
          *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
         (L)                                               (L)
         (O)    An Overview of the Teradyne 4Tel System    (O)
         (D)                                               (D)
         (+)                       by                      (+)
         (+)                                               (+)
         (+)                  Doom Prophet                 (+)
         (L)                                               (L)
         (O)             Legion of Doom/Hackers!           (O)
         (H)                                               (H)
          *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
            


    4TEL is a loop testing system mainly used by General Telephone (GTE) that
consists of a Voice Response System and a Craft Dispatch Section as well as
the facilities and equipment used for testing functions. The following text
will attempt to dispell many of the 4TEL myths that have been created in the
past years, such as the idea that it can be used to eavesdrop on lines within
its serving area. The information provided has been gained from company
publications and from personal experience. A 4TEL is not the same thing as a
REMOBS, which stands for REmote service OBservation System.



    The portion of the system that some of the phreak/hack population is
familiar with is the Voice Response System, which has normal POTS dialups.
This system greets the user with an announcement message and then asks for a
password, which is entered in DTMF tones. The legitimate use of these dialups
are for outside craft personnel (linemen) to call in, perform tests and
receive the results for subscribers' lines. The VRS is provided so craft
personnel can access the 4TEL system at times when no one is at the testboard
(at nights or weekends). Through the VRS, up to 8 craft/technicians can access
4TEL at the same time, enabling them to get more done in a smaller amount of
time.



    After a password has been accepted by the system, the electronic voice
will ask for the line number that the user wishes to be tested. The number
entered will be read back to ensure correct entry. The system will then ask
for the user to enter the mode. The modes are:


    1: Calling on other line
    2: Calling on test line
    3: Line test results


    It is possible on some VRS's to get a listing of the modes by dialing 0
when the voice prompts. Line tests are possible from both modes 1 and 2 by
dialing the octothorpe (#) key. The results of the test will be announced
along with the length of the cable in miles. Bridged ringers, if any, will
also be noted. Mode 3, the line test results section, will tell the user there
are no test results available unless they have beeen previously entered. The 7
key is the monitor command from both test modes. If there is speech on the
line, it will be detected electronically but will NOT be heard by the user.
The monitor command is not 'REMOBS' (Remote Observation) but a method of
determining if the line is busy due to normal means (conversation) or due to
some trouble condition at the switch. When the system asks for the ID code for
a monitor command, the system will accept the line number as well as the
initial password, and even a secondary password before dialing, but it has not
been determined by the author if this is a standard for every 4TEL. Not just
anything will work for the monitor password however as it will announce if the
ID code entered is invalid or not.


    If mode 1 is entered, these commands are available:


MODE ONE COMMANDS:


    1-Fault location
    2-Other Testing
    7-Test OK, monitor
    8-Hang up
    9-Enter next line number


    If option 7 is chosen, another menu will be available if the line tests
busy.


    2-Monitor test
    3-Overide and test
    4-Wait for idle


    If suboption one (Fault location), mode one, is chosen, these commands are
available:


    1-Open location
    3-Short location
    4-Cross location
    5-Ground location
    8-Hang up


    If suboption two (Other testing), mode one, is chosen, these commands are
available:


    2-Loop ground Ohms
    3-Dial tone test
    4-Pair ID
    8-Hang up



MODE TWO COMMANDS:


    2-Other testing
    7-Test OK, monitor
    8-Hang up
    9-Enter next line number


    If suboption 2 (Other testing), mode two, is selected, these commands are
available:


    2-Loop ground Ohms
    8-Hang up



    The 4TEL system's main use is for standard testing, which is done nightly
upon every line in an exchange. This locates faults and problems before they
have to be reported by customers. All lines that have trouble detected upon
them are printed out in a report at the repair center the next morning where
the proper fault location and dispatching can be done. The measurement and
test unit of the 4TEL system is called a COLT, Central Office Line Tester,
which performs all nightly and on demand testsupon the exchange through local
test trunks.


    There are a few different types of COLTs. The standard version will serve
any CO for up to 10,000 subscribers. The COLT RS is used in rural step by step
offices (referred to as 'steppers' also) for up to 1,300 lines. The Digital
COLT is used for digital Central Offices. These can have remote Colt
Measurement Units (CMU's) for remote switches which are controlled by the Colt
Computer Unit (CCU) at the host switch. The CMU speed calls the CCU at night
to start the testing and direct the operations. The CMUs in regular end
offices have digital links (over the normal telephone network) with the SAC,
which is how the line test results are distributed to the repair center.



    The 4TEL system can also test lines upon command by a human operator at
the SAC (Service Area Computer). The CRT operator enters the line number in
the proper field and 4TEL runs a full series of tests as well as displaying
past line history, fault summary, volts and current information, and the cable
length. The results of the testing are displayed in plain english, as opposed
to decimal or other format, on the screen. A dispatch decision is also
displayed after every line test to determine if a dispatch is needed.


