://newbiehack.com/VideoClipsList.aspx?category=LCDClick on each link , then click on those pictures with skeleton head to see the video.Or go directly to the youtube channel for the whole series with microcontrollers :https://www.youtube.com/playlist?list=PLE72E4CFE73BD1DE1

author: DutchGert
author_rank: Frequent Contributor
timestamp: November 15, 2013, 07:51:27 am
content: Quote from: Kjelt on November 13, 2013, 07:33:20 pmAnyone?

author: amyk
author_rank: Super Contributor
timestamp: November 15, 2013, 12:49:23 pm
content: Quote from: Atreidae on November 14, 2013, 12:53:42 amAFAIR they run Vxworks and there's a serial port on the board somewhere you can play with. (I never got around to RE'ing one a while back...)

author: greatal
author_rank: Newbie
timestamp: November 15, 2013, 06:03:54 pm
content: Hi DaveAbout this time tear down you always can salvage some ram and Flash chips from IP phones to upgrade your Linux base router or other devicesGood luck

author: jh15
author_rank: Frequent Contributor
timestamp: November 16, 2013, 02:14:46 am
content: Thanks for the lcd replies. I can't imagine the number of them in our town's electronic waste dropoff day tomorrow. Don't think they've had one for 3 years... Now I'll have to look at the stack of printers I am going to toss for a lcd patient.

author: Stonent
author_rank: Super Contributor
timestamp: November 16, 2013, 10:29:19 pm
content: Quote from: jh15 on November 16, 2013, 02:14:46 amMake sure to post back with pics and or video of your findings.

author: Atreidae
author_rank: Contributor
timestamp: November 18, 2013, 01:33:06 am
content: Quote from: amyk on November 15, 2013, 12:49:23 pmIts quite possibly the accessory port, as as far as I know its serial. Look for a little 5 pin female header accessible from the back of the phone.The phone Tx's Serial data on this line to control headsets and the like.Might be worth me trying to look at those ports at some stage..

author: amyk
author_rank: Super Contributor
timestamp: November 18, 2013, 08:59:00 am
content: Quote from: Atreidae on November 18, 2013, 01:33:06 amNot that one, it's not accessible without removing the back case as it's on the main PCB itself.