FeTAp 611 unplugged: Taking a rotary dial phone to the mobile age

FeTAp 611 unplugged: Taking a rotary dial phone to the mobile age

Speakers: Michael Weiner

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=puYlK_gzCQE

Overview

In an era dominated by sleek smartphones and ubiquitous digital communication, Michael Weiner's talk, "FeTAp 611 unplugged: Taking a rotary dial phone to the mobile age," presents a fascinating journey into bridging the past and present of telephony. Weiner, an electrical engineer and penetration tester, details his ambitious project to transform a vintage German FeTAp 611 rotary dial telephone into a fully functional Bluetooth headset for modern mobile phones. This endeavor goes far beyond mere novelty, delving deep into the intricate electronics required to replicate the complex analog signals and electromechanical interactions of an antique phone using contemporary digital components.

The core of the project lies in meticulously reverse-engineering and digitally synthesizing the unique electrical characteristics of the classic telephone system, from the distinctive ringing voltage to the precise timing of pulse dialing and the nuanced audio capture of a carbon microphone. Weiner's work is a testament to the enduring appeal of retro technology and the satisfaction of giving new life to old devices. It highlights the challenges of interfacing vastly different technological paradigms and offers practical solutions for overcoming them, demonstrating how detailed electrical engineering and embedded systems design can unlock unexpected functionalities and create unique user experiences in our hyper-connected world.

This talk is particularly relevant for hardware hackers, embedded systems developers, and enthusiasts of vintage technology. It underscores the importance of understanding fundamental electrical principles and showcases how careful design can overcome significant technical hurdles. Beyond the technical achievements, Weiner also touches upon the unexpected social interactions and nostalgic charm that such a project evokes, proving that sometimes, the most engaging technology is that which connects us not just to each other, but also to our shared technological history.

Background

▶ Watch: Speaker intro and project acknowledgements (0:00)

The project centers around the FeTAp 611, a ubiquitous German desk telephone manufactured by various companies like DTV and Siemens, based on a Deutsche Post design, and introduced in the 1960s. Its colored variants, appearing in the early 1970s, solidified its status as a cult classic. To understand the challenge of "unplugging" it, one must first grasp the underlying principles of the traditional German Plano telephone system, which operated from the 1920s into the 1990s.

This system relied on physical electrical connections rather than digitized voice forwarding for local calls. The infrastructure comprised Main Distribution Frames (MDFs), Primary Connection Points (PCPs), and Network Termination Points (NTPs), all contributing to a circuit-switched network. Key components within the FeTAp 611 itself include the ringer (a mechanical bell), the hook switch (GU, or Gabelumschalter), and the rotary dial (Numan schalter or Wählscheibe). The rotary dial features two critical contacts: the off-normal contact (NSA), which closes when the dial is operated, and the impulse contact (NSI), which generates the dial pulses—short interruptions in the loop current—corresponding to the dialed digit.

Traditional ringing required an AC voltage between 32 volts and 75 volts at a frequency of 25 Hz. Dialing involved precise timing of current interruptions, with pulse durations around 59 milliseconds and total durations of approximately 98 milliseconds for each digit. Voice transmission was handled by carbon microphones, which modulate loop current through variable resistance, and an anti-sidetone transformer circuit to attenuate the user's own voice feedback. Connections were established using rotary dialers in the central exchanges, which advanced in steps based on the incoming dial pulses.

Michael Weiner acknowledges that he is not the first to attempt such a modification. Previous efforts include a FeTAp 611 modification using a Nokia 5110 (2007, by BNV), an improved version with a Siemens C25 (by Delta Golf 7 X-ray Oscar), and even complete mechanical designs for rotary cell phones (Justine Hoped). The speaker himself had a first prototype for 25C3, built on perf board using a Siemens S35 module and an inversely operated power transformer for ringing voltage. While functional, this prototype was complex and not user-friendly for non-technical individuals.

This led to the motivation for Version 2:

• Network independence: Avoiding reliance on technologies like 3G/4G that can become obsolete.
• Simple switching: Easy transition between using the FeTAp and a regular cell phone.
• Battery charging: Integrating proper power management.
• Improved ringing voltage generation: Moving beyond improvised solutions.
• Standard components: Ensuring maintainability and reproducibility.

