Teardown, Test: WebExcel 56k Voice/Fax/Data External Modem

A few weeks back, I was fortunate enough to receive a donation of various technology items from a reader of the blog. The donor had quite a lot of equipment, so I picked a few items I thought I could feature on the blog and make some use of.

Within the lot of items, which I’m taking my time sifting through, was a few modems. Regular readers would be familiar with my “definitive” collection of V.90/92 and V.34 modem sounds amongst other related pages, so I thought it would be good to start off with one. After all, I still have some of my telephony equipment set-up (e.g. ATA, Raspbx).

The first modem is a rather “modern” one – a WebExcel 56k Voice/Fax/Data Modem. You might be wondering why I’d even bother … it’s just going to be Rockwell/Conexant chipset just like all the other cheapies! That’s what I thought. But just in case I was wrong … lets take a look inside.

The Modem

The unit itself looks almost generic in its appearance, with a relatively “cheap” silver-coloured finish on plastic. The unit has no grilles for ventilation, despite the “ribbed” underside. It carries a serial number label, an Austel approval (N622) and claims to be Made in China. It has just two rubber feet – a sign of the cost-reductions made.

On one side of the modem, there is 3.5mm jacks to accommodate a headset (speaker/mic) for use with the voice modem features.

The rear has a toggle switch for power, a 9V AC input (2.1mm tip), 9-pin serial port and RJ12 ports for phone and line. Nothing unusual here, although the smaller DB-9 port suggests that this is a later modem – older modems typically had DB-25 ports although there was no great need for the extra pins.

From the front, there is a deeply “smoked” plastic window similar to that on remote controls, behind which there are LEDs for receive data, send data, carrier detect, auto-answer, off-hook, data terminal ready and modem ready. The plastic itself has crazed over the years, exhibiting some fine almost radial cracking. The unit is branded WebExcel 56000 Voice/Fax/Data/Modem.

Surprisingly, I wasn’t able to find a model number at all from the labels on the unit. Maybe there was another label that fell off at one stage, or maybe it was just that generic that they didn’t bother labelling the modem itself.

As it was missing a power supply, I managed to dig up a 9V AC 1A power supply that I got from a liquidator a long time ago. Unfortunately, the tip didn’t fit, so I chopped it off and fitted my own 2.1mm tip barrel plug which fit the modem perfectly. There was no serial lead either, but that’s no issue because the 9-pin straight-through serial cables are pretty common. I guess we’re all set to rock and roll … but first, lets take a look inside.


Removing the two feet exposes two screws that hold the casing together. With the casing apart, we can peer inside.

If you guessed it was a Rockwell/Conexant modem, you’d be wrong (yep, that includes me too). This is an Ambient chipset modem based on the MD5660DT/MD4450C chipset with a Cirrus Logic MD1724T line interface. The line interface is rather traditional, using a transformer hybrid and a reed relay to connect the line. One of the bridge rectifiers seems to have gone a bit “hairy-looking” for some reason.

Rather unusually, the firmware is held on two Holtek HT27C010-70 1Mbit OTP EPROM chips. This means that there is not going to be any firmware updates for this unit by uploading through the serial interface – any updates will require a change of the two socketed chips. The chips themselves would be regular EPROMs that would normally be packaged in ceramic with an erase window – instead being packaged in opaque plastic, thus being “one time programmable”. It seems to be a low-cost way to deploy the firmware short of creating mask-programmed ROMs. As for using two of the chips – maybe they needed to meet a particular databus width, or maybe it was cheaper than using one larger device. But definitely not an arrangement I’ve come across before – most of the 56k modems I have are either soft-modems or contain Flash memory for the firmware.

The underside doesn’t have any components but shows all the through-hole connections and isolation from the phone line. The PCB appears to be two-layer, with a date of Week 12 of 2000. The date of the chips place the unit around Week 10 of 1998 (RAM), Week 9 of 1999 (OTP EPROM), Week 45 of 1999 (MD5660), Week 8 of 2000 (MD4450C) and Week 6 of 2000 (MD1724).


Testing of the modem shows that it is still functional. Issuing the regular AT commands and making a test call …

CD08.55 - 612 (10/19/99) SERIAL - SPEAKERPHONE 05 - DSP PATCH: 001.55
Present, 32K DSP RAM.000
Host I/F: Serial
P. Mem. : 016 Bit 003 W.S. 
D. Mem  : 008 Bit 001 W.S. 
DSP code location = INT ROM
CIR3100\00314159\MODEM\PNPC107,ATM0096\CIRRUS 56K External MODEMDA
Not V90/X2 Connected
V.90 Server Not Available
Retrains : 0
Renegs   : 0
Cirrus Logic, Inc.

