Work in progress

Produced by Landis&Gyr Communications for Nortel. Landis&Gyr Communications was sold to IPM Group - who have gone bankrupt and renamed themselves to New IPMtel.

Pictures:

Serial communication protocol (600/8n1):

COIN VALIDATOR SLEEP MODE's'
COIN VALIDATOR WAKE UP'g'
CALC COIN VALIDATOR CHECKSUM'k'
ACCEPT NEXT COIN'x'
ACCEPT ALL VALID COINS'a'
REJECT ALL COINS'z'
COLLECT ESCROW'c'
REFUND ESCROW'f'
ESCROW NULL'n'
LEARN ESCROW'l'  <- Very important, they wont work together otherwise.
REQUEST COIN STATUS'r'
DISABLE SPECIFIED COIN'd'
ENABLE SPECIFIED COIN'e'
READ COIN VAL ADDR'q'

ROM can be dumped with q 0x0000 to 0xFFFF.

IC-markings:

[M] SC408664CB
QQ1SSC-01
2C14H
LLHA9408

QMV 492 AD1
P190 C 9430

the MCU is a custom-marked MC68HC05B6

EEPROM

The EEPROM is located at 0x0100-0x1FF.

Below is a side-to-side comparison of the EEPROM of a Bell Canada and a Nevada Bell coin validator. Note, that the Bell Canada validator “knows” more coins than the Nevada Bell one.

  • MS: Most significant Byte
  • LS: Least significant Byte
Offset (h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00 Options register Checksum MS Checksum LS Western Electric refit flag Nominal avg sensor C time MS Nominal avg sensor C time LS Nominal avg sensor F time MS Nominal avg sensor F time LS Nominal avg sensor G time MS Nominal avg sensor F time LS Instantaneous half-window for detector C Instantaneous half-window for detector F Instantaneous half-window for detector G Scale factor for sensor timeout calculation MS Scale factor for sensor timeout calculation LS Half-window for detector C avg MS
10 Half-window for detector C avg LS Half-window for detector F avg MS Half-window for detector F avg LS Half-window for detector G avg MS Half-window for detector G avg LS Firing duration for solenoid MS Firing duration for solenoid LS Minimum coin separation time Pause time during cash or refund cycle number of bytes in coin table number of coins in coin table On-time for validator entry and exit sensors (A, B) Blocked-time for escrow sensors (C, F, G) Timeout on escrow motion (rotation jam) Unused Unused
20 Coin 1 Coin 2
30 ← 2 cont Coin 3 Coin 4
40 ← 4 cont Coin 5
50 ← 5 cont Coin 6 Coin 7
60 ← 7 cont Coin 8
70 Coin 9 Coin 10
80 ← 10 cont Coin 11 Coin 12
90 ← 12 cont Coin 13
A0 ← 13 cont Coin 14 Coin 15
B0 ← 15 cont Coin 16
C0 Coin 17 (Calibration Coin A) Coin 18 (Calibration Coin B)
D0 ← 18 cont Unknown (Calibration?) 0x00 0x00
E0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
F0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 ROM Version EEPROM Config ID
  • Some CRC - don't bother and just issue the k-command to have it calculated and written to the EEPROM automagically.
  • Unused
  • 0.25 µs increments
  • 2 µs increments
  • 0.25 µs increments
  • 2 µs increments
  • 8 µs increments
  • 8 µs increments
  • not actively used

On-time for validator entry and exit sensors (A, B)

  • 2 µs increments
  • 8 ms increments
  • 64 ms increments

28.05.2016: This is the first time, that coin-definitions have been publicly documented, after Krater and martin started reverse-engineering the Coin validator firmware.

Each defined coin is represented by 5 measurement-values of 2 Bytes each, so 10 Bytes in total. Each measurement of 2 Bytes/16 Bits contains the following information:

  • Enable/Disable coin (E): 1 Bit
  • Median value (V): 9 Bits
  • Validity range (R): 6 Bits

In other words, the acceptance range for each of the five parameters, given a measured value of M is: V-R ⇐ M ⇐ V+R (If the measured value is 100 and the range is set to 30, coins with a measurement of M in between 70 and 130 will pass).

First Byte Second Byte
E V V V V V V V V V R R R R R R

The Enable-Bit is only set on the first tuple of each coin - the other four tuples have it set to zero. Unused coin-slots are written as 0x80 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Median tuple transformation

Alway rounded to ,0.