The goal was to create a polished, consumer-ready device that seamlessly integrates the nostalgic experience of a rotary phone with the ubiquitous connectivity of a modern smartphone, leveraging common components and robust design principles.

Key Findings

▶ Watch: FeTAp phone circuit diagram: Ringer, hook, dial (2:40)

The central achievement of Michael Weiner's project is the successful and elegant transformation of a vintage FeTAp 611 rotary dial telephone into a functional Bluetooth headset, effectively "unplugging" it from the legacy landline network and integrating it into the modern mobile ecosystem. This involved overcoming several significant technical hurdles, leading to key findings in hardware design and embedded software implementation.

One primary finding was the successful replication of the specific electrical signals required by the antique phone's electromechanical components. This included generating a robust ringing voltage (up to 60 volts RMS at 25 Hz) from a single lithium-ion battery cell (3-4.2V input), which was achieved through a combination of a flyback converter and an H-bridge. The refinement of the H-bridge's output, using sine half-wave modulated PWM, was a crucial innovation that produced a smoother, more authentic ringing sound by preventing the clapper from simply "smashing" against the bell.

Another key finding was the effective interfacing with the phone's unique input mechanisms. The rotary dial's impulse contact (NSI) and off-normal contact (NSA) were reliably read by a microcontroller's GPIO pins, enabling accurate detection of dialed digits. Similarly, the challenging task of integrating the antique carbon microphone—a variable resistor requiring a current supply—was solved by connecting it in series with a current measurement resistor and feeding the resulting signal, conditioned by an RC element, into the Bluetooth module's audio input.

The project also demonstrated the versatility of using the Bluetooth Hands-Free Profile (HFP). By designing the FeTAp as a Bluetooth headset rather than a standalone phone, Weiner avoided the need for a dedicated SIM card and enabled seamless integration with any paired smartphone. This approach unlocked non-standard, yet highly practical, use cases such as making WhatsApp calls or participating in Microsoft Teams meetings using the vintage device, showcasing unexpected modern utility for a historical artifact.

Finally, the project highlighted the importance of meticulous power management and mechanical integration. The implementation of Battery Charging 1.2 (BC 1.2) and USB-C standards ensured reliable power delivery and charging. Furthermore, the detailed work on reusing original, no-longer-produced mechanical connectors and the hook switch, including a test series to determine optimal PCB hole diameters for a secure fit, underscored the critical role of precision in bringing such a complex, multi-disciplinary project to fruition. The resulting prototype is not only functional but also aesthetically faithful to the original device.

Technical Deep Dive

▶ Watch: Rotary dial contacts (NSA, NSI) operation video (5:40)

The core of Weiner's project involved a sophisticated interplay of analog and digital electronics to interface the vintage FeTAp 611 with modern Bluetooth technology. The technical challenges spanned power conversion, signal generation, input reading, audio processing, and robust state management.

Connectivity and Architecture

For modern connectivity, the choice was Bluetooth, specifically implementing the device as a Bluetooth headset using the Hands-Free Profile (HFP). This strategic decision eliminated the need for a dedicated SIM card within the FeTAp, allowing it to seamlessly pair with any smartphone and leverage its cellular capabilities. This also expanded its utility to non-standard applications like WhatsApp calls or Microsoft Teams conferencing. Weiner selected a Physicom module featuring a Qualcomm chip, citing Microchip's proprietary configuration software and expensive evaluation boards as reasons for avoiding them.

The central control unit is an STMicroelectronics STM32L4 microcontroller, chosen for its excellent peripheral set, including Digital-to-Analog Converters (DACs) essential for audio generation. The firmware, currently written in C, manages the phone's state machine and orchestrates all hardware interactions.

Ringing Voltage Generation

Generating the characteristic 32-75 volts AC at 25 Hz ringing signal from a single 18650 lithium-ion battery (input range 3V to 4.2V) was one of the most significant challenges.

1. DC-DC Conversion: A flyback converter topology was employed to step up the low battery voltage to a stable high DC voltage. This circuit utilizes a 1:10 turns ratio transformer and a controller chip from Analog Devices (formerly Linear Technology - LT), chosen for its robust simulation library. The converter operates by switching current through the primary coil via a MOSFET; when the current is switched off, the collapsing magnetic field induces a high voltage in the secondary coil, charging an output capacitor.

