Gemalto MagIC3 C-series User manual

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
INTRODUCTION
Ref: 22000-02-MAN-I-08010 August 2009 1/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
Point of Sales Terminals
MagIC3M-series Handset
MAINTENANCE MANUAL
Version 2.0 - August 2009

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
INTRODUCTION
Ref: 22000-02-MAN-I-08010 August 2009 2/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
COPYRIGHT AND PROPRIETARY LEGENDS
These materials contain confidential and proprietary information in the nature of, for
example, trade secrets and know-how, and are not to be distributed or divulged to third
parties, or duplicated in whole or in part without prior written permission from Gemalto E-
Payment, and are subject to use, copying, and disclosure restrictions contained in a
agreement with Gemalto E-Payment.
These materials are to be used only for the intended purpose agreed upon in the related
contract with Gemalto E-Payment. IN NO EVENT SHALL GEMALTO E-PAYMENT BE
LIABLE FOR SPECIAL, INDIRECT, OR CONSEQUENTIAL DAMAGES IN CONNECTION
WITH OR ARISING FROM THE USE OF THIS DOCUMENT OR ANY PROGRAMS
CONTAINED HEREIN. GEMALTO E-PAYMENT EXPRESSLY DISCLAIMS ANY
WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE IN
RELATION TO THIS DOCUMENT OR ANY PROGRAMS CONTAINED HEREIN.
Copyright (c) 2008 by Gemalto
All rights reserved.

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
INTRODUCTION
Ref: 22000-02-MAN-I-08010 August 2009 3/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
MODIFICATION SHEET
Date Version Modifications
Aug 2008 1.0 Draft
Oct 2008 1.1 Release
Oct 2008 1.2 Updated III- MI16 Elastomeric replacement.
August 2009 2.0 Updated I-2
Updated II-2.12. SECURITY ALERT procedure.
Added II-3.0. SECURITY ALERT SP status register.
Updated III- MI5, MI7, MI9, MI11, MI15.
Updated LITHIUM_BAT voltage threshold replacement

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
INTRODUCTION
Ref: 22000-02-MAN-I-08010 August 2009 4/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
Table of contents
INTRODUCTION...................................................................................................................5
1. Scope.............................................................................................................................5
1.1 References.............................................................................................................. 5
1.2 MagIC3Diag software .............................................................................................5
1.3 Abbreviations used .................................................................................................5
I) - DESCRIPTION ................................................................................................................6
2. System Product Architecture design ..............................................................................6
2.1 Technical overview .................................................................................................6
2.2 Physical Architecture .............................................................................................. 8
3. Software Architecture...................................................................................................16
II) - TROUBLESHOOTING.................................................................................................. 18
1. Introduction ..................................................................................................................18
1.1 Methodology .........................................................................................................18
1.2 Safety regulation ...................................................................................................18
1.3 Special tools and test equipment .......................................................................... 18
1.4 Procedure ............................................................................................................. 19
2. Troubleshooting Instructions ........................................................................................20
2.1 BATTERY-PACK failure........................................................................................20
2.2 POWER SUPPLY failure.......................................................................................21
2.3 DISPLAY failure ....................................................................................................22
2.4 KEYBOARD failure ...............................................................................................22
2.5 PRINTER failure ...................................................................................................23
2.6 MAGNETIC READER failure ................................................................................24
2.7 CUSTOMER SMART CARD READER failure ......................................................25
2.8 SAM READER (SIM-sized) failure ........................................................................25
2.9 GSM INTERFACE failure...................................................................................... 26
2.10 USB failure............................................................................................................ 27
2.11 BASE CONTACT INTERFACE failure ..................................................................27
2.12 SECURITY ALERT / LITHIUM BATTERY failure.................................................. 28
3. SECURITY ALERT – How to interprete SP Status information.................................... 31
3.1 SP STATUS ticket information .............................................................................. 32
3.2 UKSR/SECIRQ values meanings ......................................................................... 33
3.3 Interpreting UKSR/SECIRQ values....................................................................... 33
III) - MAINTENANCE …………………………………………………………..……………. RI[01]

