Analyzing a Faulty Cisco IAD2431-16FXS

I have a Cisco IAD2431-16FXS that has an issue with audio from the FXS mouth ports, sending only static, receive is fine

Testing with a 600ohm Alcatel TE200 with REN of 1 over a 1000m coil

FXS Loopback Tests

Lopping the local disables network and I get amplified static in earpiece (could be due to the anti side band in the phone too )
#test voice port 2/0 loopback local
#test voice port 2/0 loopback disable


Looping the network side yields clear audio with a tiny tiny delay from the network side which is a SIP phone via a gateway.
#test voice port 2/0 loopback network
#test voice port 2/0 loopback disable

Codec Testing

ulaw
g729r8 (dtmf-relay rtp-nte, sip-notify )

no difference, only extra compression artifacts which is expected.

VINET4 Debug

#test voice port 2/0 debug on

v4vip_isr:INT-0,1,port#=0,0000,0000,600F,0005
v4vip_active_lo_v1x:dev#=0, ch#=0
v4vip_send_cmd:cmd_len=14, port=0, 0200,540C,D9B5,DC18,22D1,74F6,00F8,03E0,0400,5839,3F00,3800,4000,BE50,
v4vip_send_cmd:cmd_len=3, port=0, 0100,0B01,0040,
v4vip_output:port=0, output_signal=4, relays=04, oper_mode=5280
v4vip_send_cmd:cmd_len=3, port=0, 0100,0801,EC00,
v4vip_output:port=0, output_signal=3, relays=05, oper_mode=5280

Comparisons

SOP (Status Operation) register at 0x0A is set to 0200 verses my other IAD’s with this register set to 0000

E1 Input testing

Dialing in via the ISDN port out via the VoIP Peer works fine. Loopback testing both ends work fine also.

#show isdn active detail

--------------------------------------------------------------------------------
                                ISDN ACTIVE CALLS
--------------------------------------------------------------------------------
Call    Calling      Called       Remote  Seconds Seconds Seconds Charges
Type    Number       Number       Name    Used    Left    Idle    Units/Currency
D-DSL   DSL          Int-id       B-chan  Callid  Conn    Disc    Call Type 
                                                          Updated
--------------------------------------------------------------------------------
In         4000        0000                   346       0       0               
   0          0           0            0     000A       1       0       VOICE  
--------------------------------------------------------------------------------  

#show voice port summary

                                           IN       OUT
PORT            CH   SIG-TYPE   ADMIN OPER STATUS   STATUS   EC
=============== == ============ ===== ==== ======== ======== ==
1/0:15          01  isdn-voice  up    up   none     none     y 
1/0:15          02  isdn-voice  up    dorm none     none     y 
1/0:15          03  isdn-voice  up    dorm none     none     y 
1/0:15          04  isdn-voice  up    dorm none     none     y 
1/0:15          05  isdn-voice  up    dorm none     none     y 
1/0:15          06  isdn-voice  up    dorm none     none     y 
1/0:15          07  isdn-voice  up    dorm none     none     y 
1/0:15          08  isdn-voice  up    dorm none     none     y 
2/0             --  fxs-ls      up    dorm on-hook  idle     y 
2/1             --  fxs-ls      up    dorm on-hook  idle     y 
2/2             --  fxs-ls      up    dorm on-hook  idle     y 
2/3             --  fxs-ls      up    dorm on-hook  idle     y 
2/4             --  fxs-ls      up    dorm on-hook  idle     y 
2/5             --  fxs-ls      up    dorm on-hook  idle     y 
2/6             --  fxs-ls      up    dorm on-hook  idle     y 
2/7             --  fxs-ls      up    dorm on-hook  idle     y 
2/8             --  fxs-ls      up    dorm on-hook  idle     y 
2/9             --  fxs-ls      up    dorm on-hook  idle     y 
2/10            --  fxs-ls      up    dorm on-hook  idle     y 
2/11            --  fxs-ls      up    dorm on-hook  idle     y 
2/12            --  fxs-ls      up    dorm on-hook  idle     y 
2/13            --  fxs-ls      up    dorm on-hook  idle     y 
2/14            --  fxs-ls      up    dorm on-hook  idle     y 
2/15            --  fxs-ls      up    dorm on-hook  idle     y 
 
PWR FAILOVER PORT        PSTN FAILOVER PORT
=================        ==================

#show voice dsp active

----------------------------FLEX VOICE CARD 0 -----------------------
-------
                        *DSP ACTIVE VOICE CHANNELS*
DSP    DSPWARE              VOX DSP                 SIG DSP          PAK   TX/RX
TYPE   VERSION    CODEC     NUM CH TS VOICEPORT SLT NUM CH TS RST AI ABRT PACK COUNT
====== ========== ========  === == == ========= === === == == === == ==== ============
C5510     26.3.14 g711ulaw  001 01 01 1/0:15    000 001 01 01   0  0    0     581/2332
------------------------END OF FLEX VOICE CARD 0 --------------------

#show voip rtp connections detail

VoIP RTP active connections :
No. CallId     dstCallId  LocalRTP RmtRTP LocalIP                                RemoteIP                               
1   55         54         18508    10458  192.168.15.121                         192.168.15.124                         
 callId 55 (dir=2): called=6000 calling=4000 redirect=
     dest callId 54: called=0000 calling=4000 redirect=
   1 context 65964984 xmitFunc 62628578
Found 1 active RTP connections

Physical

Port <-> SLIC Protection <-> SLIC <-> VICETIC <-> TDM Bus <-> DSP <-> CPU <-> SIP

Input/Output

Forming the first part of the analog section input from a RJ21 Connector thur to 8 transformers (as this a a 16FXS unit )

As tone generation ??

SLIC Protection

ST LCP1521

ST LCP1521
ST LCP1521

SLIC

Subscriber line interface card

PEB4266V and supporting LCP1521 PROGRAMMABLE TRANSIENT VOLTAGE
SUPPRESSOR FOR SLIC PROTECTION in SOC-8 package

PEB4266V

Ring generation on this chip? might be why no noise when idle

Interface Circuit

PEB3304 HL and 4 SLIC’s

PEB3304 HL and 4 SLIC’s

4 interface chips and SLICs totaling 16 analogue ports ( 8 unpopulated)
Unpolluted Interface and 2 SLIC’s

so I need to jump onto the pcm bus to see if the correct data is getting through and compare it to #test voice port 2/0 pcm-dump

Setup Capture

#conf t
(config)#voice hpi capture destination slot0:cap.dat
(config)#voice hpi capture buffer 5000000
(config)#end
#test voice port 2/0 pcm-dump caplog 7 duration 10
#test voice port 2/0 pcm-dump disable
#dir slot0:

Register Names

In the command

#test voice port 2/0 read all

The unnamed registers have the meanings below

SOP = Status Operation
IOP = Interface Operation
COP =Coefficient Operation
EOP = EDSP Operation

TDM Bus

I’m guessing being cisco it all head off onto a TDM bus as PCM data

In Cisco routers, there is one PLL on the motherboard, called the network-clock. This PLL acts as the internal clock to the TDM backplane on the router and can lock on to one external source of clocking.

DSP’s

The DSP’s are the same as a PVDM2 C5510’s only soldered onto the main board.

TNETV2510GGW DSP and K4S281632F-TC75 RAM

Cisco Magic Sauce

1x Marvell GT-96123 – chipset???
1x PCM RM5261A – 64-Bit MIPS RISC Microprocessor with 32/64-Bit System Bus
2x Altera ACEX EP1K100FC484 – Programmable logic devices

CPLD’s

proably the location of the TDM bus and the rest of the glue logic