Teardown: Cisco 7945 IP Phone, USB 5V Power Modification & Power Consumption

As much as I love the iconic look of the Cisco 79xx series, one of the units from my recent haul had a minor issue that meant it was not really usable as a phone. Since it was being replaced anyway (and I got to keep the old unit), let’s crack it open in the name of science and to satisfy a curiosity.

Perhaps we can even make it a little more “home-friendly” by not needing 802.3af PoE or 48V DC in the process … or perhaps fix it for good?

Teardown – The Base Unit

Taking apart this phone requires hunting for screws. Two are easily visible on the back, with two more hidden inside the rubber feet.

I thought I had it all and started to take it apart … forcing it to the point that I managed to crack the case. One sneaky little screw is hidden underneath the receiver hook plate below the hook switch … whoops! In spite of this, the case parts seem to fit together very well, because there is foam gaskets keeping it nicely sealed. The back cover mechanism that controls the large flap-style stand is seen above – seems like the lubrication is still good too.

The business side comprises of one large PCB to which all the ports are mounted. Connectors are used to attach the speakerphone microphone and speaker, hook switch and ringing LEDs.

In the gaming world, optical keyswitches are now all the rage – but this Cisco desk phone has an optical hook-switch! I didn’t expect that – most of the phones I normally use have a physical, sometimes crackly, hook switch. There are also a number of silicone rubber inserts around where the receiver sits, which provide some “padding” for the receiver to rest onto, making for that firm but satisfying “thunk” of hanging up the phone. I guess this is what sets this apart from cheaper consumer products.

The main PCB is copyright 2009, giving us a firm date of about 13 years old. The board is a aqua-green with gold pads, which seems to be a quality four-layer board. It’s not all that cluttered but also serves as the front-panel switches, explaining its physical size. Let’s take a closer look at the board in the following images.

We can see the speakerphone microphone in the bottom left attached to a connector and shrouded in a silicone sleeve to isolate it from case vibration feedback. A MAX232 is seen, which supports the supposition that the AUX port is some form of console-port (or accessory port that communicates using serial). The magnetics for the two Gigabit ports are seen above the ports, while a network of diodes is seen below which are most likely used to arbiter between different sources of power with potentially different polarities (e.g. PoE Mode A/Mode B or barrel jack). The barrel jack power seems to pass through a sizeable onboard choke to reduce potential RFI.

The wires to the speaker pass through a sizeable onboard choke – perhaps to eliminate potential RFI noise. Other than this, a programmable reference voltage and op-amp are also seen.

The right side of this seems to be main power converter that handles the 48V DC from PoE or barrel jack. The output seems to be filtered by inductor, ceramic capacitors and a solid electrolytic capacitor – no capacitor plague here! (EDIT: I’ve been informed by a reader that the vent scores on the can means this is an ordinary SMD electrolytic capacitor – hence not immune to capacitor plague. I stand corrected!) Without looking too close into it, it seems the Pulse PA2725NL is an isolated-winding transformer, with feedback flowing via the optoisolator next to it. There is an FDS2582 N-channel MOSFET on the input, perhaps to chop, while an FDS3572 N-channel MOSFET on the output may be synchronously rectifying (at a guess). The show is orchestrated by a Linear Technology LTC4267 Power over Ethernet IEEE 802.3af PD Interface with Integrated Switching Regulator. Also visible is a pair of HCT4053 analog switches and HCT32 OR gates. Perhaps they are involved in audio routing in some way.

A 25MHz clock crystal seems to serve a clock reference for this unit, seemingly run by an unidentified chip marked IDT6P400 86PGG ZA0947T. A slot is cut through the board for a clear leaded SMD LED package. Gigabit Ethernet connectivity is provided by a pair of Broadcom BCM5481A1KMLG Ethernet transcievers. It seems there is no actual Ethernet switch chip on the phone, thus the function likely requires the intervention of the main CPU or maybe has been integrated into the main ASIC.

In this corner, we see the ribbon for connecting the LCD module and Texas Instruments HC595 shift registers. Some interesting LED packages are mounted on this side as well, configured to fire through a hole in the PCB to the other side – we don’t see these around very much anymore. There is the main RAM for the phone, a Samsung K4H561638J-LCB3 32MiB DDR DRAM chip.

