Produced by Landis&Gyr Communications for Nortel. Landis&Gyr Communications was sold to IPM Group - who have gone bankrupt and renamed themselves to New IPMtel.
Pictures:
Serial communication protocol (600/8n1):
COIN VALIDATOR SLEEP MODE's' COIN VALIDATOR WAKE UP'g' CALC COIN VALIDATOR CHECKSUM'k' ACCEPT NEXT COIN'x' ACCEPT ALL VALID COINS'a' REJECT ALL COINS'z' COLLECT ESCROW'c' REFUND ESCROW'f' ESCROW NULL'n' LEARN ESCROW'l' <- Very important, they wont work together otherwise. REQUEST COIN STATUS'r' DISABLE SPECIFIED COIN'd' ENABLE SPECIFIED COIN'e' READ COIN VAL ADDR'q'
ROM can be dumped with q 0x0000 to 0xFFFF.
IC-markings:
[M] SC408664CB QQ1SSC-01 2C14H LLHA9408 QMV 492 AD1 P190 C 9430
the MCU is a custom-marked MC68HC05B6
The EEPROM is located at 0x0100-0x1FF.
Below is a side-to-side comparison of the EEPROM of a Bell Canada and a Nevada Bell coin validator. Note, that the Bell Canada validator “knows” more coins than the Nevada Bell one.
Offset (h) | 00 | 01 | 02 | 03 | 04 | 05 | 06 | 07 | 08 | 09 | 0A | 0B | 0C | 0D | 0E | 0F |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
00 | Options register | Checksum MS | Checksum LS | Western Electric refit flag | Nominal avg sensor C time MS | Nominal avg sensor C time LS | Nominal avg sensor F time MS | Nominal avg sensor F time LS | Nominal avg sensor G time MS | Nominal avg sensor F time LS | Instantaneous half-window for detector C | Instantaneous half-window for detector F | Instantaneous half-window for detector G | Scale factor for sensor timeout calculation MS | Scale factor for sensor timeout calculation LS | Half-window for detector C avg MS |
10 | Half-window for detector C avg LS | Half-window for detector F avg MS | Half-window for detector F avg LS | Half-window for detector G avg MS | Half-window for detector G avg LS | Firing duration for solenoid MS | Firing duration for solenoid LS | Minimum coin separation time | Pause time during cash or refund cycle | number of bytes in coin table | number of coins in coin table | On-time for validator entry and exit sensors (A, | Blocked-time for escrow sensors (C, F, G) | Timeout on escrow motion (rotation jam) | Unused | Unused |
20 | Coin 1 | Coin 2 | ||||||||||||||
30 | ← 2 cont | Coin 3 | Coin 4 | |||||||||||||
40 | ← 4 cont | Coin 5 | ||||||||||||||
50 | ← 5 cont | Coin 6 | Coin 7 | |||||||||||||
60 | ← 7 cont | Coin 8 | ||||||||||||||
70 | Coin 9 | Coin 10 | ||||||||||||||
80 | ← 10 cont | Coin 11 | Coin 12 | |||||||||||||
90 | ← 12 cont | Coin 13 | ||||||||||||||
A0 | ← 13 cont | Coin 14 | Coin 15 | |||||||||||||
B0 | ← 15 cont | Coin 16 | ||||||||||||||
C0 | Coin 17 (Calibration Coin A) | Coin 18 (Calibration Coin | ||||||||||||||
D0 | ← 18 cont | Unknown (Calibration?) | 0x00 | 0x00 | ||||||||||||
E0 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 |
F0 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | ROM Version | EEPROM Config ID |
28.05.2016: This is the first time, that coin-definitions have been publicly documented, after Krater and Kontakt started reverse-engineering the Coin validator firmware.
Each defined coin is represented by 5 measurement-values of 2 Bytes each, so 10 Bytes in total.
Each measurement of 2 Bytes/16 Bits contains the following information:
In other words, the acceptance range for each of the five parameters, given a measured value of M is: V-R ⇐ M ⇐ V+R (If the measured value is 100 and the range is set to 30, coins with a measurement of M in between 70 and 130 will pass).
First Byte | Second Byte | ||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
E | V | V | V | V | V | V | V | V | V | R | R | R | R | R | R |
The Enable-Bit is only set on the first tuple of each coin - the other four tuples have it set to zero.
Unused coin-slots are written as 0x80 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Alway rounded to ,0.
* PROCEDURE: get_coin_validator_version_num * * DESCRIPTION: This procedure gets a 4 byte version number from the coin validator. * It has the following format and EEPROM addresses: * Field EEPROM address * ----- -------------- * 1. ROM Version Number 1FC - 1FD * 2. EEPROM Config ID 1FE - 1FF
The validator communicates with a serial protocol at 600 Baud, 8n1
1 GND | 3 DIn | 5 GND | 7 GND | 9 +12VDC |
2 DOut | 4 GND | 6 GND | 8 GND | 10 Reset |
17.03.2016: This is the first time, that the commands TST and EAPw have been publicly documented, after Kontakt started reverse-engineering the Coin validator firmware.
17.03.2016: This is the first time, that N-command has been publicly documented, after Kontakt started reverse-engineering the Coin validator firmware.
The original software used to program these coin validators ist called VAL-ESC, a itty-bitty-shitty DOS-application that also just issues the previous commands to calibrate a device, download the current coinset, or upload a new one.
There is a repository of some coin sets, that we should probably put online at some point in the future.