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
INTRODUCTION
Ref: 22000-02-MAN-I-08010 August 2009 5/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
INTRODUCTION
1. Scope
This document relates to the MagIC3M-series Handset. The aim of this manual is to give
necessary technical information and procedures to carry out all maintenance activities
needed during the life span of the MagIC3M-series Handset.
This guide is divided in 3 parts:
•I) Description, consisting in a detailed description of the terminal and its equipment.
•II) Troubleshooting, explaining how to find the root cause of failures.
•III) Maintenance, containing replacement procedures for all parts that can be
exchanged during Maintenance level 2 operation.
It mainly makes reference to the Maintenance software MagIC3-Diag RI[02].
1.1 References
RI[01] : 22000-02-MAN-I-08011 Part III - MAINTENANCE
RI[02] : 15200-00-MAN-S-07001 Maintenance software, MagIC3-Diag User Manual
1.2 MagIC3Diag software
You have to use MagIC3Diag version 1.5 minimum to test M-series. This software tool
is available on the MPO site.
1.3 Abbreviations used
AM Application Manager
MMS MagIC Management System
MP Main Processor
OS Operating System
PCB Printed Circuit Board
POS Point Of Sale
SAM Security Application Module
SIM Subscriber Identification Module
SMD Surface Mounted Device
SP Secure Processor
TMS Terminal Management System

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 1 : DESCRIPTION
Ref: 22000-02-MAN-I-08010 August 2009 Ch.1 - 6/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
I) - DESCRIPTION
2. System Product Architecture design
2.1 Technical overview
The M-series Handset product is based on dual micro-processor architecture, the secure
microcontroller to manage security purposes, the main processor as application manager.
The Handset architecture is mainly made of 3 electronic boards:
•The Keyboard PCB supports the keypad rubber membrane, the Smart card reader,
the display connectors and the SP (Secure Processor). Lithium battery backup is
located on this board too. This PCB is connected to the Main board through 30-pin
board-to-board connector.
•The Main PCB supports the MP (Main Processor), memories (RAM, Flash,
EEPROM), Power/Charge manager and connectors for devices (SAM readers, mag
stripe rdr, printer, radio module, battery pack, external contacts with the Base,
USBA & power supply jack).
•A secure box, mades of PCB, that covers sensitive signals/components of the
keyboard board.
The Handset is made of following devices:
•32-bit RISC core ARM7, as SP (Secure Processor) ;
•32-bit RISC core ARM9, as MP (Main Processor) ;
•4 / 8 Mb Flash, 16 / 32 Mb SDRAM, 1024-bit EEPROM ;
•Lithium battery to back-up sensitive data and triggering data stored in SP ;
•Magnetic stripe reader ;
•Customer smart card reader ;
•2 accessible SIM-sized readers ;
•1 accessible SIM-sized reader dedicated to GSM SIM ;
•GPRS radio module ;
•128x64 graphic display with backlight, no icons ;
•Keypad with backlight ;
•Buzzer ;
•Thermal printer ;
•1 USB host ;
•Power supply input.

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 1 : DESCRIPTION
Ref: 22000-02-MAN-I-08010 August 2009 Ch.1 - 7/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
1. Printer 6. Contacts with Base 11. USB Device
2. Display 7. SIM-sized reader for GSM 12. Power Supply
3. Keyboard 8. Battery pack
4. Smart Card Reader 9. Reset button
5. Magnetic Stripe Reader 10. 2 x SIM-sized readers for
application purpose.
2
3
5
1
4
6
7
11
10
8
12
9

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 1 : DESCRIPTION
Ref: 22000-02-MAN-I-08010 August 2009 Ch.1 - 8/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
2.2 Physical Architecture
2.2.1 Block diagram
Main Processor
AT91SAM9260
Radio
Module
MC55/56
Thermal
printer
Driver
Secure Processor
AT91SO101
ROM: 32 kbytes
EEPROM: 256 kbytes
RAM: 100 kbytes
h/w TRNG, TDES, RSA accelerator
Intrusion sensors,
Protection against SPA/DPA attacks
Environment protection systems (Voltage, frequency
temperature, UV)
SIM1 to SIM2
smart card readers
Customer
smart card reader
Intrusion switches
& mesh sensors
Battery backup
Graphic display Graphic display
Buzzer
Keyboard
EEPROM
FLASH
EPROM
SDRAM
Magnetic
stripe
d
Driver
SIM GSM
Li-ion
Battery pack
/
Fuel gauge
Charge management
/
Power management
Com Base Vin Base Vin USB-h < In/Out
Base contacts jack usb-a < connectors
Element located or linked with Keyboard pcb
Element located or linked with Main pcb