The firmware is likely stored in the Spansion S29GL128P11TF102 128Mbit (16MiB) NOR Flash memory. This is to the left of test-pads marked DSP and MIPS which might be used for debugging, production test or initial programming. There is an unidentified Texas Instruments IC marked 97CX7YTL that appears to be a power management IC responsible for generating the other voltage rails needed for the phone.

The heart of the phone seems to be this ASIC with the Cisco Systems logo. Dated 2008, it has a part number of F751916BGZDW and seems to be common to much of the 79xx line. According to a later source, this is a Texas Instruments part – that wouldn’t be entirely surprising given their heritage in doing DSPs.

With the board extracted from the casing, what is left is mostly the hard plastic buttons that push upon the rubber membrane and the LCD assembly.

The display comes from Innolux and carries part number AT050TN23. It is a TN display that seems pretty well integrated into the front casing. I did not attempt to remove it to avoid potentially damaging it.

The push-buttons are based on remote-control and calculator-style rubber membranes with conductive spots.

The PCB interfaces to the membrane with gold-plated interdigitated fingers across the width for most buttons, however, where the buttons light-up for the lines, the contact is changed to an annular ring pattern with a hole in the centre for the LED on the board to shine through.

Why does the speakerphone on this unit sound so good? Aside from having its own sealed acoustic chamber for proper frequency response and rubber sheeting to prevent any case rattling, the high-excursion speaker has a generous 6W rating and thus is probably never over-driven, keeping distortion at bay. Just another way in which this proper phone differs from the cheaper consumer level desk phones. The chamber probably also helps reduce case-induced feedback to the microphone in the speakerphone mode, allowing the speakerphone to go louder without echoes.

A teardown of a later Cisco 7975G by iSuppli in 2008 seems to reveal very similar components to this unit. An except of the top 19 components is quoted below:

Major Cost Drivers (Representing 76% of Total Direct Materials Costs) – Top 20 [sic] Items

1. Innolux Display Corp. – AT056TN53 – Display Module Value Line Item – 5.6′ Diagonal, 65K Color TFT LCD, 640 x 480 Pixels, w/ Touch Screen & Backlight
2. Texas Instruments (Cisco Systems) – F751916BGZDW – ASIC – IP Phone
3. Touchscreen Overlay – 4-Wire Resistive
4. Pan-International Industrial Corp. – 6-Layer – FR4
5. Broadcom – BCM5482A1KFBG – Gigabit Ethernet Transceiver – Dual Port, 10/100/1000 Base-T, 130nm
6. Button Insert – Injection Molded Plastic, 2-Shot (Qty:14)
7. Spansion – S29GL128P11TFI02 – Flash – NOR, 128Mb, 3V, 110ns, 90nm
8. Ceramic Multilayer – X5R/X7R (Qty:310)
9. Pulse Engineering – H2053BNL – Ethernet Magnetics Module – 10/100 Base-TX, VoIP, Dual-Port (Qty:2)
10. Button Insert – Clear Injection Molded Polycarbonate (Qty:9)
11. Enclosure, Main, Rear – Injection Molded ABS
12. Front Faceplate – Injection Molded ABS, Silver Painted, Silkscreened
13. Enclosure, Main, Front – Injection Molded ABS
14. Linear Technology – LTC3407EMSE-2 – Regulator – DC-DC Converter, Dual, Step-Down, 800mA, 2.25MHz (Qty:2)
15. Button Insert – Injection Molded Plastic, Silkscreened (Qty:6)
16. Samsung Semiconductor – K4H561638H-UCB3 – SDRAM – DDR, 256Mb (16M x 16), 166MHz, 2.5V
17. Rear Foot Stand – Injection Molded ABS
18. Texas Instruments – TSC2000IPW – PDA Analog Interface Circuit – w/ 12-bit A/D Resistive Touch Screen Converter & Drivers
19. AVX – TAJ Series – Tantalum – Encapsulated, 10V, 470uF, 85C, 20% (Qty:2)

Materials and Manufacturing $87.46

I guess making IP phones is a profitable business … especially when it also leads to software and maintenance contract subscriptions.

Teardown – The Receiver Handset

As for the actual fault, it was to do with the receiver handset speaker which wouldn’t play any audio whatsoever. I verified this by exchanging cords and receivers – the only commonality was the receiver itself, so I decided it would be good to take a look inside to see if it can be fixed.

