PA1688 page changed to

More information:
Palmmicro products mailing list —
VoIP and Palmmicro products BLOG —
AR1688 customer website:

This is low cost VoIP solution, complete with reference design and software that allows you to make cheap ip phones and ATAs.

The CPU is similar to an MCS8051 and operates at max 50 MHz. That is a 8bit CPU ...
to speed it up, it has an on-chip DSP which is ADSP2181 instruction set compatible, operating at 50MHz. The chip has interfaces to RS232, USB, SDRAM, SRAM, AC97 codec and a keypad. An RTL8019 10MBit ethernet chip can easily be connected.

Part of the documentation is gibberish:

Considering about standard MCS8051, there are a 256bits SRAM in core.
The most scope of core can seek is 65536bits of SRAM and 65536 of Program
Flash. There has a 4.5KB SRAM in PA1688, it is an outside SRAM of MCU core

Now everything is indeed clear. :-)

Newsflash - January 30, 2007
SecurityFocus is reporting today a security vulnerability in the PA168 chipset that allows a remote attacker to issue administrative commands. The attack seems to be somewhat mitigated by the fact that an attacker can only execute the attack when someone has logged into the phone with the superuser password, but when an attacker is able to do this (and they can automate checking to see if the superuser is logged in) they have control of the phone. No fix is reportedly available but the workarounds are to use router Access Control Lists to restrict access to the phone's web server and also to not put one of these phones directly on the public Internet.

I've just had confirmation from the manufacturers of the PA168 chipset that they are open sourcing their VoIP firmware! It's being released under the BSD licence, and it will be hosted on Source Forge. I've setup a page on the AMP Documentation Wiki until the SourceForge project is set up, and I'll try to keep it as updated as I can.

Actually, this chipset has a number of nice features. It comes with g711, g723.1, g729, iLBC, and gsm codecs. IAX2, H.323, MGCP, Net2Phone, and SIP are well-supported. The voice prompts are available in a number of languages (English and Mandarin are standard, French or German or other custom language is available by request).

Although the code is closed-source, it's pretty easy (compared to most closed-source products) to obtain redacted source for the firmware. Even if you don't have access to the source, the developers are willing to consider widely useful enhancements - for instance I asked about uPnP support, provided the developers with a link to libupnp and they said they'd look into it. Ok, so maybe it will be a while before it arrives, but any other group would have given me the answer "order 200K items and we'll do it" - not very useful for a small-time user.

It supports up to 5 separate SIP registrars, but not simultaneously (you can preset the phone to work with 5 providers, say, FWD and Stanaphone, but only one will register at a time. It's fairly easy, however, to switch among profiles/proxies). STUN servers are supported, but not uPnP (yet).

Firmware upgrade failure recovery

One nice feature of this chip is its' disaster recovery mode — if something goes wrong during the firmware upgrade process, you can rather painlessly reflash.

To do this, you'll need to get the latest version of PalmTool. Be aware that PalmTool does not appear to work with Windows XP (possible firewall issues). {palmtool 1.57 works ok with xp pro service pack 2}

First, turn on the phone while holding down the * key. The normal boot process should be interrupted, and "*" should be displayed. Release the * key, turn off the phone, and repeat the process. The phone will now be reset to the factory default IP address (usually

Next, turn on the phone again, still holding down the * key. Once * is displayed, release the key and plug the phone into your network. The phone is now in recovery mode, waiting to talk to PalmTool.

On your PC, launch PalmTool. Select "List Phones". Select the phone that you want to reflash from the list. Important safety tip — your PC must be on the same network segment as the phone.

After the target phone is selected, click "Update Program". Select the correct firmware image. The transfer will begin — the phone will display "Updating..." (without a byte count) during the transfer, and "Updating..." (with a percentage) during the actual flash operation.

After a successful flash, the phone will automatically reboot.

Phones with this chip:

  • YUXIN YWH10 IP phone from YUXIN
  • YWH100 IP phone from YUXIN
  • YWH200 IP phone from YUXIN
  • YWH300 IP phone from YUXIN
  • YWH500 IP phone from YUXIN

ATA with this chip:

  • YGW20 ATA vendor is YUXIN.

See also:

PA1688 Version 1.47 Released

PA1688 VOIP API 1.47 release new binary files and documents is ready for download from now. If you can not find the needed firmware for special language, protocol or hardware type, please send email to to ask for it.

Changes and Fixes:
1. Enhanced voice quality and echo cancellation for ATAs and ip phones, especially for PA168V, set handset input volume number between 10-15 to get best performance
2. Enhanced auto-provision feature, support HTTP, FTP and TFTP in the same time, no need to compile differently now. Use URL to indicate which protocol to use.
3. Added STUN NAT type judgement for better working behind NAT
4. Added service provider long name support in SIP service type options.
5. Fixed non-Chinese IVR number play problem.
6. Fixed audio disconnect in a call problem since 1.46
7. Added page12 to restore the function of automatically find public ip address when use port mapping on NAT. Please notice that as program grows, only 1M (like MX28LV008T used in PA168S, PA168Q) and 2M (MT28F016S5 used in PA168T, PA168V) bytes program flashes will have this function.
8. Spanish IVR now available! Juan Carlos Valero ( recorded IVR for Spanish, modified Spanish lcd display.
9. Poland version added, Piotr Niemojewski ( ) provided Polish IVR, display and web support
Piotr Niemojewski ( ) currently has a hardware type "5111phone" ip phone, he asked me whether we can provide an ATA for him to do test and development for Poland market. I told him that we do not have it but I will ask among our customers and our mailing list in Yahoo to find some possible device donation :)

Compiled Palmtool.exe package also attached for those who do not have M$VC 6
If you do not like to receive this 3M bytes files any more, please feel free to send email to, I will remove you from this private mailing list upon request.

You can get a test version of binary files by writing to, please include the following:
1. Hardware type, like PA168S, PA168T for ip phone, PA168Q, PA168V for 1-port FXS gateway.
2. Software version, we can provide every final release version since 1.00, and the most recent test version.
3. Protocol needed, like H323/SIP/MGCP/IAX2 and other private protocols like Net2phone
4. Language needed, like Chinese, English
5. If it is for an OEM build, please specify OEM type

Software download:

  • 1.47 API

PA1688 Version 1.48 Released

1.48.011 attached.

Changes and Fixes:
1. Delayed IVR play time to fix IVR shortened playing problem
2. Improved DTMF detection and continue improvment on voice quality.
3. Added more country and district support for dial-up modem and dial-tone.
4. Fixed problem with Call Hold and Flash functions.

updated development guide also attached.

Compiled Palmtool.exe package also attached for those who do not have M$VC 6
Created by: schurig, Last modification: Fri 29 of Mar, 2013 (20:14 UTC) by woody1234
Please update this page with new information, just login and click on the "Edit" or "Discussion" tab. Get a free login here: Register Thanks! - Find us on Google+