This is an old revision of the document!
Work in progress
Produced by Landis&Gyr Communications for Nortel. Landis&Gyr Communications was sold to IPM Group - who have gone bankrupt and renamed themselves to New IPMtel.
Pictures:
Serial communication protocol (600/8n1):
COIN VALIDATOR SLEEP MODE's' COIN VALIDATOR WAKE UP'g' CALC COIN VALIDATOR CHECKSUM'k' ACCEPT NEXT COIN'x' ACCEPT ALL VALID COINS'a' REJECT ALL COINS'z' COLLECT ESCROW'c' REFUND ESCROW'f' ESCROW NULL'n' LEARN ESCROW'l' <- Very important, they wont work together otherwise. REQUEST COIN STATUS'r' DISABLE SPECIFIED COIN'd' ENABLE SPECIFIED COIN'e' READ COIN VAL ADDR'q'
ROM can be dumped with q 0x0000 to 0xFFFF.
IC-markings:
[M] SC408664CB QQ1SSC-01 2C14H LLHA9408 QMV 492 AD1 P190 C 9430
the MCU is a custom-marked MC68HC05B6
EEPROM
The EEPROM is located at 0x0100-0x1FF.
Below is a side-to-side comparison of the EEPROM of a Bell Canada and a Nevada Bell coin validator. Note, that the Bell Canada validator “knows” more coins than the Nevada Bell one.
Decoding
Offset (h) | 00 | 01 | 02 | 03 | 04 | 05 | 06 | 07 | 08 | 09 | 0A | 0B | 0C | 0D | 0E | 0F |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
00 | OPTR | CHKSUM | Escrow-related? | |||||||||||||
10 | ||||||||||||||||
20 | Coin 1 | Coin 2 | ||||||||||||||
30 | ← 2 cont | Coin 3 | Coin 4 | |||||||||||||
40 | ← 4 cont | Coin 5? | ||||||||||||||
50 | ← 5 cont | Coin 6 | Coin 7 | |||||||||||||
60 | ← 7 cont | Coin 8 | ||||||||||||||
70 | Coin 9 | Coin 10 | ||||||||||||||
80 | ← 10 cont | Coin 11 | Coin 12 | |||||||||||||
90 | ← 12 cont | Coin 13 | ||||||||||||||
A0 | ← 13 cont | Coin 14 | Coin 15 | |||||||||||||
B0 | ← 15 cont | Coin 16 | ||||||||||||||
C0 | Coin 16 | Coin 17 | ||||||||||||||
D0 | ← 17 cont | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | |||
E0 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 |
F0 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | ROM Version | EEPROM Config ID |
OPTR
- EEPROM Options register
- 03: Part 2 of the EEPROM array is not protected; all 256 bytes of EEPROM can be accessed for any read, erase or programming operations. / Security Bit is not set
ROM Version / EEPROM Config ID
* PROCEDURE: get_coin_validator_version_num * * DESCRIPTION: This procedure gets a 4 byte version number from the coin validator. * It has the following format and EEPROM addresses: * Field EEPROM address * ----- -------------- * 1. ROM Version Number 1FC - 1FD * 2. EEPROM Config ID 1FE - 1FF
- As the EEPROM starts at 0x0100, the same value has to be substracted from above mentioned addresses.
Communication
The validator communicates with a serial protocol at 600 Baud, 8n1
Pinout
1 GND | 3 DIn | 5 GND | 7 GND | 9 +12VDC |
2 DOut | 4 GND | 6 GND | 8 GND | 10 Reset |
- DIn is data fed into the validator
- DOut is data coming from the validator
- Reset must be tied to 5VDC. To perform reset, short to GND
Commands to validator
17.03.2016: This is the first time, that the commands TST and EAPw have been publicly documented, after Kontakt started reverse-engineering the Coin validator firmware.
Replies from validator
17.03.2016: This is the first time, that N-command has been publicly documented, after Kontakt started reverse-engineering the Coin validator firmware.