Tadeu's Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
# Panasonic KX-TD816 serial port shenanigans

TD816/TD1232 are equipped with one/two serial port(s). This primarily serves the SMDR facility, which records outside calls (and, probably, whatever calls you want to record, the manual is extensive and I don't know for sure.) However, the RS232C port can also be used for remote programming. 

## Getting connected


Connecting the KSU to the computer is dead easy. The installation manual has instructions and even the pinouts to make it work. It's a bog standard RS-232 null cable, male DB-25 to female DB-9. Once connected, you can use PuTTY, HyperTerminal or the likes to get it connected. By default, the settings are: 9600bps, 8 bits, 1 stop bit and «mark» parity. You may want to activate RTS/CTS as well. Do that, and you get a text string that's probably something like this: 

```
ATQ0E0V1S0=1X0&D0
```

This has a function, but let's leave at it, for now. If you see it, you're successfully connected and will probably get SMDR records on your terminal. 

## Remote Programming shenanigans

Now that's where the walk in the park ends. There's absolutely no documentation available for this unit on what comes to remote programming. You'll see mentions to the «System Programming and Diagnosis with Personal Computer» on the [Features Guide](http://www.wedophones.com/Manuals/Panasonic/KX-TD%20816%201232/KX-TD%20816%20-%201232%20Feature%20Guide%20Ver%206.pdf), but not elsewhere is this document to be found. And nearly every forum post you'll stumble across will be like «wHaT ArE yOu TRyInG to DO? JuST uSE thE ProPRiETaRy teLePhoNe To PRoGrAm» or «do you need the XPTOXKCDWHTVR-4 version? sent you via PM.» I can't begin to surmise why is the telephony/PBX world so walled. Not even HVAC world is so protective of itself. 

So, you see, I'm writing this out of sheer frustration. But it gets worse. I was able to track down some of the programming software ([[telephony:td816|cf. here, in the «Software» session]]) originally used by sales representatives. So, here it is: 

{{:telephony:e1232b_v1.png|}}

It works? Ehhhhhhh... Kind of. 

{{:telephony:screenshot_20250323_203344.png|}}

It will connect to the system, but then will throw you some curveballs, as exemplified in this sequence, in which trying to get to the first group of configurations for the extensions will show a blinking message about «Saving system data» (despite nothing having been altered) and finally throw a «Parameter Error»: 

{{:telephony:screenshot_20250323_203425.png?200 |}}
{{:telephony:screenshot_20250323_203435.png?200 |}}
{{:telephony:screenshot_20250323_203440.png?200 |}}
{{:telephony:screenshot_20250323_203459.png?200 |}}
{{:telephony:screenshot_20250323_203520.png|}}

Albeit I certainly didn't test it nearly quite enough to assert how widespread the problem is, it's clear by now that this software isn't exactly a match to my TD816BX's P401A ROM. And the first version was what worked better. Versions 2, 3 and 4 would throw «Database mismatch» errors left and right. This makes sense, this ROM seems to be quite old (dating back to 1996) and, to make matters worse, this software is probably tailor made for the British version (TD816E/TD1232E.) 

Nevertheless, some sections do work and I suspect you can easily do some basic changes, like time and date. And this was sufficient pretext to throw me into a whole new rabbit hole: to understand how the software communicates with the PBX and maybe learn something in the process. 
## Into the rabbit hole

Okay, so this software is obviously suboptimal: I don't want to run it just to get system status or adjust the clock to NTP. Also, I very much don't want to rely on old OS platforms to do this. So, know what time is it? ~~It is time to stop~~ Time to spend an entire weekend trying to sniff serial traffic, fail miserably, learn stuff along the way and write this article out of frustration and need to write down some of those learnings, so they don't get completely vanished, after my brain clears it's cache. 

So, to be clear, **I didn't** succeed, thus far. Anyway, let's roll... 

### Setting the theatre

This thing is running inside DOSBox, and DOSBox is directly tied to the serial port (`serial1=directserial realport:ttyS0`). The host system is a fairly modern i5-6300 laptop, using a proprietary Dell dock which provides access to the serial port, although I don't think this detail particularly matters... The cable is an entire chapter on it's own, because it was constructed out of a Cisco-compatible RJ-45->DB-9 cable, a Cat.5E keystone and an old printer cable going into that keystone. However, the wiring is basically a run-of-the-mill DB-25->DB-9 null modem cable. 

Connecting PuTTY to `/dev/ttyS0` gets me that message we mentioned before (`ATQ0E0V1S0=1X0&D0`), and now it's time to explain what it is: whenever the PABX detects a terminal device connected to it's serial port, 
it sends those commands. If the device is a modem, this command will initialize the modem. It's an [Hayes AT command](https://en.wikipedia.org/wiki/Hayes_AT_command_set), that can also be written as individual commands, like this: 

```
ATQ0
ATE0
ATV1
ATS0=1X0
D0 (?)
```

ATQ0 sends the modem into quiet mode, ATE0 disables echoing, ATV1 calls for verbal result codes and ATS0=1X0 sets the modem to auto-answer after one ring. I really don't know much about the D0. 

This may not matter much to us, now, but might matter a bit further down the road. 

After this string, the PBX will print SMDR records. 

And that's everything you'll get from it by using PuTTY. The unit won't respond to anything you type.
Tadeu's Wiki

User Tools

Site Tools

Page Tools