  • 1st tupel: (X1 - 0x1000) / 0x10
  • 2nd tuple: X2 / 0x04
  • 3rd tuple: (X3 - 0x1000) / 0x10
  • 4th tuple: X4 /0x02
  • 5th tuple: X5 / 0x80

Tuple construction

  1. Obtain a sufficient amount of test-data for each coin using the TST-command.
  2. Calculate median value
  3. Transform tuples according to section above
  4. Calculate necessary range (max. +- 63) to cover all measurements
  5. Convert median and range into single Bits and fill in table
  6. Convert Bit-Table into 2 Hex-numbers and write to EEPROM.
* PROCEDURE: get_coin_validator_version_num
*
* DESCRIPTION: This procedure gets a 4 byte version number from the coin validator.
*  It has the following format and EEPROM addresses:
*          Field             EEPROM address
*          -----             --------------
*   1. ROM Version Number      1FC - 1FD
*   2. EEPROM Config ID        1FE - 1FF
  • As the EEPROM starts at 0x0100, the same value has to be substracted from above mentioned addresses.

Communication

The validator communicates with a serial protocol at 600 Baud, 8n1

1
GND
3
DIn
5
GND
7
GND
9
+12VDC
2
DOut
4
GND
6
GND
8
GND
10
Reset
  • DIn is data fed into the validator
  • DOut is data coming from the validator
  • Reset must be tied to 5VDC. To perform reset, short to GND
ASCII Hex FW-level name Explanation
s 0x73 COIN_VALIDATOR_SLEEP_MODE Send device to sleep; must use COIN_VALIDATOR_WAKE_UP to put back into service
g 0x67 COIN_VALIDATOR_WAKE_UP Wake up device. Also needed after reset
k 0x6B CALC_COIN_VALIDATOR_CHECKSUM
x 0x78 ACCEPT_NEXT_COIN
a 0x61 ACCEPT_ALL_VALID_COINS
z 0x7a REJECT_ALL_COINS
c 0x63 COLLECT_ESCROW
f 0x66 REFUND_ESCROW
n 0x6e ESCROW_NULL
l 0x6c LEARN_ESCROW
r 0x72 REQUEST_COIN_STATUS
d<n> 0x64 DISABLE_SPECIFIED_COIN <n> is index of coin to be disabled; eg. d1
e<n> 0x65 ENABLE_SPECIFIED_COIN <n> is index of coin to be enabled for acceptance; eg. e3
q<n><m> 0x71 READ_COIN_VAL_ADDR <n> <m> is the address of the byte to be dumped from the device. EEPROM is from 0x0100 to 0x01FF. To dump first digit of ROM Version: 0x71 0x01 0xFC
TST 0x54 0x53 0x54 n/a Enable Test-Mode: Measurement data for each following deposited coin is returned.
EAPw <n><m> 0x45 0x41 0x50 0x77 n/a Write <m> to EEPROM-address <n> (0x00 < = n < = 0xFF). Wait 20ms between issuing EAPw, <n> and <m>

17.03.2016: This is the first time, that the commands TST and EAPw have been publicly documented, after martin started reverse-engineering the Coin validator firmware.

ASCII Hex FW-level name Explanation
0 0x30 INVALID_COIN Coin could not be validated (or was not enabled)
1 0x31 COIN_1
2 0x32 COIN_2
3 0x33 COIN_3
4 0x34 COIN_4
5 0x35 COIN_5
6 0x36 COIN_6
7 0x37 COIN_7
8 0x38 COIN_8
9 0x39 COIN_9
a 0x61 COIN_10
b 0x62 COIN_11
c 0x63 COIN_12
g 0x64 COIN_13
e 0x65 COIN_14
f 0x66 COIN_15
g 0x67 COIN_16
h 0x68 CALIBRATION_COIN_A Calibration Coin 1 - not used anymore in the field
i 0x69 CALIBRATION_COIN_B Calibration Coin 2 - not used anymore in the field
A 0x41 COIN_VALIDATOR_ALLS_WELL
B 0x42 COIN_VALIDATOR_STATUS
C 0x43 COIN_VALIDATOR_HW_FAULT
D 0x44 COIN_ESCROW_FAULT
E 0x45 COIN_EEPROM_CHECKSUM_FAILURE Can mostly be fixed by requesting new Checksum-calc with “k”
F 0x46 COIN_PWR_UP_RAM_FAULT
G 0x47 COIN_ERROR_UNKNOWN_CMD
H 0x48 COIN_EEPROM_WR_FAILURE
I 0x49 COIN_VALIDATOR_JAM
J 0x4A COIN_ENTRY_FRAUD_ATTEMPT
N <x> 0x4E COIN_TST_DATA Returns coin-measurement-data in the following format: “N<AAAA> <BBBB> <CCCC> <DDDD> <EEEE>\r\n”. Data in <> is hexadecimal.

17.03.2016: This is the first time, that N-command has been publicly documented, after martin started reverse-engineering the Coin validator firmware.

  • millennium/coinvalidator.txt
  • Last modified: 2021/04/18 12:35
  • (external edit)