Unfortunately, the unit is manufactured in such a way that it is glued shut. Opening it up by force seems to be the only way and damage to the edges and plastic pegs/holes unavoidable. Inside, we can see a metal weight, insulated with some tape, screwed to the frame.

The faulty speaker is secured to the top with a plastic pressure plate screwed down at two points. Interestingly, the speaker has three connections rather than the customary two. The printing visible through the hole has “WB” visible – it seems there were versions of these handsets that were not wideband.

The input jack is wired through to this PCB containing a chunky inductor and several capacitors. Perhaps this is for filtering of RF noise. Nevertheless, the three connections that go to the speaker are marked COM for common, VC presumably for voice coil and HAC which may stand for hearing-aid coil. I suspect this latter connection is to add additional magnetic field to help with T-coil enabled hearing aids or to add additional gain.

The microphone resides on the back-side of the PCB, which sits comfortably in a silicone rubber gasket to prevent acoustic feedback.

A foam donut is adhered to the rear of the speaker to provide additional pressure to seat the speaker into place. Everything has seals and gaskets – that’s Cisco quality! Measuring resistance, VC-COM was open, while HAC-COM showed 32-or-so ohms. I decided to swap VC and HAC connections and could only hear the faintest of audio … so that was not a fix. Unfortunately, the connections at the speaker were completely potted – I suspect the thin enamel wire may have fractured due to shock or age … so this one is pretty much a goner.

On the plus side, the microphone still works and the unit can still be used as a speakerphone, for what it’s worth …

Swap PoE for USB 5V?

The use of 802.3af Power-over-Ethernet (PoE) was a great option for corporate environments where changing a switch in a cabinet to PoE would mean power for all desks without any additional cables or power-points required. Unfortunately, this is still not a technology that is all-that-common in the average home (although this is slowly changing, especially with the proliferation of Ethernet IP surveillance cameras).

Cisco, having thought of the fact that not all companies would be happy to upgrade to PoE at a whim, especially in the case of having just a few endpoints to support, had a second option of supplying DC locally via a barrel jack to the phone itself. Unfortunately, to make their lives “easier”, they chose to make this 48V DC which is not a common voltage in the home (or outside the telecommunications field). Add to the fact the existing barrel jack has been severely tarnished over time, it doesn’t seem like that would work without at least a little mechanical assistance.

Unsurprisingly, these phones did not come with the CP-PWR-CUBE3 power adapter since they were likely used in a PoE environment. While there are some questionably-cheap PoE injectors available for as low as AU$13-14 each in bulk (and I’ve got some on the way), quality units often command double the price.

Having opened the device, it seemed there was an easier way.

This seems to be the power circuitry and rather nicely, P35 is marked P5V which suggests to me that this is the main 5V rail. There are plenty of ground connections – P16, P37 and P10 in the same shot. I decided to use some DMM probes to apply 5V across these connections and no surprise – the phone fired right up with an “eyeballed” peak consumption of 1.2A during booting.

Not complying with USB standards nor providing any additional safety, I connected a microUSB socket (on my Kelvin breakout, just because it was on-hand) to those pins.

Ideally, a Schottky diode would probably be nice to prevent reverse-powering, a polyfuse to protect against overloads and maybe even a unidirectional TVS diode to prevent against overvoltage, but this is a written-off $1 phone we’re dealing with here …

I eyeballed a location on the side of the case, but perhaps could’ve done better as it didn’t quite squeeze in so well. I later had to cut some of the interior casing that was responsible for the silicone pad in the bottom-left microphone portion of the receiver to make the casing close nicely.

Copious amounts of hot glue did the trick when it came to securing the connector into place.

There we go – the phone runs from USB, in this case, a power bank. It connects at the full Gigabit Ethernet rate, the connected devices suffered no ill effects and the internal Gigabit “switch” seemed to be working just fine. The phone didn’t seem to know the difference, so I would call this a success. Perhaps if you were to try it yourself, maybe pick a better location for the socket or just cut-up a cable instead.

Test: Cisco 7945 Power Consumption

While we know the 7945 was designed for 802.3af PoE, I guess this is a good opportunity to examine a few things:

• Can the 7945 be powered from non-standard PoE injectors?
• What is the lower-end voltage tolerance of PoE power?
• What is the power consumption of the phone in various modes?
• How big a USB power supply would be necessary?

