====== Coin Validator ======
Produced by Landis&Gyr Communications for Nortel. Landis&Gyr Communications was sold to IPM Group - who have gone bankrupt and renamed themselves to New IPMtel.
Pictures:
* http://imgur.com/WtfJ1ns
* http://imgur.com/TR0Rmcl
* http://imgur.com/56GCbZd
Serial communication protocol (600/8n1):
COIN VALIDATOR SLEEP MODE's'
COIN VALIDATOR WAKE UP'g'
CALC COIN VALIDATOR CHECKSUM'k'
ACCEPT NEXT COIN'x'
ACCEPT ALL VALID COINS'a'
REJECT ALL COINS'z'
COLLECT ESCROW'c'
REFUND ESCROW'f'
ESCROW NULL'n'
LEARN ESCROW'l' <- Very important, they wont work together otherwise.
REQUEST COIN STATUS'r'
DISABLE SPECIFIED COIN'd'
ENABLE SPECIFIED COIN'e'
READ COIN VAL ADDR'q'
ROM can be dumped with q 0x0000 to 0xFFFF.
IC-markings:
[M] SC408664CB
QQ1SSC-01
2C14H
LLHA9408
QMV 492 AD1
P190 C 9430
the MCU is a custom-marked MC68HC05B6
====== EEPROM ======
The EEPROM is located at 0x0100-0x1FF.
Below is a side-to-side comparison of the EEPROM of a Bell Canada and a Nevada Bell coin validator. Note, that the Bell Canada validator "knows" more coins than the Nevada Bell one.
{{:millennium:bc_nv_coinvalidator_eeproms.png?nolink|}}
===== Decoding =====
* MS: Most significant Byte
* LS: Least significant Byte
^ Offset (h) ^ 00 ^ 01 ^ 02 ^ 03 ^ 04 ^ 05 ^ 06 ^ 07 ^ 08 ^ 09 ^ 0A ^ 0B ^ 0C ^ 0D ^ 0E ^ 0F ^
^ 00 | Options register | Checksum MS | Checksum LS | Western Electric refit flag | Nominal avg sensor C time MS | Nominal avg sensor C time LS | Nominal avg sensor F time MS | Nominal avg sensor F time LS | Nominal avg sensor G time MS | Nominal avg sensor F time LS | Instantaneous half-window for detector C | Instantaneous half-window for detector F | Instantaneous half-window for detector G | Scale factor for sensor timeout calculation MS | Scale factor for sensor timeout calculation LS | Half-window for detector C avg MS |
^ 10 | Half-window for detector C avg LS | Half-window for detector F avg MS | Half-window for detector F avg LS | Half-window for detector G avg MS | Half-window for detector G avg LS | Firing duration for solenoid MS | Firing duration for solenoid LS | Minimum coin separation time | Pause time during cash or refund cycle | number of bytes in coin table | number of coins in coin table | On-time for validator entry and exit sensors (A, B) | Blocked-time for escrow sensors (C, F, G) | Timeout on escrow motion (rotation jam) | Unused | Unused |
^ 20 | Coin 1 |||||||||| Coin 2 ||||||
^ 30 | <- 2 cont |||| Coin 3 |||||||||| Coin 4 ||
^ 40 | <- 4 cont |||||||| Coin 5 ||||||||
^ 50 | <- 5 cont || Coin 6 |||||||||| Coin 7 ||||
^ 60 | <- 7 cont |||||| Coin 8 ||||||||||
^ 70 | Coin 9 |||||||||| Coin 10 ||||||
^ 80 | <- 10 cont |||| Coin 11 |||||||||| Coin 12 ||
^ 90 | <- 12 cont |||||||| Coin 13 ||||||||
^ A0 | <- 13 cont || Coin 14 |||||||||| Coin 15 ||||
^ B0 | <- 15 cont |||||| Coin 16 ||||||||||
^ C0 | Coin 17 (Calibration Coin A) |||||||||| Coin 18 (Calibration Coin B) ||||||
^ D0 | <- 18 cont |||| Unknown (Calibration?) |||||||||| 0x00 | 0x00 |
^ E0 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 |
^ F0 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | ROM Version || EEPROM Config ID ||
==== Options Register ====
* EEPROM OPTR
* 03: Part 2 of the EEPROM array is not protected; all 256 bytes of EEPROM can be accessed for any read, erase or programming operations. / Security Bit is not set
* [[http://cache.nxp.com/files/microcontrollers/doc/data_sheet/MC68HC05B6.pdf#page=48|Page 48, Section 3.5.5, Options register (OPTR)]]
==== Checksum ====
* Some CRC - don't bother and just issue the k-command to have it calculated and written to the EEPROM automagically.