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 1 : DESCRIPTION
Ref: 22000-02-MAN-I-08010 August 2009 Ch.1 - 9/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
2.2.2 The AT91SO101, the Secure Processor
The AT91SO101 is a single package solution in BGA256 embedding two chips, the
AT91SO100 and the AT83C26
The AT91SO100 is a 32-bit microcontroller based on the ARM RISC architecture
(ARM7TDMI code compatible) with embedded EEPROM, RAM and peripheral functions. It
achieves throughputs close to 1 MIPS per Mhz.
The AT83C26 is a multiple Smart Card Reader interface. Combined to the AT91SO100, it
makes a fully compatible solution with ISO7816, EMV2000 level1 standards.
Below are the main features of the AT91SO101:
•256 Kb EEPROM, 96 Kb RAM, 4 Kb crypto RAM, 32 Kb ROM
•RTC, System timers, Communication ports
•1x ISO7816 controller
•1x ISO7816 multiplexed to address up to 4 SAM in our application
•DES3, AES, SHA, crypto multiplier (RSA, DSA, key generation, ECC)
•True random number generator
Security features :
•256 bits for key storage (battery backup)
•Dedicated hardware for protection against SPA/DPA attacks
•Active shield, intrusions sensors (mesh & switches)
•Environmental protection (voltage, frequency, temperature)
•Secure memory management
2.2.3 The AT91SAM9260, as Main Processor
The AT91RM9260 is a complete system-on-chip built around the ARM926EJ-S core.
The AT91RM9260 operating frequency can go up to 200 MHz.
The ARM926EJ-S, an ARM9 32-bits RISC processor with :
•Mode Thumb
•8 Kb Data cache, 8 Kb instruction cache
•MMU to provide access permission checks for instruction and data
•A set of system peripherals & interfaces ; timers, RTC, interrupt controller, I/O, USB,
etc…
•Embedded memories (8 Kb SRAM, 32 Kb ROM)

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 1 : DESCRIPTION
Ref: 22000-02-MAN-I-08010 August 2009 Ch.1 - 10/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
2.2.4 External Memory
2.2.4.1 FLASH
The Flash (8 Mb NOR-Flash) contains boot and compressed executable files as Linux, AM,
Applications, … The executable files are uncompressed and copied in SDRAM for
execution. Flash can be compared to the disk of your PC, a kind of Flash-disk.
2.2.4.2 SDRAM
The SDRAM (16 Mb) is used by MP as executable area (Linux, AM, Applications, …) and
working area (stacks, buffers, variables, …). The SDRAM content is lost when system
powered down.
2.2.4.3 EEPROM
This E2PROM (1024 bits) is used to keep Gemalto and manufacturer information such as
serial number for instance. This component is interfaced to the AT91SAM9260.
2.2.5 Magnetic stripe card reader interface
This interface allows reading magnetic stripe cards ISO1/2/3 according to ISO 7811
standard. The interface can be equipped with either head allowing 2 tracks reading ISO1/2
(2/3) or head allowing 3 tracks reading for ISO 1/2/3. Head (2 or 3 tracks) is connected to
the PCB via a 7-point connector.
Note:
The cards can be read in both way, it can be introduced from up to down, or from down to up.
2.2.6 Smart card interfaces
The AT91SO101 includes a smart card solution fully compatible with ISO7816 & EMV2000
standards. The complete function is able to manage the customer card and up to 2 SIMs.
Below are features that are common to all smart card interfaces.
•Support 3.3V and 5V cards.
•VPP is electrically isolated according to EMV specifications.
•Card clock runs to 4.80Mhz (means D=1 at 12,900 bps).
•D=2, D=4 are supported.
•Support asynchronous cards using protocols T=0 and T=1 according to ISO 7816-3
and EMV 2000 specifications.
2.2.6.1 Customer SC reader interface
The smart card reader is located under the keyboard. The reader is made of a SAM reader
and a card reader box (bottom and top) plastic parts (developed by Gemalto), this is a
friction contact connector type. The reader includes a dustproof switch that detects the
insertion/removal of smart cards. The reader accepts both asynchronous (EMV) and
synchronous smart cards.

