Produced by Landis&Gyr Communications for Nortel. Landis&Gyr Communications was sold to IPM Group - who have gone bankrupt and renamed themselves to New IPMtel.

Pictures:

• http://imgur.com/WtfJ1ns
• http://imgur.com/TR0Rmcl
• http://imgur.com/56GCbZd

Serial communication protocol (600/8n1):

COIN VALIDATOR SLEEP MODE's'
COIN VALIDATOR WAKE UP'g'
CALC COIN VALIDATOR CHECKSUM'k'
ACCEPT NEXT COIN'x'
ACCEPT ALL VALID COINS'a'
REJECT ALL COINS'z'
COLLECT ESCROW'c'
REFUND ESCROW'f'
ESCROW NULL'n'
LEARN ESCROW'l'  <- Very important, they wont work together otherwise.
REQUEST COIN STATUS'r'
DISABLE SPECIFIED COIN'd'
ENABLE SPECIFIED COIN'e'
READ COIN VAL ADDR'q'

ROM can be dumped with q 0x0000 to 0xFFFF.

IC-markings:

[M] SC408664CB
QQ1SSC-01
2C14H
LLHA9408

QMV 492 AD1
P190 C 9430

the MCU is a custom-marked MC68HC05B6

The EEPROM is located at 0x0100-0x1FF.

Below is a side-to-side comparison of the EEPROM of a Bell Canada and a Nevada Bell coin validator. Note, that the Bell Canada validator “knows” more coins than the Nevada Bell one.

• EEPROM Options register
• 03: Part 2 of the EEPROM array is not protected; all 256 bytes of EEPROM can be accessed for any read, erase or programming operations. / Security Bit is not set
• Page 48, Section 3.5.5, Options register (OPTR)

Each defined coin is represented by 5 measurement-values of 2 Bytes each, so 10 Bytes in total.
Each measurement of 2 Bytes/16 Bits contains the following information:

• Enable/Disable coin (E): 1 Bit
• Median value (V): 9 Bits
• Validity range (R): 6 Bits

* PROCEDURE: get_coin_validator_version_num
*
* DESCRIPTION: This procedure gets a 4 byte version number from the coin validator.
*  It has the following format and EEPROM addresses:
*          Field             EEPROM address
*          -----             --------------
*   1. ROM Version Number      1FC - 1FD
*   2. EEPROM Config ID        1FE - 1FF

• As the EEPROM starts at 0x0100, the same value has to be substracted from above mentioned addresses.

The validator communicates with a serial protocol at 600 Baud, 8n1

• DIn is data fed into the validator
• DOut is data coming from the validator
• Reset must be tied to 5VDC. To perform reset, short to GND

ASCII	Hex	FW-level name	Explanation
s	0x73	COIN_VALIDATOR_SLEEP_MODE	Send device to sleep; must use COIN_VALIDATOR_WAKE_UP to put back into service
g	0x67	COIN_VALIDATOR_WAKE_UP	Wake up device. Also needed after reset
k	0x6B	CALC_COIN_VALIDATOR_CHECKSUM
x	0x78	ACCEPT_NEXT_COIN
a	0x61	ACCEPT_ALL_VALID_COINS
z	0x7a	REJECT_ALL_COINS
c	0x63	COLLECT_ESCROW
f	0x66	REFUND_ESCROW
n	0x6e	ESCROW_NULL
l	0x6c	LEARN_ESCROW
r	0x72	REQUEST_COIN_STATUS
d<n>	0x64	DISABLE_SPECIFIED_COIN	<n> is index of coin to be disabled; eg. d1
e<n>	0x65	ENABLE_SPECIFIED_COIN	<n> is index of coin to be enabled for acceptance; eg. e3
q<n><m>	0x71	READ_COIN_VAL_ADDR	<n> <m> is the address of the byte to be dumped from the device. EEPROM is from 0x0100 to 0x01FF. To dump first digit of ROM Version: 0x71 0x01 0xFC
TST	0x54 0x53 0x54	n/a	Enable Test-Mode: Measurement data for each following deposited coin is returned.
EAPw <n><m>	0x45 0x41 0x50 0x77	n/a	Write <m> to EEPROM-address <n> (0x00 < = n < = 0xFF). Wait 20ms between issuing EAPw, <n> and <m>

17.03.2016: This is the first time, that the commands TST and EAPw have been publicly documented, after Kontakt started reverse-engineering the Coin validator firmware.

ASCII	Hex	FW-level name	Explanation
0	0x30	INVALID_COIN	Coin could not be validated (or was not enabled)
1	0x31	COIN_1
2	0x32	COIN_2
3	0x33	COIN_3
4	0x34	COIN_4
5	0x35	COIN_5
6	0x36	COIN_6
7	0x37	COIN_7
8	0x38	COIN_8
9	0x39	COIN_9
a	0x61	COIN_10
b	0x62	COIN_11
c	0x63	COIN_12
g	0x64	COIN_13
e	0x65	COIN_14
f	0x66	COIN_15
g	0x67	COIN_16
h	0x68	CALIBRATION_COIN_A	Calibration Coin 1 - not used anymore in the field
i	0x69	CALIBRATION_COIN_B	Calibration Coin 2 - not used anymore in the field
A	0x41	COIN_VALIDATOR_ALLS_WELL
B	0x42	COIN_VALIDATOR_STATUS
C	0x43	COIN_VALIDATOR_HW_FAULT
D	0x44	COIN_ESCROW_FAULT
E	0x45	COIN_EEPROM_CHECKSUM_FAILURE	Can mostly be fixed by requesting new Checksum-calc with “k”
F	0x46	COIN_PWR_UP_RAM_FAULT
G	0x47	COIN_ERROR_UNKNOWN_CMD
H	0x48	COIN_EEPROM_WR_FAILURE
I	0x49	COIN_VALIDATOR_JAM
J	0x4A	COIN_ENTRY_FRAUD_ATTEMPT
N <x>	0x4E	COIN_TST_DATA	Returns coin-measurement-data in the following format: “N<AAAA> <BBBB> <CCCC> <DDDD> <EEEE>\r\n”. Data in <> is hexadecimal.

17.03.2016: This is the first time, that N-command has been publicly documented, after Kontakt started reverse-engineering the Coin validator firmware.