DATUs - The Tool of the New Age Phreak

by MMX

Most of this article is adapted/condensed from the administration manual.  But be honest with yourself before criticizing me for "stealing" this article.  When was the last time you called Harris and SE'd it out of them?  Huh?  Didn't think so bitch.

The Harris Direct Access Test Unit Remote Terminal extends the field technician's testing capabilities of subscriber lines through the non-metallic environment of a pair gain system.  Typical pair gain systems include SLC-96, SLC-Series 5, etc.  The system has three major components: the Direct Access Test Unit (DATU), the Pair Gain Applique II (PGA II), and the remotely located Metallic Access Unit (MAU).

Direct Access Test Unit - Remote Terminal

The DATU-RT is a printed circuit card that provides microprocessor control of line preparation functions, voice-prompted menus and status reports to the technician.  It allows technicians to access and perform specific loop conditioning and tone generating functions on any working subscriber line to prepare the line for use with field test equipment.  The card is installed in the Metallic Facility Terminal (MFT) bay and connected to the central office switch.

Pair Gain Applique II

The PGA II is a printed circuit card that extends the DATU-RT capabilities into the pair gain environment and serves as the interface between the DATU-RT and the switch's Pair Gain Test Controller (PGTC).  It determines the status of the PGTC and its metallic DC test pair, provides carrier channel signaling and transmission test results, and controls the DATU-RT's access to the MAU.  The card is installed in the MFT frame and connected to the switch.

Metallic Access Unit

The MAU provides the standard DATU-RT line conditioning functions as directed by the DATU-RT.  It eliminates the need for metallic bypass pairs from the switch to the remotely located pair gain terminal.  The enclosure is installed inside the cabinet housing the pair gain equipment.  One DATU-RT and one PGA II, working together in the same switch, may serve a maximum of 212 separate MAU locations.  The RT system provides the technicians the ability to perform a series of line preparation functions to subscriber lines.  These functions are established and maintained by authorized personnel.

Now, onto my part of the article.

I won't be speaking about administrator mode for three reasons:

1. If you accidentally screw something up, the DATU probably won't work.
2. You don't own any DATU that you're using (nor do you have permission), and therefore committing a crime by accessing one.
3. I think that if I talk about things like changing the No-Test Trunk (NTT) Busy Test, you will do something naughty.  Very naughty.

To access the DATU, dial the telephone number assigned to the DATU.

Upon connection, you will hear a 440 Hz "dial tone" indicating that the DATU has answered and is ready for password entry.

Dial the password of the DATU, which is defaulted for technicians at: 1111

If the first digit of the password is not entered within seven seconds after the DATU answers, it will release the line.  Upon entering a successful password, another DATU dial tone is heard, prompting you to dial the seven-digit subscriber line number (in other words, the number you want to test).

Occasionally, something will be wrong at the CO, the DATU will say "Error, bad no-test trunk" and a pulsating 440 Hz tone will be heard.  If you ever get this, than you probably are accessing a DATU at either a CO where someone is asleep at their desk, or in a remote office.  I have yet to get this error at a heavily manned CO.  You also won't be able to run tests if you get this message.

After the DATU prompts you to dial the subscriber line number, a few things can happen.  If you dialed a number not served by that DATU, you will get the message "Invalid prefix" and another DATU dial tone.  Upon dialing a correct number, if the line is idle, the DATU accesses the line and you will hear "Connected to, NXX-XXXX.  OK.  Audio monitor."

You can then select a line conditioning function anytime after the voice message begins, including the 10 seconds of audio monitor before the menu is presented.  If the line is busy, the DATU will say "Connected to NXX-XXXX.  Busy line.  Audio monitor."

The busy line will then be monitored for 10 seconds.  It should be said at this point that all audio traffic is unintelligible.  After the 10 seconds of audio monitor, the DATU will send two 614 Hz tones in rapid succession to indicate the end of the monitor period.

