Triton 9610 ATM Teardown

A few years ago I got a Triton 9610 single cassette ATM of craigslist as something to play with. While I did take a look at it and started to reverse engineer it, over time I lost interest and it became a potplant stand. I finally decided to get rid of it and I thought I’d rip it to bits and take a bunch of photos during the process.
A nice potplant standIMG_9643_small

The Teardown


Behind the covers. Most of the user interface is mounted to the inside of the front lid, with the exception of the processor module. I’ll provide more detail on both further down.


Check this out guys, it’s insanely great. It’s got a 2400bps modem. Also a whopping 2Mb of expanded memory, Flash in this case.



Here is the electronic deadbolt for the safe. A La Gard Inc (KABA) 3040-DB. The dial is a La Gard Inc LG3035 Low Profile Keypad.



Time for a trip to the recycling centre.

The Interesting Bits


This is a journal module. I’m quite sure that it stores the history of all transactions for audit trail purposes. It’s possible to print and clear the journal from the management menu on the ATM. This one had roughly 4 years worth of transactions in it, which I started printing. I had to turn the ATM off as it would have gone on forever. This whole thing is potted and there is no chance of looking inside without the use of a lot of nasty chemicals. It could be something I do another day.


The cash dispenser, set up for the Canadian $20 paper note. It’s a DeLa Rue MiniMech 10. I have no idea what I’m going to do with it, I do know that it’s in working condition. Depends if I can figure out how to talk to it.


Standard 2 track magnetic card reader.


The thermal printer. An Axiohm BRBHS010. I’m hoping that the protocol is similar to the one listed here as I’ve got plans for this.


Power supply and filtering.

Embedded Controller

The processor and accompanying support components are on a set of removable cards, connected together via a back plane. The back plane also provides power and communications to the devices mounted on the inside cover. All of the PCBs are 2 layer with very large track clearances. This made it relatively easy to reverse engineer the circuit connections.


A Z180 with Timer and IO expansion module. The Z180 (centre) supports banked memory up to 1M. The other ICs on board are RS232 level converters and 7400 series logic for address decoding. All of the boards and back plane have a 24C01 128 byte I2C EEPROM which I assume is used to determine which boards are present in the system. I haven’t had a look at the contents of these at all.


The memory module. The ATM firmware is stored on the IC on the left and then proceeding to the right there is 32Kb of static RAM, 8Kb EEPROM and then two 256Kb Flash ICs. In the lower left corner is a microprocessor supervisor, with battery backup and in the right is more address decoding logic. The two flash chips probably serve as storage for images used during ATM operation.


The modem and LCD display driver. The modem module on the bottom of the image is socketed to allow upgrades.


2Mb memory expansion module. Each IC is a 512Kb Flash and the same PCB is used for the 4Mb expansion modules. The rest of the components are address decoding. So how does 2Mb (or 4Mb) of memory get accessed along with everything else by a processor that only has a 1Mb address space? Most parts are mapped directly into the address space of the processor, although not necessarily in a continuous block. For this board however there are latches in the IO space which act as another bank selection, only mapping 4Kb of a chip into the memory address space of the processor at a time. I believe this technique was also quite common with Z80 based arcade machines.


The back plane, providing IO and power to the cards.


My many pages of reversing notes. I mapped out how each IC on the CPU, memory and memory expansion boards connect to other ICs on the board and to the back plane. The only tool I used to do this was a continuity tester.

The Secure Pin Entry Device

The SPED is responsible for securely capturing the customers PIN when needed. Battery backed up with DES encryption keys stored in RAM in order to prevent key disclosure. I tried to take a look at it.




Whoops. I can’t tell too much by this, which I guess is by design.


I’m not sure what I’m going to do with most of this stuff. For the time being they’ll live in the projects box until I have a use for them.

, , ,

  1. No comments yet.
(will not be published)