• Initial Problem: During development, the simulated ramp-up to the target voltage (e.g., 60-80V) was rapid (15ms), but practical measurements showed the voltage plateauing around 40V with significant ripple. This was identified as an overcurrent fault detection mechanism triggering an auto-retry hiccup mode. The controller's soft-start pin voltage would repeatedly charge and then drop due to overcurrent.
• Solution: Reading data sheets from other manufacturers revealed that a too-fast soft-start time, determined by a capacitor value, destabilized the current control loop. By adjusting this capacitor to achieve a 55ms ramp-up time, the overcurrent protection was no longer triggered, resulting in a stable high DC voltage.

1. DC-AC Conversion (H-Bridge): The stable high DC voltage was then converted into the required AC ringing voltage using an H-bridge. This circuit consists of four transistors, toggled in pairs to reverse the polarity across the load (the ringer).

• Square Wave Generation: Initially, a simple square wave was generated by alternately switching the diagonal transistor pairs.
• Sine-Shaped Current Enhancement: To achieve a smoother, more pleasant ringing sound (preventing the clapper from harshly impacting the bell), Weiner implemented a more sophisticated approach. While the upper P-MOS transistors in the H-bridge still toggled, the lower N-MOS transistors were driven by a high-frequency Pulse Width Modulation (PWM) signal. The duty cycle of this PWM signal was dynamically modulated by a sine half-wave. This effectively shaped the current flowing through the ringer, resulting in a current waveform that, while not a perfect sine wave, was "very good enough" and produced a "quite loud" and smooth bell ring, measured at 60 volts RMS.

Pulse Dialing Input

Reading the rotary dial involved monitoring the NSI (impulse contact) and NSA (off-normal contact).

• The microcontroller's GPIO pins were configured with external pull-up resistors (or internal pull-downs, as stated for the microcontroller pins) to detect the contact closures and openings.
• Debouncing capacitors were crucial to filter out electrical noise and mechanical bounce from the contacts, ensuring accurate pulse counting. The NSI contact generates a series of pulses for each digit, while the NSA contact indicates when the dial is in operation.

Dial Tone Generation

The classic 425 Hz sine wave dial tone was generated using the STM32L4's DAC.

• A full-scale sine wave was generated internally to minimize quantization noise.
• This signal was then scaled down using a voltage divider and a potentiometer, amplified by a voltage follower, and routed through an audio switch chip (from Texas Instruments). This switch toggles between the generated dial tone and the Bluetooth module's audio output when a call is established.

Carbon Microphone Interface

The carbon microphone in the FeTAp 611 is a variable resistor that modulates current based on sound. It cannot be directly connected to a modern Bluetooth module's audio input, which expects a voltage signal and typically doesn't supply the necessary DC current.

• Weiner connected the carbon microphone in series with a current measurement resistor.
• The voltage drop across this resistor, representing the modulated current, was then passed through an RC element for conditioning before being fed into the line-in of the Bluetooth module. This method effectively translates the microphone's resistance changes into an audible signal for the digital system.

State Machine and Power Management

The phone's operational logic is governed by a state machine implemented in C (with plans for Rust in the future). Key states include:

• Idle: Low power consumption.
• Power Saving (ARM Cortex M4 stop mode): Deep sleep for extended battery life.
• Dialing: Activated when the hook switch is lifted and digits are dialed.
• In Call: Active communication.

Special transitions handle scenarios like:

• Bluetooth not connected: Lifting the handle in this state triggers a congestion tone (similar to a Gaston or busy signal in traditional networks).
• Incoming call from paired phone: If a call is already active on the paired smartphone, lifting the FeTAp's handle picks up the existing call, rather than presenting a dial tone.

Battery charging was implemented using BC 1.2 and USB-C standards. These rely on resistor encoding where both the power source and the phone use resistors to create a voltage divider. The phone then measures this voltage to determine the maximum current it can safely draw. An integrated circuit from Monolithic Power Systems (MPS) handles this negotiation, ensuring smooth and safe charging of the single Li-ion cell. While Power Delivery (PD) could offer higher currents, it was deemed unnecessary for this application.