Features that would be disruptive to a call in progress are not available if the DATU-RT detects a busy line condition.  These functions include High-level Tone, Open Subscriber Line, and Short Subscriber Line.

There are theories about confusing the DATU by changing its busy test in administrator mode.  Theoretically, if you change the busy test on the NTT, you could, say, open your ex-girlfriend¿s line while she was on the net cyber-f*cking her new boyfriend.

Functions of the DATU

Anyway, after learning the status of the line, the functions are presented in a menu format.  Main Menu functions are announced as follows:

Dial 33 for Tip/Ring Short to Ground Dial 37 for Ring Ground Dial 38 for Tip Ground Dial 44 for Tip/Ring High-Level Tone Dial 47 for Ring High-Level Tone Dial 48 for Tip High-Level Tone Dial 1 to Change System Security Code Dial 2 for Audio Monitor Dial 3 to Add Prefix Dial 4 to Clear All Prefixes Dial 5 for Low-Level Tone Dial 6 to Open Subscriber Line Dial 7 to Short Subscriber Line Dial 8 to Read Job Counter Dial 9 to Clear All Counters Dial 0 to Clear Alarm Dial * to Keep Test After Disconnect Dial # for New Subscriber Line

Most of these functions actually aren't as exciting as they sound, if you're on crack.  A quick description of each of the functions:

1)  Announce Main Menu

2)  Audio Monitor  Provides a way to verify that the busy test was correct.  Traffic on the line is audible but unintelligible.  Audio Monitor is automatically disabled at regular intervals to insure that the DATU-RT is able to detect DTMF tones in the event an exceptionally strong audio signal is present.  This occurs at regular six-second intervals and is of approximately two seconds duration.

3)  Short to Ground  The Short to Ground function is used to connect the tip, ring or both leads to ground potential.  If only a single lead (tip or ring) is selected, the opposite lead is unterminated.

4)  High-Level Tone  This function places 577 Hz high-level (+22 dBm) interrupted tone bursts on the tip lead, ring lead, or both.  If a single lead is selected, the opposite lead is grounded.  This function is typically used for the purpose of conductor or pair identification.

5)  Low-Level Tone  This function places 577 Hz low-level (-12 dBm) interrupted tone bursts on both the tip and ring leads.  Because the tone signal is longitudinal, use of this function does not disrupt traffic on a busy line.  Tone bursts can be heard only on a telephone instrument connected between tip or ring and ground.  This function is typically used for the purpose of conductor or pair identification on a busy subscriber line.

6)  Open Subscriber Line  The Open Subscriber Line function removes battery (-48 VD) and ground potentials from the subscriber's tip and ring leads.

7)  Short Subscriber Line  The Short Subscriber Line function provides an electrical short across the subscriber's tip and ring leads.

*)  Hold Functions  The Hold Test feature provides a means by which a line condition asserted by the DATU-RT is maintained for a specified time interval after disconnecting from the DATU-RT.  The duration of the Hold Test interval is entered through the telephone keypad and is specified in minutes.  Any interval may be entered, however, the DATU-RT will not maintain a line condition longer than the Access Timeout interval.  The programmed function is automatically canceled by the DATU-RT when the specified time interval or, if of a shorter duration, the Access Timeout interval has elapsed.

At this point, it should be noted that upon setting up a DATU, the administrator determines the Access Timeout Interval, which is basically a timer to say "goodbye" once you've lounged too long on the DATU.  By default, the Access Timeout is 10 minutes.  Also, after hitting *, the DATU will prompt you with either "Dial number of minutes" or "Dial 2 digits for number of minutes."  With respect to single digit entries, 0 is interpreted as 10 minutes.  Also, after you use this function, the DATU will expect you to be finished and will say "Please hang up."

#)  New Subscriber Line  This function releases the currently-held subscriber line so that another subscriber line may be accessed.

Before moving on, there is one other function that is worth mentioning.

