Triton 9610 ATM Teardown


A few years ago I got a Triton 9610 single cassette ATM of craigslist as something to play with. While I did take a look at it and started to reverse engineer it, over time I lost interest and it became a potplant stand. I finally decided to get rid of it and I thought I’d rip it to bits and take a bunch of photos during the process.
A nice potplant standIMG_9643_small

The Teardown

IMG_9642_smallIMG_9651_small

Behind the covers. Most of the user interface is mounted to the inside of the front lid, with the exception of the processor module. I’ll provide more detail on both further down.

IMG_9650_smallIMG_9654_small

Check this out guys, it’s insanely great. It’s got a 2400bps modem. Also a whopping 2Mb of expanded memory, Flash in this case.

IMG_9656_smallIMG_9658_small

IMG_9664_smallIMG_9666_small

Here is the electronic deadbolt for the safe. A La Gard Inc (KABA) 3040-DB. The dial is a La Gard Inc LG3035 Low Profile Keypad.

IMG_9669_small

IMG_9671_small

Time for a trip to the recycling centre.

The Interesting Bits

IMG_9672_small

This is a journal module. I’m quite sure that it stores the history of all transactions for audit trail purposes. It’s possible to print and clear the journal from the management menu on the ATM. This one had roughly 4 years worth of transactions in it, which I started printing. I had to turn the ATM off as it would have gone on forever. This whole thing is potted and there is no chance of looking inside without the use of a lot of nasty chemicals. It could be something I do another day.

IMG_9673_small

The cash dispenser, set up for the Canadian $20 paper note. It’s a DeLa Rue MiniMech 10. I have no idea what I’m going to do with it, I do know that it’s in working condition. Depends if I can figure out how to talk to it.

IMG_9680_small

Standard 2 track magnetic card reader.

IMG_9686_small

The thermal printer. An Axiohm BRBHS010. I’m hoping that the protocol is similar to the one listed here as I’ve got plans for this.

IMG_9690_small

Power supply and filtering.

Embedded Controller

The processor and accompanying support components are on a set of removable cards, connected together via a back plane. The back plane also provides power and communications to the devices mounted on the inside cover. All of the PCBs are 2 layer with very large track clearances. This made it relatively easy to reverse engineer the circuit connections.

IMG_9692_small

A Z180 with Timer and IO expansion module. The Z180 (centre) supports banked memory up to 1M. The other ICs on board are RS232 level converters and 7400 series logic for address decoding. All of the boards and back plane have a 24C01 128 byte I2C EEPROM which I assume is used to determine which boards are present in the system. I haven’t had a look at the contents of these at all.

IMG_9694_small

The memory module. The ATM firmware is stored on the IC on the left and then proceeding to the right there is 32Kb of static RAM, 8Kb EEPROM and then two 256Kb Flash ICs. In the lower left corner is a microprocessor supervisor, with battery backup and in the right is more address decoding logic. The two flash chips probably serve as storage for images used during ATM operation.

IMG_9695_small

The modem and LCD display driver. The modem module on the bottom of the image is socketed to allow upgrades.

IMG_9696_small

2Mb memory expansion module. Each IC is a 512Kb Flash and the same PCB is used for the 4Mb expansion modules. The rest of the components are address decoding. So how does 2Mb (or 4Mb) of memory get accessed along with everything else by a processor that only has a 1Mb address space? Most parts are mapped directly into the address space of the processor, although not necessarily in a continuous block. For this board however there are latches in the IO space which act as another bank selection, only mapping 4Kb of a chip into the memory address space of the processor at a time. I believe this technique was also quite common with Z80 based arcade machines.

IMG_9697_small

The back plane, providing IO and power to the cards.

IMG_9705_small

My many pages of reversing notes. I mapped out how each IC on the CPU, memory and memory expansion boards connect to other ICs on the board and to the back plane. The only tool I used to do this was a continuity tester.

The Secure Pin Entry Device

The SPED is responsible for securely capturing the customers PIN when needed. Battery backed up with DES encryption keys stored in RAM in order to prevent key disclosure. I tried to take a look at it.

IMG_9698_small

IMG_9700_small

IMG_9701_small

Whoops. I can’t tell too much by this, which I guess is by design.

 

I’m not sure what I’m going to do with most of this stuff. For the time being they’ll live in the projects box until I have a use for them.

, , ,

  1. No comments yet.
(will not be published)