TCSM2 firmware structure¶

All firmware images for TCSM2 system, for all components in this system, are stored on the TRCO card. If someone manages to find these firmware images somewhere, there is a straightforward procedure for loading fw updates onto a TRCO via the local RS-232 management port (using Kermit protocol), and if the TCSM2 is managed remotely from the BSC (using the in-band protocol on Ater T1/E1 link), the BSC can also push updates to all firmware components.

TRCO main firmware¶

On the TRCO card we got, the main fw version is TC1_PXMX.PAC 14.20-0 12/05/31. This ID string is printed on the RS-232 console on boot, and it can also be displayed with ZGI:TRCO command.

Prior to running this update-able firmware image, TRCO runs immutable "boot PROM" code from an OTP ROM chip. This boot ROM code allows the main fw image to be loaded serially with Kermit, but judging from system boot messages, it seems to also be able to bring up the E1 link to the BSC, presumably to receive main fw updates from the latter.

Transcoder DSP firmware¶

TCSM2 transcoder cards (at least the TR16-S version we got) don't have any on-board flash - hence they must be receiving their program code from TRCO on every boot. (The transcoder DSP chip appears to be a custom Skunkworks part, without any documentation, hence further investigation is not really feasible here.) Furthermore, the architecture of TCSM2 provides several different DSP code images for different PCM circuit types; according to documentation, TRCO can hold up to 3 different DSP fw images, and can only support those PCM circuit types that are covered by these DSP images.

Our TRCO card came with these 3 DSP fw images (output from ZGW command in our current config):

 TRANSCODER SOFTWARE :

    NBR   ADDRESS    PCM_LINE(S)   USED_SW   ID STRING

    1.    4000.0000:                         PID: TD6_PXMX.PRM 3.10-0 08/06/17  
    2.    6000.0000: 1                *      PID: TD1_PXMX.PRM 3.7-0 02/02/20   
    3.    5000.0000:                         PID: TD2_PXMX.PRM 3.5-0 02/02/20   

Experiments with ZRR command (the command that configures different PCM circuit types) reveal that TD1_PXMX.PRM supports PCM circuit type A (FR, EFR and CSD with 16 kbit/s submultiplexing), TD2_PXMX.PRM supports PCM circuit type B (HR on 8 kbit/s sub-timeslots), and TD6_PXMX.PRM supports PCM circuit type F (AMR). PCM circuit types C, D and E are not possible with the firmware we got.

ET module firmware¶

The firmware situation with Exchange Terminal modules is currently unclear. It seems that classic (earlier generations) ET2E and ET2A modules have on-board ROMs that are not update-able (EPROM or OTP ROM), but they also run RAM-based firmware fed to them by the TRCO.

Our TRCO came with 3 different ET fw images in it, as displayed by ZGI:ET command:

/* ET PROGRAM IDENTIFICATION */

400A.0004:      ET2RAMQA.PAC 6.1-0 10/06/25        
480A.0004:      ET5RAMQK.PAC 6.3-0 11/06/30        
700A.0004:      EA2TCSM2.PAC 4.1-0 10/06/25        

Of course it is not obvious at all from those image names which image supports which variants of ET2E and/or ET2A, but then we got an additional clue. ZGU:ET command is used to initiate the process of loading a new ET fw image over the RS-232 port; issuing this command bring up the following menu:

SELECT ECHANGE TERMINAL SOFTWARE :

    NBR   ET TYPE            ID STRING

    1.    ET2E               ET2RAMQA.PAC 6.1-0 10/06/25        
    2.    ET2A               ET5RAMQK.PAC 6.3-0 11/06/30        
    3.    ET2E/A-T           EA2TCSM2.PAC 4.1-0 10/06/25        

ENTER NUMBER : 
/*** COMMAND NOT EXECUTED ***/

As one can see, I entered an empty string instead of a valid selection to abort the operation (so TRCO manager won't erase any of those 3 flash locations) - but we extracted the crucial tidbits of knowledge as to which image supports which ET module versions.