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 1 : DESCRIPTION
Ref: 22000-02-MAN-I-08010 August 2009 Ch.1 - 11/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
2.2.6.2 1 to 2 SIM interface(s) for application purpose
The product supports up to 2 SIM-sized SAM reader located in the bottom part of the
terminal, near battery pack and accessible by opening the SIM door. SIMs are mechanically
guided and held in place by the bottom plastic part.
SIM connectors do not include card detect switch.
Since auxiliary signals are not interfaced, synchronous cards cannot be supported by these
interfaces.
2.2.6.3 SIM interface reserved for GSM module
The product includes 1 SIM-sized SAM reader dedicated to GSM module. It is located in
the bottom part of the terminal, near the 2 other SIMs and accessible near battery pack by
opening the SIM door. This SIM is mechanically guided and held in place by the bottom
plastic part.
2.2.7 Graphic Display
MAIN CHARACTERISTICS
Backlight Optional (backlight equipped in standard configuration)
Icon area NO
Active area 54,18(w) x 28,58(h) mm
Dot & Dot size 128 x 64 dots
0,38 x 0,38 mm (pitch 0,40 x 0,40)
Contrast Automatic temperature adjustment integrated to the display, with possibility to
control it by software
Lcd type Backlight version: FSTN/White/Positive/Transflective
No backlight version: STN/Yellow-green/Positive/Reflective
Viewing direction 6 o’clock
Controller COG (Chip On Glass)
2.2.8 Keyboard
The keyboard consists of :
•A set of 3 cursor keys [U] [–] [V]without backlight
•A set of 15 keys with backlight, as follows:
•11 numerical keypad: [0] – [9], [00]
•4 function keys: [*] , [x]:cancel , [<]:clear , [O]:enter
•Keys [0] – [9] have alphabet marking
•Key [5] has the blind point
Mechanically it consists of a silicon rubber membrane where each key is covered by a
plastic cap (known as plastic caps technology). The plastic caps cannot be removed from
their casing.
The backlight is optional but equipped in standard configuration. It is obtained by 4 LEDs
implemented on the keyboard PCB.
2.2.9 Buzzer
The buzzer is used for sound generation according to the software needs (e.g. keystroke).
Frequencies are under software control.

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 1 : DESCRIPTION
Ref: 22000-02-MAN-I-08010 August 2009 Ch.1 - 12/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
2.2.10 Printer
The printer is a Fujitsu FTP628-MCL101 or equivalent. The main characteristics are :
•384 dots / line ;
•Dot size 0.125 mm x 0.12 mm ;
•Printing speed = 15 lines/s (15 lines of 24 characters "0121345678901234567890123", font
16x8) ;
•Life time (paper feed length) = 50 Km for printing rate 25% max.
Note:
2 printer covers exist, first one allows to use a paper roll of 32 mm in diameter at the most,
second one allows to use a paper roll of 40 mm at the most.
2.2.11 USB
1 x USB 2.0 master, full speed and low speed (1.5 and 12 Mbps), 500 mA max.
2.2.12 Reset button
A reset buttom is accessible via plastic well on the bottom part of the terminal. The
activation of this buttom will lead to an hardware reset of the M-series. To make a reset,
introduce a paper clip in the well until activation of the reset buttom.
Note:
We recommend you to prefer this mean to make a reset. Other way consist by removing the
battery pack, but it is not suitable since you run the risk of dammaging the battery pack
connector.
2.2.13 Battery backup for Secure Processor
A lithium button cell of 3V - 230mA/h is used for the backup of the Secure Processor. It is
located on the keyboard pcb, and is not accessible. Its replacement requires the opening of
the terminal, triggering the tampering mechanism, leading to the erasure of the banking
keys.
When the Terminal is power-off or in case of Vcc failure, the SP is backed up via the battery
lithium cell, and the following security items continu to be active: Supply monitor on Vbat,
Temperature monitor, Intrusion monitor (mesh and switches) and key integrity violation.
Note that the SP Real Time Clock is backed up too.
The battery is identical to the one used on C-series. It allows 3-year lifetime for a terminal
powered 10 hours a day after 6 months storage.
The battery lifetime given here concerns a terminal stayed on shelf in normal storage
condition as specified by § 2.2.21 Environment Use.
Note:
When tampering, the Terminal shall be put back into operation using the Unlocking tool.
Only the secure processor is backed up, the application contexts are not.
For repair & manufacturing operations, the current of the battery can be checked via some PCB
pads, accessibles by opening the SIM door.
2.2.14 Radio communication
M-series integrates hardware solution (radio module + internal antenna) to work on
frequencies GSM 900/1800, or GSM 850/1900. The frequencies depend of the couple
(module + antenna) equipped in the Terminal. Associated to the good antenna, it is indeed