==== Western Electric refit flag ====
* Unused
==== Nominal avg sensor C/F/G time ====
* 0.25 µs increments
==== Instantaneous half-window for detector C/F/G ====
* 2 µs increments
==== Half-window for detector C/F/G avg ====
* 0.25 µs increments
==== Firing duration for solenoid ====
* 2 µs increments
==== Minimum coin separation time ====
* 8 µs increments
==== Pause time during cash or refund cycle ====
* 8 µs increments
==== number of bytes/coins in coin table ====
* not actively used
==== On-time for validator entry and exit sensors (A, B) ====
* 2 µs increments
==== Blocked-time for escrow sensors (C,F,G) ====
* 8 ms increments
==== Timeout on escrow motion (rotation jam) ====
* 64 ms increments
==== Coin definitions ====
28.05.2016: This is the first time, that coin-definitions have been publicly documented, after [[User:Krater]] and [[User:martin]] started reverse-engineering the Coin validator firmware.
Each defined coin is represented by 5 measurement-values of 2 Bytes each, so 10 Bytes in total.
Each measurement of 2 Bytes/16 Bits contains the following information:
* Enable/Disable coin (E): 1 Bit
* Median value (V): 9 Bits
* Validity range (R): 6 Bits
In other words, the acceptance range for each of the five parameters, given a measured value of M is: V-R <= M <= V+R (If the measured value is 100 and the range is set to 30, coins with a measurement of M in between 70 and 130 will pass).
^ First Byte ^^^^^^^^ Second Byte ^^^^^^^^
| E | V | V | V | V | V | V | V | V | V | R | R | R | R | R | R |
The Enable-Bit is only set on the first tuple of each coin - the other four tuples have it set to zero.
Unused coin-slots are written as 0x80 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
=== Median tuple transformation ===
Alway rounded to ,0.
* 1st tupel: (X1 - 0x1000) / 0x10
* 2nd tuple: X2 / 0x04
* 3rd tuple: (X3 - 0x1000) / 0x10
* 4th tuple: X4 /0x02
* 5th tuple: X5 / 0x80
=== Tuple construction ===
- Obtain a sufficient amount of test-data for each coin using the TST-command.
- Calculate median value
- Transform tuples according to section above
- Calculate necessary range (max. +- 63) to cover all measurements
- Convert median and range into single Bits and fill in table
- Convert Bit-Table into 2 Hex-numbers and write to EEPROM.
==== ROM Version / EEPROM Config ID ====
* PROCEDURE: get_coin_validator_version_num
*
* DESCRIPTION: This procedure gets a 4 byte version number from the coin validator.
* It has the following format and EEPROM addresses:
* Field EEPROM address
* ----- --------------
* 1. ROM Version Number 1FC - 1FD
* 2. EEPROM Config ID 1FE - 1FF
* As the EEPROM starts at 0x0100, the same value has to be substracted from above mentioned addresses.