To test this, I used my modified DSLKIT 802.3bt PoE injector to provide “standards compliant” PoE in a way that I could measure current using my Rohde & Schwarz HMP4040. For the Gigabit Passive Injector, I used an older Mikrotik RBGPOE adapters. For the 100Mbit/s injector, I used a cheap generic mid-span injector. It is notable both are wired as per the Mode B wiring (4,5 positive/7,8 negative). Power for the USB case was also provided from the Rohde & Schwarz HMP4040 via a banana to USB adapter.

In testing, it was determined that passive PoE adapters with mode B wiring seem to function just fine when supplied at 48V. The minimum voltage for reliable start-up appears to be about 38V which is close to the 37V required by the standard. There is not much leeway here, so it’s not likely you can get away with a smaller voltage plug-pack using regular PoE.

Current consumption was measured by eyeballing the boot maximum peak current, the idle current at 50% screen brightness, the idle current with the screen asleep, the current of a speakerphone call with maximum volume playing loud hold music and a “worst case” including a PC connected on the additional switch port at gigabit rates for both standards 802.3af-compliant PoE and USB, while spot-checks were done on passive injection on idle cases.

Quiescent draw of each injector was measured and the quiescent value was subtracted from any measured value to leave the phone consumption tabulated below. The exception is with the 802.3bt injector where some additional active circuitry functions may add a small amount of consumption that is technically on the PSE side.

The results seem to show that the phone needs about ~142mA at 48V to satisfy the worst tested case, so the 0.38A rating on the back seems to give some headroom. But this does mean the phone is consuming close to 6.8W! Using a passive gigabit injector worked fine and resulted in a gigabit link being achieved. A minor current reduction was seen of about 8.7mA which may be the current saved from the PSE’s circuitry that negotiates PoE. With the 100Mbit/s injector, a 15.4mA saving is realised, likely due to the reduced link rate requiring less resources to process.

It would seem that at 5V, the USB input needs to be around 1.2A to meet the worst case. As some additional margin is necessary for current peaks, a 2A adapter with good quality cable is recommended. But this is well within the realm of a USB power supply. On the plus side, it seems we save some power too – compared to using PoE, the consumed power is less because there is one conversion step taken out of the power chain. This results in an estimated PoE power conversion efficiency ranging between 74 to 84%, which is in line with my expectations.

Unfortunately using USB, even idling with the screen off, the phone is burning up about 3.8W – this is more than some smart-phones consume while actually in use! With the screen on at 50% brightness, this is about 4.5W which is close to the amount taken while actually “doing business” on a call. I guess that’s probably one good reason not to have one of these running on your desk all the time. Perhaps the monochrome screens of the predecessors are more power-efficient, especially if not actively backlit, but I suspect the DSP and cores are partly to blame for the result. On PoE, this rises to approximately 5.0W and 5.8W respectively.

Conclusion

Unfortunately, the bad unit couldn’t be saved by opening it up – in fact, through some brute force, I managed to break a bit of the casing near the hook switch. But its sacrifice was not in vain – for science, it provided a good chance to examine the internals and admire the quality of construction. It’s definitely quite different from the inexpensive consumer-grade telephones that have very little weight, creaky cases and no real internal sound isolation. It explains, in part, the weight of the device. The teardown reveals a lot of similarities with a teardown done of a later model by iSuppli.

It also provided the opportunity to modify the phone for operation from a 5V power source, for example, USB. A crude but functional modification is demonstrated, while power supply sources were tested. It is found that passive PoE injectors following the Mode B wiring seem safe to use and supply of about 38V and above is tolerated. Use of 5V supply directly to the board is more efficient (PoE seemingly ranges between 74 to 84%).

Unfortunately, the good news ends here, as the unit as a whole is not particularly efficient, drawing about 3.8W from 5V with the screen off and 4.5W with the screen idle at 50% brightness. On PoE, this rises to approximately 5.0W and 5.8W respectively based on DC side only – the PSE’s own efficiency will mean the AC power from the wall will be higher. This amount of power is sufficient for modern smartphones to perform normal functions, making this desk phone a particularly power inefficient proposition overall. I never would have thought such phones could have such an impact – imagine 100 phones on a floor would be burning up 500W, plus throwing some additional heat in the Ethernet cabling and the communications cabinet from the PSE too.