9)  Permanent Signal Release  The Permanent Signal Release function causes the removal of battery (-48 VDC) and ground potentials from a permanent signal line served by a step-by-step switch.  This function is typically used to clear a busy condition resulting from a line fault so that normal line tests may be performed.   After pressing 9 on the keypad, the DATU responds with "Permanent signal release."  After executing the required sequence of operations, the DATU tests the subscriber line to determine whether the busy condition has been cleared.  The result of this test is then announced as either "OK" if the line is idle or "Busy line" if the line is busy.  This function is not available unless specifically enabled by the DATU administrator.  Unless enabled, any attempt to use this function results in the message "Error - Permanent signal release disabled."   Permanent Signal Release will function only on a line that the DATU has identified as busy.  An attempt to use this function on an idle line results in the message "Error - idle line."

Single Line Access

You may be saying at this point, "Gee, MMX, how do you find the measure of the interior angles of a regular polygon?"  If you¿re saying this, you probably are on a large number of prescription drugs.  Moving right along...  If you should find yourself "testing" the line that you're calling the DATU with, you will realize that you can't test that line, since you're using it to call the DATU.  An interesting predicament.

The DATU is prepared as always to handle your problem.  By dialing ** before the subscriber line number, the DATU will wait until you hang up, and then test the line.  Pretty simple, eh?  Oh yes, and for those who wonder why there is no Audio Monitor during single line access: after you select the test function, the DATU will ask you for the "Number of minutes."  The testing doesn't start until one minute after you hang up.

Sadly, the actual Administrator's Guide went into great detail on the use of each feature of the DATU more than three times by the end of it.  Stupid corporate products.

Conditioning of Carrier System Lines

Note:  Unless you have a fairly basic grasp of the way pair gain systems operate, I would suggest skipping this section.

After dialing the subscriber line number, if the line is on a pair gain system, the DATU announces, "Accessing" and repeats the subscriber telephone number entered.  The DATU announces the state of the subscriber line/NTT with one of the following voice messages:

"Pair gain line, processing." - If the line is idle and is a pair gain line.

"Busy line" - If the line is busy.

If the selected line is busy, the DATU cannot determine whether the line is served by a carrier system.  It is, therefore, not possible for the DATU to activate the Pair Gain Test Controller (PGTC) and metallically connect the DC bypass pair at the RT to the subscriber line.

Without this metallic connection, the DATU cannot condition the line.  In this case, only the Audio Monitor and Low-Level Tone functions are available to the user.  Because it's signal is longitudinal, the Low-Level Tone function is generally not effective when used on a busy carrier system line.

If the line is idle, the DATU attempts to activate the Pair Gain Test Controller (PGTC).  The PGTC, in turn, tests the carrier channel and communicates the results to the DATU.  These operations require additional time and may result in a delay of up to 30 seconds.  After successfully completing these steps, the RT system identifies the carrier channel as follows:

"Single-party line" - If a single-party channel unit is detected.

"Multi-party line" - If a multi-party channel unit is detected.

"Coin line" - If a coin channel unit is detected.

If the DATU is unable to activate the PGTC or the PGTC encounters a problem in testing the carrier channel, the DATU issues one of the following voice messages:

"Bypass pair busy or PGTC failure" - The DC bypass pair is in use, all PGTC test circuits are busy or the PGTC cannot complete carrier system connections.

"Pair gain system alarm" - The carrier system serving the selected line is in a major alarm condition.

"Channel not available" - Channel test results were not provided by the PGTC.

"Bad channel" - Channel tests failed - possible bad channel unit.

After a failure in carrier channel tests or in activating the PGTC, the DATU remains in Menu Item Selection mode so that the central office personnel may more easily determine the problem.  If one of the above error messages is heard, however, the DATU is probably not connected to the line to be tested.

Therefore, line conditioning commands will be accepted and confirmed by the DATU but the condition may not necessarily exist on the line anytime after one of the above error messages is heard.