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 1 : DESCRIPTION
Ref: 22000-02-MAN-I-08010 August 2009 Ch.1 - 13/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
possible to integrate either the Siemens MC55 or MC56 module. MC55 & MC56 are pin-
to-pin and mechanically compatible, as well as antennas.
MC55/56 features GPRS multislot class 10 and supports the GPRS coding schemes CS1
to CS4.
Antenna is linked to the radio module via coaxial cable inside the Terminal.
oCouple MC55 + antenna C0120 is used to address GSM 900 / DCS 1800 markets
(European for instance).
oCouple MC56 + antenna C0132 is used to address GSM 850 / PCS 1900 markets
(USA for instance).
Note:
Future evolution : New Siemens Quad band module MC55i will be used to replace MC55 &
MC56 module. That means, whatever the frequency, you will always use the same module : the
MC55i. But you will always need 2 different antennas since each antenna has been designed to
support only 2 bandwidths.
2.2.15 Battery pack / Charge manager
2.2.15.1Battery pack
A Li-ion battery pack of 7.4V - 1150mA/h is used to maintain the Handset functional when
not power-on (typically the case when it is not on its Base & when not directly power-on via
its jack plug).
The Li-ion battery set consist in fact on 2 prismatic elements of 3.7V each.
This pack integrates a fuel gauge used for charge management and a protection circuit to
detect over & under-voltage.
It is located on the bottom side of the Handset, accessible by opening the SIM door. It is
connected to the Handset Main board via a connector 4 pts (Molex type).
2.2.15.2Charge manager
A Li-ion (Li-Polymer) charge-management circuit is integrated on M-series to manage the
battery charge.
2.2.16 Power supply
Power supply must be Vin = 12V +/- 5%, I = 1.8A (maximum current required).
On the Handset, power comes from 2 sources:
•From PSU connected to jack connector located on the back side of Handset ;
•From Base via 2 of the 4 connectors located on the bottom side of the Handset.
Note:
The Battery pack must be present and charge enough before applying the power supply source.
The Handset does not boot without Battery pack even if power supply is present.
2.2.17 Shut down / Wake up Functions
2.2.17.1Power OFF / Power ON
2.2.17.1.1 Power OFF
When does the Handset go in power off ?
•By using software function (via AM menu for instance) ;

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 1 : DESCRIPTION
Ref: 22000-02-MAN-I-08010 August 2009 Ch.1 - 14/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
•By removing the battery pack ;
•Upon AM decision, when Battery pack voltage is lower than 7,2V (AM shut down
security) ;
•Upon OS decision, when Battery pack voltage is lower than 6,8V (OS shut down
security in case of AM shut down security by-passed for any reason) ;
•Upon Battery pack voltage internal trigger (Security is included in the pack to cut
power in case of over/under voltage detection).
2.2.17.1.2 Power ON
Battery pack must be present and charge enough, that are the initial conditions to leave
power off. From this state, power on can be done by :
•Connecting PSU on the Handset jack connector ;
•Laying down the Handset to the Base (assuming Base is powered on) ;
•By typing the key DOWN (key must be pushed during 1s at least to wake up.
2.2.17.2Power Sleep / Wake up
2.2.17.2.1 Power Sleep
The Handset goes in power sleep upon software decision (when Handset is in AM idle
mode for 10s for instance (Application dependent).
2.2.17.2.2 Wake up
The handset can leave the power sleep upon any key pressed, upon hardware trigger like
from communication devices, …. (in any case it is software dependent).
2.2.18 Communication with the Base
It is done via an USBh, Base can be considered like a Hub on which peripherals are
connected to.
Physically, it consists of 4 electrical contacts located on the bottom side of the Handset
(D+,D-, Gnd, Vin). When Terminal put on its Base, communication is done via this way.
2.2.19 Tamper detection mechanisms
The Handset is equipped with many different means of detection:
•Security features integrated in the Secure Processor, such as active shield, intrusion
sensors, environmental protection systems (Voltage, Frequency, UV and
Temperature) ;
•6 switches are part of the keypad membrane ;
•The secure box is made of a 2-layer grid mesh PCB surrounded with 4 sidewalls (3
soldered to the secure box, the front wall to the keyboard PCB). The secure box is
connected to the keyboard PCB via one elastomeric connector. It defines a secure
area that protects the smart card reader and sensitive components ;
•A I/O of the display device and of the board-to-board1connector conveys a security
signal.
As soon as one of the means of detection triggers (grid mesh cutted or short-circuited,
elastomeric connector or keyboard switch disconnection, abnormal environmental
detection, ….), the Secure Processor goes immediately in security alert, leading to the
1The board-to-board connector conveys signals from the keyboard to the main PCB.

