Sony SPP-ID910 Digital 900 MHz Telephone Experiments

Overview

Another useful device for covert surveillance applications is the Sony SPP-ID910 digital 900 MHz cordless telephone.  Unlike other digital cordless phones, which are usually based around Direct Sequence Spread Spectrum (DSSS) chipsets, the Sony SPP-ID910 uses conventional Frequency Shift Keying (FSK) to send its digital audio data in a fairly narrow bandwidth of 100 kHz or so.  This is useful because low-power DSSS systems usually perform poorly in the overcrowded Part 15/ISM 900 MHz band.  A narrowband FSK system will be much more interference resistant, while still providing some "security" by using a digital transmission.  You'll notice this improved performance in several Internet reviews of the Sony SPP-ID910 where the phone's operating "range" is noted to be much greater than other similar devices.  This makes the phone very handy for modification in quick "drop-type" surveillance operations where you want decent RF range, but don't want your audio recovered by any nearby scanner listeners.  Also, since the schematics for the Sony SPP-ID910 cordless telephone are available, it may be possible to utilize the phone's stock 10.7 MHz Intermediate Freqency (IF) section to decode other cordless phones which operate using the same type of digital modulation.  The full schematics for the Sony SPP-ID910 will be available on the GBPPR 'Zine webpage.

The RF sections of the Sony SPP-ID910 use a National LMX2337 dual-PLL synthesizer for both the transmit and receive local oscillators.  The 10.7 MHz IF receive strip is based around a Motorola MC13156 IC which is specifically designed for receving narrowband FSK data transmissions.

The Sony SPP-ID910 handset is designed to transmit on 10 channels between 925 - 927.75 MHz and the base station transmits down in the 902.3 - 905 MHz region.  RF output power meets the required FCC Part 15.249 field strength settings (i.e. not much power).  The FCC emission designator is F1D (standard on/off digital FM) with a tested bandwidth of 102 kHz.

The phone's stock microphone can also be replaced with one which has a pre-amplifier stage or one modified to include some other form of audio pre-processing, such as a high-pass filter.  You can even replace the microphone line with a long run of shielded coax for remote audio operations.  It is even possible to retransmit the audio from another surveillance device for a "repeater" operation.

You may also wish to add your own battery pack for the handset.  Using four standard "AA" Nickel Metal Hydride (NiMH) batteries will prolong the transmitter (handset) operation time, while still being easy to recharge.

Pictures & Construction

Overview of the Sony SPP-ID910 digital 900 MHz cordless telephone.

You can usually find them at thrift stores very cheap.  The handset's rechargeable battery pack eventually dies, and people end up just throwing the whole phone away.

The phone's FCC ID is: AK8SPP-ID910

Internal view of the base station's circuit boards.

The LM324 op-amp on the "Line Interface Board" will be tapped to provide our raw audio output from the handset transmitter.  There is no need to connect a phone line for this device to operate.

The four LEDs indicate "Power," "Line," "Charge," and "Spare Battery."

Handset internal view.

You can remove the plastic case and alot of the taller components for reduced height applications.

Closeup of the antenna connection pad on the handset.

The large screw on the lower left held a little antenna mount which was pressed against the large tinned pad you see in the photo.  You'll may want to try adding a higher efficiency antenna or even an external RF connector.

The passive components and stripline inductors form a simple duplexer circuit, and the respective transmit and receive RF paths are then sent to their proper sections via bandpass filters.

Closeup of the line interface circuit board.

Raw audio output is taken at pin 1 of the LM324 or on the leg of the 10 kohm resistor, as shown above.

Send the audio into a LM386, via a 0.1 µF coupling capacitor, to drive a standard pair of headphones or small speaker.  You can even use an isolation transformer to run the audio into a computer sound card for further processing, if so desired.

The GBPPR 1079 Audio Amplifier from GBPPR 'Zine, Issue #39 is a useful piece of test gear for probing audio lines in this device.

Closeup of the base station's antenna connection.

The large pad was pressed against the antenna's base and secured using a screw.

You'll want to add an external antenna connection to the base so you can easily use a directional antenna for extending the operational range or for reducing any on-channel interference.  Changing the antenna polarization from vertical to horizontal can reduce some sources of interference up to 20 dB.

Overview of the base station's RF, IF, and PLL circuits.

From the antenna input on the lower-right, the signal is split into two paths and then onto two bandpass filters.  One filter is for the receive section and the other filter is for the transmit section.  In the above photo, the bandpass filter for the transmit section is labeled "480."  The receive bandpass filter is marked "481."

A National LMX2337 dual-PLL synthesizer (surface mount IC in the middle) is used to control the seperate transmit and receive VCOs.  The received signal is demodulated with a Motorola MC13156 IF strip (upper-left) operating at 10.7 MHz.  The digital audio is encoded and decoded by an onboard microprocessor.

The IC labeled "MT88E43" is part of the caller ID circuit, and is not used in this application.

Handset internal view.

The microphone is on the bottom-left, next to the buzzer, surrounded by anti-vibration material.

Alternate view of the handset with some of the unneccessary components removed.

The battery charging "prongs," volume controls, the speaker and buzzer, and the LCD panel all have been removed.

The handset's stock battery connections have been removed.  You'll need to power the handset from an external power source capable of around +5 VDC.

To force the handset into "talk" mode on power up, short the two keypad connections shown above.

This view is looking down on the handset.