Mechanical Integration

A significant aspect involved reusing the original connectors and the hook switch, which are no longer manufactured. Weiner desoldered these components from old PCBs. A particular challenge was the cascaded pin outline of these connectors, where a thicker part is press-fit into a hole for mechanical stability, and a thinner part is soldered. Initial prototypes had incorrect hole diameters, leading to poor fit. A test series with various hole diameters was conducted to determine the optimal dimensions for secure press-fit and reliable soldering, ensuring the new PCB perfectly integrates with the vintage phone's components.

Demo / Proof of Concept

▶ Watch: Carbon microphone and anti-sidetone circuit (6:20)

Michael Weiner's presentation included several demonstrations and visual proofs of concept to illustrate the project's technical achievements and functionality.

Early in the talk, a video demonstrated the intricate mechanical operation of the rotary dial. This footage clearly showed the off-normal contact (NSA) closing as the user began to operate the dial and opening only at the very end of the dialing sequence. Simultaneously, the video highlighted the impulse contact (NSI) repeatedly opening and closing to generate the precise electrical pulses corresponding to the dialed digit (e.g., three openings for the digit '3'). This visual explanation laid the groundwork for understanding how the microcontroller interprets the user's input.

Throughout the "Technical Deep Dive," Weiner presented numerous oscilloscope screenshots and logic analyzer traces to validate his design choices and demonstrate the successful generation and interpretation of signals.

• Screenshots from a Fritzbox showed the actual ringing voltage (37V at 25Hz) and the precise timing of dial pulses (59ms pulse duration, 98ms total duration) on a real, modern-day landline connection, serving as a baseline for his design.
• LT Spice simulations were shown, initially illustrating the ideal behavior of the flyback converter, contrasted with real-world scope captures that revealed the overcurrent fault and hiccup mode before the fix.
• Post-fix, a scope shot demonstrated the stable DC voltage ramp-up (55ms) from the flyback converter.
• A logic analyzer trace visually confirmed the sine half-wave modulated PWM applied to the H-bridge's N-MOS transistors, showing the duty cycle widening and narrowing over time to shape the ringing current.
• Crucially, an oscilloscope capture of the ringing current through the bell, measured via a shunt resistor, showcased the resulting "not perfectly sign-shaped but very good enough" waveform, confirming the success of the smooth ringing implementation.
• Finally, a scope capture of the 425 Hz dial tone generated by the STM32L4 DAC provided visual proof of the audio synthesis.

The culmination of the technical work was showcased through KiCad models of the prototype PCB, followed by photographs of the manufactured and soldered circuit board. These images illustrated the compact and integrated design, powered by an 18650 lithium-ion battery. The talk concluded with images of the assembled PCB fitted seamlessly into the original FeTAp 611 housing, demonstrating the complete physical integration.

Beyond the technical demonstrations, Weiner shared compelling social anecdotes that served as a unique proof of concept for the project's human impact:

• On a train in Spain, a breakdown caused widespread annoyance until Weiner made a call on his FeTAp, instantly shifting the mood to curiosity and engagement.
• At a flea market, the phone started ringing, captivating passersby who initially thought it was just an antique for sale.
• Perhaps the most amusing anecdote involved using the FeTAp as a Microsoft Teams headset during a video call at work, especially with upper management, leading to humorous reactions from colleagues who initially thought he was making fun of them.

These stories underscore the project's unexpected ability to foster human connection and curiosity, fulfilling its historical purpose of "making people talk to each other more" in a surprisingly modern context.

Defensive Implications

▶ Watch: Video: Electromechanical switch making connections (8:20)

Unlike many talks at security conferences, Michael Weiner's "FeTAp 611 unplugged" is not primarily focused on identifying or exploiting vulnerabilities in existing systems. Instead, it is a deep dive into reverse engineering, hardware modernization, and embedded systems development. Therefore, traditional defensive implications in the context of cybersecurity, such as patching vulnerabilities or implementing specific security controls, are not directly applicable to the project itself.