====== Communication ======
The validator communicates with a serial protocol at 600 Baud, 8n1
===== Pinout =====
| **1** \\ GND | **3** \\ DIn | **5** \\ GND | **7** \\ GND | **9** \\ +12VDC |
| **2** \\ DOut | **4** \\ GND | **6** \\ GND | **8** \\ GND | **10** \\ Reset |
* DIn is data fed into the validator
* DOut is data coming from the validator
* Reset must be tied to 5VDC. To perform reset, short to GND
===== Commands to validator =====
^ ASCII ^ Hex ^ FW-level name ^ Explanation ^
| s | 0x73 | COIN_VALIDATOR_SLEEP_MODE | Send device to sleep; must use COIN_VALIDATOR_WAKE_UP to put back into service |
| g | 0x67 | COIN_VALIDATOR_WAKE_UP | Wake up device. Also needed after reset |
| k | 0x6B | CALC_COIN_VALIDATOR_CHECKSUM | |
| x | 0x78 | ACCEPT_NEXT_COIN | |
| a | 0x61 | ACCEPT_ALL_VALID_COINS | |
| z | 0x7a | REJECT_ALL_COINS | |
| c | 0x63 | COLLECT_ESCROW | |
| f | 0x66 | REFUND_ESCROW | |
| n | 0x6e | ESCROW_NULL | |
| l | 0x6c | LEARN_ESCROW | |
| r | 0x72 | REQUEST_COIN_STATUS | |
| d | 0x64 | DISABLE_SPECIFIED_COIN | is index of coin to be disabled; eg. d1 |
| e | 0x65 | ENABLE_SPECIFIED_COIN | is index of coin to be enabled for acceptance; eg. e3 |
| q | 0x71 | READ_COIN_VAL_ADDR | is the address of the byte to be dumped from the device. EEPROM is from 0x0100 to 0x01FF. To dump first digit of ROM Version: 0x71 0x01 0xFC |
| TST | 0x54 0x53 0x54 | n/a | {{https://www.dokuwiki.org/_media/wiki:usersmileys:new.gif}} Enable Test-Mode: Measurement data for each following deposited coin is returned. |
| EAPw | 0x45 0x41 0x50 0x77 | n/a | {{https://www.dokuwiki.org/_media/wiki:usersmileys:new.gif}} {{https://www.dokuwiki.org/_media/wiki:usersmileys:button-danger-red.png}} Write to EEPROM-address (0x00 < = n < = 0xFF). Wait 20ms between issuing EAPw, and |
17.03.2016: This is the first time, that the commands TST and EAPw have been publicly documented, after [[User:martin]] started reverse-engineering the Coin validator firmware.
===== Replies from validator =====
^ ASCII ^ Hex ^ FW-level name ^ Explanation ^
| 0 | 0x30 | INVALID_COIN | Coin could not be validated (or was not enabled) |
| 1 | 0x31 | COIN_1 | |
| 2 | 0x32 | COIN_2 | |
| 3 | 0x33 | COIN_3 | |
| 4 | 0x34 | COIN_4 | |
| 5 | 0x35 | COIN_5 | |
| 6 | 0x36 | COIN_6 | |
| 7 | 0x37 | COIN_7 | |
| 8 | 0x38 | COIN_8 | |
| 9 | 0x39 | COIN_9 | |
| a | 0x61 | COIN_10 | |
| b | 0x62 | COIN_11 | |
| c | 0x63 | COIN_12 | |
| g | 0x64 | COIN_13 | |
| e | 0x65 | COIN_14 | |
| f | 0x66 | COIN_15 | |
| g | 0x67 | COIN_16 | |
| h | 0x68 | CALIBRATION_COIN_A | Calibration Coin 1 - not used anymore in the field |
| i | 0x69 | CALIBRATION_COIN_B | Calibration Coin 2 - not used anymore in the field |
| A | 0x41 | COIN_VALIDATOR_ALLS_WELL | |
| B | 0x42 | COIN_VALIDATOR_STATUS | |
| C | 0x43 | COIN_VALIDATOR_HW_FAULT | |
| D | 0x44 | COIN_ESCROW_FAULT | |
| E | 0x45 | COIN_EEPROM_CHECKSUM_FAILURE | Can mostly be fixed by requesting new Checksum-calc with "k" |
| F | 0x46 | COIN_PWR_UP_RAM_FAULT | |
| G | 0x47 | COIN_ERROR_UNKNOWN_CMD | |
| H | 0x48 | COIN_EEPROM_WR_FAILURE | |
| I | 0x49 | COIN_VALIDATOR_JAM | |
| J | 0x4A | COIN_ENTRY_FRAUD_ATTEMPT | |
| N | 0x4E | COIN_TST_DATA | {{https://www.dokuwiki.org/_media/wiki:usersmileys:new.gif}} Returns coin-measurement-data in the following format: "N \r\n". Data in <> is hexadecimal. |
17.03.2016: This is the first time, that N-command has been publicly documented, after [[User:martin]] started reverse-engineering the Coin validator firmware.
===== The proper way to program coin validators =====
The original software used to program these coin validators ist called VAL-ESC, a itty-bitty-shitty DOS-application that also just issues the previous commands to calibrate a device, download the current coinset, or upload a new one.
There is a repository of some coin sets, that we should probably put online at some point in the future.