Coin line controller

[timmerk]

Thanks for the update (and PM), Sigmaz!

[Sigmaz]

Ok the time came to give the CoinPro a good programming test.

I opened up the carton, removed the unit and it's power supply and plopped it onto the bench.

I plugged in an extension from my 616 to line 1 and a crappy touch tone phone for preliminary testing.




When I picked p the handset I was greeted with loud hissing and crackling.
The unit appeared to be DOA..  I removed the top cover and had a look inside for obvious component failure.. none found.
I checked the power rails and found the 5V rail ok, 48V rail ok, and even the coin relay power supply was putting out an 166V (no load).

I found the coin cell battery that is used to retain the volatile ram and the little supercap that is supposed to back it up.. with the power on I pulled the coin cell and tested it. a little shy of 3v..
killed the power and read the voltage at the battery holder to see if the cap is in parallel with the coin cell. ~1v
Looked like the cap wasnt charging/charged. I shorted the coin cell terminals to totally discharge the cap, reinstalled the coin cell and reapplied power..
when I picked up the handset I heard a little hiss and then the relays clicked!.

I was then presented with a dial tone.
I tried to dial my cell phone but was told by the DSP that the call was not permitted. I then called 800 directory and was asked for 75 cents..
Since the totalizer in my 1C1 is not working properly I used this crap phone and a tone generator app and Phreaked the coinpro into thinking I paid.. the call was then processed.

Other 800 numbers went straight through but for some reason directory assistance toll free or not is preprogrammed to charge 75 cents.
These units also have the ability to push a quick advertising quip before the call is processed, such as " Thanks to eating at Joe's Truck Stop" .. this one says in a two part recording, "Thank you for using... Cincinnati Bell"

https://youtu.be/bXvS5tLTSSo


Here are some photos of the inside for those who are interested.




Everything is stored in that dandy Intel Flash chip. I see what appears to be a JTAG header and a flash enable jumper..

I connected the CoinPro to ext26 of my 616 and my lab PC modem to 11 and asked PhoneTracker to poll the modem and push programming to it.
The controller answered on the first ring and illuminated its green line LED indicating that Line 1 was in use.




I created a sample site and gave the unit a fake location and whatnot..

Anyway, here is a screenshot of my first attempt at making contact.



The software is looking for the connect string to be very basic. The modem I am running has enhanced Verbose result codes and they were messing with it.
(CONNECT 2400 NOEc was the default connect result string, I had to send an ATW0 to switch them off and back to the simple CONNECT 2400.)

There are a few issues I need to figure out but it did say Hello world.. That's progress...right?

[timmerk]

Great update! Did you remove the EEPROM, or is that socket just unused?

[Sigmaz]

I spy a US Robotics modem (which is a good sign that it doesn't need a proprietary modem.) Also, did you remove the EEPROM, or is that socket just unused? What kind of microprocessor is that?

That is a USR V.92 but I didn't use that one to talk to it. I actually used a more common PCI winmodem that came with an HP desktop I had gutted a while back.
But the answer is "NO."  You do not need a special modem to program a CoinPro.

The empty socket you see was unpopulated. I can only assume that was put there as part of the "Future Enhancements" program.

Surprisingly, this thing is a monster, it has is a 13mhz 80188 and a Ti TMS320LC549 DSP and I believe that is a 2MB Flash chip. (PA28F016S5 - 16Mbit (2Mbit x 8 ))

[Sigmaz]

Did some research this morning and verified my suspicions.
Yep thats a JTAG port on the board next to the DSP.

Perhaps the Flash can be read/written to without pulling it from the board..

I has assumed they programmed it with the JTAG port and some proprietary software.. I just may be onto something.

(I forgot to add pin 87 -TRST to the drawing..)

[Sigmaz]

Update for tonight.

After some work with the way back machine I was able to make contact with a person that used to manage the support department at OmniPhone.

He gave me some valuable information.
One thing is that the units are all pre programmed at the factory through the front serial port.
This is good and bad. Good, it's easy to get to and connect to...Bad, he doesn't have the software to do the job. It was in another department and all of the servers and databases were taken out over 10 years ago.

However, during my conversation with him there was a remarkable discovery made.
I was able to identify and reach out to the primary engineer that wrote the software for these marvelous devices.
I have a detailed message sitting in an inbox right now. All we need is for him to read it and reply.

If the stars align and the great scoutmaster in the sky smiles upon us, We will hopefully have all the info (and tools) we could ever need.

I don't want to cast false hope, and I will still be analyzing the flash chip as well as poke around in the DB9 serial port.

But if this lead comes through reverse engineering hopefully won't be necessary.

[mentalstampede]

Wow! You're really making some awesome progress. I'll bet the ex-omniphone employee you contacted was surprised to get an inquiry about these! I'll keep my fingers crossed that you can get through to someone who has the necessary knowledge.

[Sigmaz]

Yeah, he was pretty surprised to hear from me for sure.but I think he liked trying to help.

Anyway, I removed the board from the case to examine the other side with the hopes of finding something useful hidden there..

So much for the warranty.... 

Nope, nothing useful... but here is a photo for those of you who are playing along at home.

[Sigmaz]

One issue I keep running into is an "Invalid signature. Login failure" error.. I know I'm getting past the access code check because I deliberately entered an invalid access code and it failed with an error telling me it was wrong.

I think the original program files on-board are corrupt. remember the unit was hissing and popping when I first tried it...
portions of the volatile memory may have started to lose its data.

One indication of this can be seen in the string that is returned when the software queries the controller for its facility name.

To eliminate the possibility of the error being the fault of my configuration, I did a fresh install on a real xp machine. I then tried again to communicate using an external USR modem instead of a win modem through a virtualized port. The result was exactly the same.

I think that this can be cleared up if the unit was able to take a fresh copy of the .bin file.. however I dont have the correct version bin for the S/W code I have on hand, and if the unit refuses to login it wont get to the part where it would take the update.
I think the secret sauce for this unit here is to reload it as the factory did, from the front port.

I think I need to learn to be patient now.. the engineer hasn't read my message yet and assuming he one day will doesn't guarantee that he has the software handy.

Fingers crossed...

[Sigmaz]

I hope the alert of an update to this thread didn't get you all too excited. I just wanted to let you guys know I have yet to hear back from Ken.
However, I'm still all in on getting this thing working properly.

This summer has been pretty busy for me so I haven't been too active but I do check in from time to time.

Fingers crossed gang, Fingers crossed...

[Protel8000]

So does that basically operate the same way a CO coinline does?

[Payphone installer]

It is a CO and will deliver collect return voltage to a dumb payphone like a W/E 1C or 1D that is what it was used for. It made adumb set smart. It even simulated a live operator or routed to a AOSP meaning Alternative Operator Services Company. It also processed credit cards.

[Protel8000]

Wow that's neat. I'll have to keep my eye out for one on eBay. Hopefully you can get the software functioning

[FABphones]

Thanks for taking the time to detail, photo and screenshot your progress Sigmaz.
I'm finding it all very interesting, some good info here. 

[robert_m]

Who has one they want to sell that works......