However, the talk indirectly highlights several principles that are valuable from a broader security and engineering perspective:

1. Understanding Legacy Systems: The project required a meticulous understanding of how the old Plano telephone system and the FeTAp 611 operated at a fundamental electrical and mechanical level. This skill set—the ability to dissect, comprehend, and interface with legacy technologies—is crucial in many security domains, particularly in industrial control systems (ICS) or critical infrastructure, where decades-old equipment often remains in service. Knowing how these systems truly work is the first step in securing them or integrating them safely into modern networks.

1. Precision in Hardware Design: Weiner's detailed explanation of challenges like the flyback converter's hiccup mode due to incorrect soft-start timing, or the precise mechanical requirements for reusing original connectors, underscores the absolute necessity of rigorous electrical engineering and hardware design. In security, flaws at the hardware level can lead to profound vulnerabilities (e.g., side-channel attacks, fault injection). The discipline required to make a complex system function reliably, as demonstrated in this project, is directly transferable to building secure hardware.

1. Secure Embedded Systems Development: While the project's firmware is not a security-critical application, the speaker's background in embedded security and side-channel attacks provides an interesting subtext. The choice of an STM32L4 microcontroller and the intention to transition to Rust for firmware development (though hardware support was a limiting factor) points to an awareness of best practices for robust and potentially more secure embedded code. Rust, for instance, is known for its memory safety guarantees, which can prevent common vulnerability classes in embedded systems.

1. The "Human Element" in Security: The social anecdotes shared by Weiner, illustrating how the phone sparks curiosity and interaction, highlight the human aspect of technology. While not a direct defensive measure, understanding how users interact with and perceive technology is vital for effective security awareness programs and for designing user-friendly security features. A device that is engaging and unique, even if not explicitly "secure," can foster a different kind of trust and interaction.

In summary, while the FeTAp 611 project doesn't offer direct defensive strategies against cyberattacks, it serves as an excellent case study in the fundamental engineering principles—deep system understanding, precision design, and robust implementation—that underpin both functional and secure technology development. It reminds us that often, the journey to modern security involves looking back and truly understanding the roots of our technological landscape.

Key Takeaways

• Bridging Vintage and Modern Technology is Achievable: The project successfully demonstrates that complex electromechanical systems from the mid-20th century, like the FeTAp 611, can be seamlessly integrated with modern mobile communication via Bluetooth, offering a unique blend of nostalgia and contemporary utility.
• Precision in Analog-to-Digital Interfacing is Crucial: Replicating and interpreting legacy analog signals, such as the 32-75V AC ringing voltage and the current modulation from a carbon microphone, requires meticulous electrical engineering, including custom flyback converters, H-bridges with sine-modulated PWM, and careful sensor interfacing.
• Embedded Systems are Key for Complex Control: An STM32L4 microcontroller running a sophisticated state machine is essential for orchestrating all aspects of the phone's operation, from reading rotary dial pulses and generating a 425 Hz dial tone to managing Bluetooth connectivity and power states.
• Bluetooth Hands-Free Profile (HFP) Offers Versatility: Designing the device as a Bluetooth headset simplifies integration with any smartphone, enabling not only traditional calls but also modern communication platforms like WhatsApp and Microsoft Teams without needing a separate SIM card.
• Attention to Detail Extends to Mechanical and Power Design: Successful implementation requires addressing mechanical challenges like reusing original, non-produced connectors through precise PCB hole design, and integrating robust battery charging (BC 1.2, USB-C), highlighting the multi-disciplinary nature of such a project.
• Technology Can Foster Unexpected Social Interaction: Beyond its technical prowess, the FeTAp 611 project serves as a social icebreaker, sparking curiosity and conversation in various public settings, fulfilling the original purpose of a telephone in a novel and engaging way.

About the Speaker(s)

Michael Weiner is an accomplished electrical engineer with a strong background in both fundamental electronics and advanced security research. He earned his bachelor's degree in electrical engineering from Dehabi Vishutkat, where he began working on the initial prototype of the FeTAp 611 modification project. He then pursued his master's and PhD degrees in Munich, focusing specifically on embedded security. His doctoral research involved projects related to side-channel attacks, demonstrating his expertise in identifying and exploiting vulnerabilities in hardware implementations. Professionally, Michael Weiner works as a penetration tester, applying his deep technical knowledge to assess and improve the security posture of various systems. He can be reached via email or on Mastodon.