Remote Terminal (RT) Access

After the DATU has successfully accessed the subscriber line and acquired channel test results, the DATU will say "Please enter pair gain system ID.  Dial star to end."  Enter the Pair Gain System ID using telephone keypad.  To condition line from central office using the bypass pair, enter: 0*

Use the following section (Alphanumeric Pair Gain System ID Entry) if Pair Gain System ID includes alphabetic or punctuation characters.  If selected, the bypass pair must be in place between the host element of the DATU at the central office and the RT.

Alphanumeric Pair Gain System ID Entry

This section describes the method by which alphabetical letters may be entered using a standard 12-key DTMF keypad.

A.)  Enter any leading numbers that are part of the Pair Gain System ID in the normal manner.

B.)  Enter **.  This key sequence places the RT system in a special mode in which alpha and certain other non-numeric characters may be entered as a series of 2-digit key codes.

C.)  The first key depression simply identifies the key on which the desired character is stamped or printed.  Press the key on which the character appears.  For example, if character is "A", "B", or "C," press the 2 key.

D.)  The second key depression identifies a single character from the group (typically three letters) selected with the first keystroke.  The character is identified by it's position on the key.  To select the first, press 1.  If the desired letter is the second of the three, press 2.  Press 3 if the desired letter is the third of the group.

E.)  Repeat Steps C and D for each alpha character in the Pair Gain System ID.  When the last character has been entered, enter ** just as previously done in Step B.  This restores the "numeric entry" mode.  Special two-key sequences are assigned to the letters "Q", "Z," and certain punctuation characters.  The table below outlines these.

F.)  Enter any trailing numbers that are part of the Pair Gain System ID.

G.)  Any combination of letters and numbers may be entered in this manner.  Repeat the appropriate steps as necessary.

H.)  Enter a single star (*) to complete the Pair Gain System ID entry.

I.)  After the Pair Gain System ID has been successfully entered, the DATU will say "Please enter pair number.  Dial star to end."  Enter the pair number for the subscriber's line using the telephone keypad.

J.)  The DATU provides verification of the Pair Gain System ID entry with a voice message.  If a valid ID was entered, the DATU announces "Access" followed by the ID previously entered.  If the Pair Gain System ID is not valid or if the bypass pair was selected, the DATU announces "Use bypass pair."

Two-Key Sequences-Non-Numeric Keypad 2nd 1st 1 2 3 4 5 1 . , - / 2 A B C 3 D E F 4 G H I 5 J K L 6 M N O 7 P R S Q 8 T U V 9 W X Y Z

Some Words About Male-Voiced DATUs

At this point, I should mention at least something about those DATUs with an incredibly sexy male voice.

These are an extreme rarity at the date of writing.  In fact, in a list of over 200 DATUs that I have, I only know of one that still works.  Upon speaking to the man at Harris who actually developed the DATU, he said, "It's so old, you could blow dust off it."  However, since it is still in use, I will soon be writing some words about it.  Please note that if you find a DATU-I in use, that I would love to be told, as I would like to get a recording of the administrator menu for it.

Last Remarks

To begin my ending, I would like to say to anyone who thinks "Hey, cool, I'll DATU an AOL access number and make it busy," is not only lame and stupid, but also factually wrong.  The NTT can't access hunt lines, and you may inadvertently set off an audible alarm at your CO by doing so.  Oh yes, and the "LO SLEEVE" LED of the DATU will go on when you try.

In the future, I will go into the wild and crazy world of the test interface for non-standard offices.  Following that, well, I'll see what I can dig up for you.  Perhaps something about (dare I say)... Administrator Mode?