CONNECT 115200/V90/LAPM/V42B/TX=28800/RX=49333

User Access Verification

 Username: username: login: 


… shows that the unit still seems to perform just fine, connecting to the test server at a blistering 49333/28800bps over a VoIP link over 4G no less. The firmware appears to have a lot of roots from Cirrus – this is where I actually learnt that Ambient was spun out of Cirrus, and later acquired by Intel. The firmware itself appears to (possibly) be a non-customised firmware from the Ambient Firmware Engineering Department – absolutely “lowest cost” here.

The modem does misbehave slightly – I tried to issue an +++ escape sequence while on call to get an ati20 statistic on the call, but it interpreted that as an ato command and went back into data mode. As a result, I was never able to obtain any in-call statistics.

One fascinating result of examining the modem was that this modem claims to be capable of X2 as well. I thought that X2 was practically restricted to US Robotics equipment and I never really recall it being available on anything else. This one claims to be capable of X2, so I rang up the last known working X2 modem bank but could not convince it to connect in X2 mode as it preferred V.90.

Unfortunately, the modem is a bit strange when it comes to AT+MS queries and sets, it was not possible in any combination to set AT+MS=X2 (and even appending several parameters, such as AT+MS=X2,1,0,0,0,0 for automode with no min/max up/downlink rates). Even querying supporting AT+MS parameters with AT+MS=? resulted in ERROR. So whether the modem is truly X2 capable or not is not something I could determine.

Because of the modem’s Ambient firmware, the DIL sound is exactly as that of my Swann Speed Demon and Intel HaM modems, thus I did not bother doing a recording of this one.

The Firmware

This bought me to the interesting exercise of dumping the firmware and seeing what is inside. The firmware files show that the firmware is interleaved across both EPROMs, with the first dumped ROM (with the green stripe) representing even bytes, and the second dumped ROM representing odd bytes. Once properly interleaved, we can start to read some strings.

We can see references within the firmware to various fax and voice commands that are supported.

The Ambient firmware strings are visible, as expected.

But so is some old Cirrus stuff from the V.34 days. I suppose the codebase must have been reused in some way.

The firmware also appears to have some additional routines with an overlay manager and flash management code for in-system firmware update. Too bad this one used a one-time programmable ROM.

This did get me thinking about whether there was any support for the WebExcel modems – from what I can ascertain, in Australia, it seems this was supplied by Protac which was an importer of computer equipment. The model number for many WebExcel modems started with PT-xxxx, but in that case, PT did not stand for Protac as some seem to believe, but Puretek which was the real OEM. I wonder if this was a Puretek product as well.


While I expected this modem to be the “run-of-the-mill” generic cheapie, in fact, it offered up something I was not expecting. The modem appears to be very much a “cost-reduced” model, foregoing flash memory for the firmware and even a second pair of rubber feet. But it still appears to work just fine.

The modem reminded me that Ambient Technology was spun out of Cirrus Technology, then acquired by Intel. It also seemed to imply that US Robotics was not the only X2 modem vendor out there. That was quite interesting to learn in itself, even though I was not able to get it to connect in X2 mode.


It’s a rather busy week for me being grant application season with a few other things I should be doing (but haven’t gotten around to), so I don’t think I’ll have time to put any more posts up for a while. That being said, I have been able to make a few updates to the CPU corner thanks to the donations, especially surrounding the CPGA Intel 80386/i486 chips. There’s always more to put up – I just need to get around to doing it! Speaking of which … my holiday in 2017? Those photos will be posted … eventually!

Tomorrow is the annual Central Coast Amateur Radio Club (CCARC) Wyong Field Day. I haven’t been in many years, but the power supply I modified in this posting and the old Motorola Advisor pagers were bought from the last time I went there (I believe, in 2009), so it’s about time I go back! It’ll be an early start, taking about 3 to 3.5 hours each way by public transport from my place, so I’ll have to be up by 4am or thereabouts. Here’s hoping to being able to see some interesting stuff!

About lui_gough

I'm a bit of a nut for electronics, computing, photography, radio, satellite and other technical hobbies. Click for more about me!
This entry was posted in Computing, Telecommunications and tagged , , , , , , , . Bookmark the permalink.

Error: Comment is Missing!