    SAC's
    -----


    The SAC is the centralized focal point for 4TEL control and reporting.
This computer is located in the repair center and distributes test/work
information between CRT's and COLT's. The SAC formats the results of routine
testing into a daily advisory report as mentioned earlier.



    There are several types of 4TEL reports that are worth noting. The
DISPATCH report lists troubles that can  have an immediate dispatch for them.
These also tell the location of the fault (cable, CO, station, etc.) and are
classified into two types, moderate and severe, relating to how service
affecting the problem may be. The CABLE report lists all new cable faults. A
Plant Status report summarizes the condition of the outside plant and totals
them per individual exchange. In these reports, trouble conditions can be
listed in a variety of ways. CROSSES and WETS refer to line insulation faults
and may indicate water penetration of the cable. SHORTS and GROUNDS are
insulation faults at the station set. OPENS refer to a broken, or 'open' Ring
or Tip lead in a Cable Pair. BACKGROUND refers to electrical noise caused by
power lines being nearby. ABNORMAL VOLTAGE indicates high voltage conditions.
There are others, but the reader will hopefully get the idea from the ones
listed above.


    CDS
    ---


    Another major part of the 4TEL system is the Craft Dispatch System, which
is a DTMF and speech response setup used to exchange report and schedule
information between the repair center staff and outside craftspersons. Linemen
call in to get dispatch information that has been previously entered by the
dispatcher. CDS plays back the info one field at a time. When the craft
personnel is ready to receive the next field of information, he simply says
'Go' and the system continues. A printer at the repair center informs the
dispatcher when a craftsperson has received a report. When the trouble is
taken care of, a completion report is done on the CDS in which it asks for the
closeout and schedule one field at a time to be entered in DTMF and in speech.
The clerk at the repair center then closes the trouble on the SAC/4TEL system
after the line is tested a final time to ensure proper operation.


    CDS may also have audit trails of every transaction for a certain time
period. So to summarize the work flow for involving the CDS: Irate customer
calls the clerk at the repair center. The information is forwarded to the
dispatcher who enters it into CDS. Craft personnel call in and receive the
messages, do the required work, then file a completion report. The clerk then
closes out the trouble in SAC/4TEL.


    The Digital Concentrator Measurement Unit is another component of the 4TEL
testing equipment that is used to test lines in digital concentrators such as
the GTE MXU and the NTI-OPM. They are located inside Digital Loop Carrier
system remote terminals or huts and consist of a circuit board and measuring
system. It provides AC and DC measurements of subscriber loops, as well as all
the normal test/measurement functions such as fault description and location ,
dispatch messages, and special tests. The DCMU can test the lines of an
individual DLC remote terminal, or a group of terminals that are located
together. The capacity of terminals that the DCMU can test is determined by
analysis of test traffic and economic factors as well. Both the CRT at the SAC
and the VRS are compatible with the DCMU. These units are self calibrating,
unlike the PMU's of an LMOS supported Loop Testing System. The 4TEL CCU is
linked to the DCMU via either a 1200 baud dial up or a dedicated link,
depending upon the size of the office.



    Some of the tests that 4TEL performs are loop and ground resistance (which
detects resistance faults and sheath ground problems), dial tone test (in
which the number of times dial tone can be drawn during a certain period is
recorded) , busy line monitoring (not BLV or REMOBS), coin station tests
(totalizer, coin relay, etc), as well as all the standard tests which were
covered above. A pair identification can also be done, in which a tone is
placed on the pair to help those at terminal cabinets locate that specific
one, similar to the LMOS/MLT tone applique function.



    Miscellaneous notes
    -------------------


    If a user enters the number of the 4TEL system they have dialed in upon,
the system will announce an intercept. A user cannot monitor/test Directory
Assistance through 4TEL. Lines that are out of the system's NPA can be tested
also, but a 1 has to be dialed before the number just like an ordinary toll
call. The 4TEL VRS will give the user a 'beep' tone after a few seconds of
waiting for input. If the user doesn't enter anything, the VRS will
disconnect.  A version of 4TEL is also used by Rochester Telephone in New
York, and there may be other independent companies that  use the system. Try
to find out what system you're served by. If you're in a Bell area, it will
most likely not be 4TEL, but LMOS.



 I  hope that this article has helped readers to better understand the way the
4TEL system operates. Again, there may be some differences depending upon the
area and the company. Thanks go to Taran King, Phantom Phreaker, and Lucifer
666 for supplying information in one way or another that contributed to this
file.


        Doom Prophet/LOD