Physical and Electrical Specifications

Physical Dimensions Length: 8.0 inches Width: 7.5 inches Height: 2.0 inches Weight: 1.7 pounds Electrical Battery Input Requirement (measured with respect to CO ground): * -46 to -54 volts DC * 600 mA maximum * 2 volts peak-to-peak noise maximum from CO Access Line Interface (Ground Start) 1. Tip and Ring Parameters in Off-Hook Mode: * Meets FCC Part 68 requirements * Resistance is 120 - 280 ohms at 20 to 80 mA * Minimum DC current required is 20 mA * Typical AC impedance, at 1 kHz, is 640 ohms 2. Tip and Ring Parameters in On-Hook Mode: * Meets FCC Part 68 requirements * Minimum ring detect level is 65 volts AC rms * Uninterrupted pre-trip ring duration is 300 ms * Ringer equivalence is 0.5B 3. Secondary Dial Tone: * Secondary dial tone is provided upon ring trip, password entry, and new subscriber line selection * Dial tone is silenced when a digit is dialed or when the DATU-RT times out * Dial tone level is -16 dBm +/-3 dBm * Dial tone frequency is 440 Hz +/-8 Hz * Harmonic distortion is less than 10% 4. DTMF Dial Decoding: * Each incoming dual-tone signal is translated into one of the 12 character sets shown in Table 6-1 * Frequency deviations of up to +/-2.5% are accepted and all deviations greater than +/-3.5% are rejected * DTMF tones greater than 50 ms are accepted * Interdigit timing is greater than 40 ms and less than seven seconds are accepted * Signal strength per frequency of -20 to 0 dBm are accepted 5. Voice Message Output: * Average voice level is -13 dBm * Voice frequency range is 200 to 3,000 Hz No-Test Trunk Interface 1. Tip and Ring Parameters in Idle Mode: * Resistance is greater than 20M ohms 2. Tip and Ring Parameters in Active Mode: * Resistance is 100 to 180 ohms at 20 - 90 mA * Maximum DC current is 90 mA * Typical AC impedance, at 1 kHz, is 660 ohms 3. MF Output Parameters: * Each outgoing dual-tone sinusoidal signal is translated from one of the 12 character sets shown in Table 2 * Frequency deviation is less than +/-2% * Signal strength per frequency is -5 to -15 dBm * Digit duration is 70 ms * Interdigital pause is 70 ms 4. Dial Pulse Addressing Parameters: * Percent break is 60% * Repetition rate is 10 pulses per second * Interdigital time is 1,000 ms 5. Sleeve Current Parameters: * Low current mode is 7 to 10 mA into 120 ohm sleeve * High current mode is 50 to 70 mA into 120 ohm sleeve * Maximum external sleeve loop resistance is 700 ohms Test Function Parameters 1. Open test is greater than 20M ohms 2. Tip and ring shorted is less than 2 ohms 3. Tone Test: * Frequency is 577 Hz * Frequency error is less than +/-3% 4. Low-Level Tone Test: * Typical signal strength, measured tip-to-ground or ring-to-ground: * At the CO is -12 dBm +/-3 dBm * At 18,000 cable feet from the CO is -19 dBm 5. High Level Tone Test (Differential): * Tip-to-ring signal strength is +22 dBm +/-3 dBm * Tip-to-ground or ring-to-ground signal strength is +17 dBm +/-3 dBm.

Tables and Other Assorted References

Table 2 - DTMF and MF Decoding Character DTMF MF Set Low High Low High 1 697 1209 700 900 2 (ABC) 697 1336 700 1100 3 (DEF) 697 1477 900 1100 4 (GHI) 770 1209 700 1300 5 (JKL) 770 1336 900 1300 6 (MNO) 770 1477 1100 1300 7 (PRS) 852 1209 700 1500 8 (TUV) 852 1336 900 1500 9 (WXY) 852 1477 1100 1500 * 941 1209 0 941 1336 1300 1500 # 941 1477 KP 1100 1700 ST 1500 1700

Acronyms That You Are Too Stupid To Know

• DATU - Direct Access Test Unit
• HILARY - Guess :)
• PGA - Pair Gain Applique
• PGTC - Pair Gain Test Controller
• RT - Remote Terminal
• SLC - Subscriber Line Carrier (a pair gain system)