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 1 : DESCRIPTION
Ref: 22000-02-MAN-I-08010 August 2009 Ch.1 - 15/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
erasure of its secret keys, by the way the lost of all sensitive data contained by the Secure
Processor.
Actuators are held in place through the mechanical structure, between the front and the
bottom covers, the whole is maintained in position by screws. Mechanical construction is
designed in order to prevent access to sensitive components.
Note:
When tampering, the Handset shall be put back into operation using the Unlocking tool.
2.2.20 Mechanical element characteristics
¾Plastic is ABS, UL94 HB (2)
¾Other pieces are UL94 HB minimum
Note:
Evolution on going to introduce Handset lid in ABS+PC material (H2 - 2009)
2.2.21 Environment Use
¾Operating
0°C to 40°C (32°F to 104°F), < 90% RH
¾Storage
-20°C to 55°C (-4°F to 131°F)
2Introduction of the handset lid in ABS+PC V0 planned Q4/2009

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 1 : DESCRIPTION
Ref: 22000-02-MAN-I-08010 August 2009 Ch.1 - 16/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
3. Software Architecture
Following diagram describes software architecture on MagIC3terminal
The main processor runs applications and application manager over the operating system
based on an embedded version of Linux.
The operating system ensures a strong fire walling between applications and allows multi-
tasking operations inside each application. It provides communication drivers for serial
ports, Ethernet, Modem and USB devices. The OS completely manages local software
downloading through USB keys, and on the Base through USB keys, USB cable and
remote TCP/IP downloading from the TMS through Ethernet or Modem.
The application manager is in charge of selecting the correct application for each
transaction. It also puts in common transactional services such as currencies, accounts,
total, merchants and messages management. It is up to the AM to handle idle screen and
all terminal management menus to setup terminal date, printer and display contrast, ticket
headers and footers, remote downloading parameters, etc.
The secure firmware is entirely contained in secure processor internal memory. It is in
charge of managing all sensitive devices related to the transaction process (display,
keyboard, smart cards and magnetic cards). The firmware also securely stores and
manages banking secret keys. Numeric and alphanumeric prompts are completely handled
by the secure processor to avoid fake PIN entries, and all messages used to prompt user
for data are authenticated by the secure firmware. This firmware will detect terminal
tampering and attacks and will block security features when such event occurred.
Main processor
Secure processor
Banking applications
Application Manager
Operating system
(based on Linux)
Secure firmware

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 1 : DESCRIPTION
Ref: 22000-02-MAN-I-08010 August 2009 Ch.1 - 17/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
END OF CHAPTER 1

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 2 : TROUBLESHOOTING
Ref: 22000-02-MAN-I-08010 August 2009 Ch.2 - 18/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
II) - TROUBLESHOOTING
1. Introduction
1.1 Methodology
The aim of this chapter is to provide assistance to operators in charge of corrective
maintenance, when the symptom of the failure is not obvious or corresponds to
different kinds of malfunction.
The instructions hereafter will inform on how to operate safely, locate the faulty unit
and identify the failure in a logical way.
1.1.1 Reference (MI)
The references (MI) linked to the troubleshooting procedures relate to procedures
listed in the MAINTENANCE part, chapter 3 of MAINTENANCE MANUAL.
1.1.2 Reference (T)
References (T) relate to the auto-test that can be run with Maintenance Software
MagIC3-Diag (refer to RI [02] for details).
1.2 Safety regulation
When the equipped boards are manipulated, these recommendations must be followed
to prevent electrostatic discharges:
•Use anti-static wrist and anti-static carpet
•Follow all the standard procedures for manipulation of SMD equipped PCBs.
1.3 Special tools and test equipment
• Tools Cross shaped screwdriver Z (Pozidrive) :: PZ1 (diam. Max. 4.5mm).
Flat shaped screwdriver 3 x 75 mm.
Flat pliers.
• Test equipment Golden sample (reference Handset & reference Base).
Magnetic card ISO1/2/3.
SIM card (1 to 2 SIM).
Smart card.
• Diagnosis aid equipment Maintenance Software MagIC3-Diag (refer to RI [02])

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 2 : TROUBLESHOOTING
Ref: 22000-02-MAN-I-08010 August 2009 Ch.2 - 19/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
1.4 Procedure
The troubleshooting operation must always follow the general
procedure below :
¾Make sure the software configuration is coherent and
operational.
¾You are aware of information related to
ELASTOMERIC by reading MI 16.
¾Before opening the Handset, make sure that cables
(power supply and USB device) are disconnected.
The Handset must be put in power off before opening
it.
¾If you open the Handset during repair operation, Get
into the habit of checking the LITHIUM_BAT voltage.
We recommend to change the LITHIUM_BAT if Vbat
< 2,9V (or if it is 3 years old).
¾Always start analyse by checking the
BATTERY_PACK first (§ 2.1).

E-Payment MagIC3M-series Handset - MAINTENANCE MANUAL
Chapter 2 : TROUBLESHOOTING
Ref: 22000-02-MAN-I-08010 August 2009 Ch.2 - 20/35
Copyright Gemalto – 2008 No disclosure to a third party without prior written consent of Gemalto
2. Troubleshooting Instructions
2.1 BATTERY-PACK failure
2.1.1 Symptoms
-The Handset does not boot (absence of any information on the display, no backlight
(display & keyboard) , no “beep” at boot time.
-The Handset boots but it shuts down very quickly.
-The BATTERY_PACK goes flat very quickly.
-The Handset boots but the BATTERY_PACK is not recognized, then the OS keeps
the control by displaying “Unknown Battery”.
When no boot or boot+shut down, the rootcause can be either BATTERY_PACK itself, or some
components of the Handset (charge manager circuit for instance).
2.1.2 Procedure
Battery pack failure Ref.
1. Make sure you reproduce the issue with a reference BATTERY_PACK. T
2. If the failure disappears, change the BATTERY_PACK. MI 17
3. If the failure is still present, change the PCB_MAINBOARD by a new one, MI 13
2.1.3 Battery pack control
Procedure Ref.
1. Check BATTERY_PACK cable and connector.
2. Check voltage Vbat
¾7,2V ≤Vbat ≤8,4V : The Handset must be operational.
¾6,8V ≤Vbat < 7,2V : Vbat is under the AM shut down trigger. The AM goes in
power-off when Vbat < 7,2V.
¾Vbat < 6,8V : Vbat is under the OS shut down trigger. The OS goes in power-off
when Vbat < 6,8V (OS shut down security in case of AM shut down security by-
passed for any reason).
¾Vbat ~ 0V : The BATTERY_PACK is in security state. The handset does not boot
any more. The pack is protected in voltage and current, it goes in security state
upon over charge, or discharge, or current detection. To restore the pack, you just
need to charge it by powering the Handset via the Base or directly via the power
supply. Note that, as soon as charge starts, Vbat increases very quickly over 6,8V
and the Handset boots.
MI 18
3. Put the BATTERY_PACK in charge (even if Vbat ~ 0V) on a reference Handset.
Complete charge must be reached in less than 90 minutes.
4. From MagIC3-Diag main menu (assuming you do not activate any function), a full
charged BATTERY_PACK takes ~ 10 hours to reach the OS shut down trigger.