Money Controls SCH2 User manual

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
This document is the copyright of Money Controls Ltd and may not be reproduced in part or in total by any means,
electronic or otherwise, without the written permission of Money Controls Ltd. Money Controls Ltd does not accept
liability for any errors or omissions contained within this document. Money Controls Ltd shall not incur any
penalties arising out of the adherence to, interpretation of, or reliance on, this standard. Money Controls Ltd will
provide full support for this product when used as described within this document. Use in applications not covered
or outside the scope of this document may not be supported. Money Controls Ltd. reserves the right to amend,
improve or change the product referred to within this document or the document itself at any time.
Money Controls 2005. All rights reserved.

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 2 of 61
Contents:
1. Diary of Changes ........................................................................................................................................... 4
2. Introduction.................................................................................................................................................... 5
3. Safety Note..................................................................................................................................................... 5
4. Mechanical Description................................................................................................................................. 5
5. Mechanical Features ..................................................................................................................................... 6
5.1 Hopper Dimensions ................................................................................................................................. 6
5.2 Hopper Weight......................................................................................................................................... 6
5.3 Coin Size Range...................................................................................................................................... 6
5.4 Coin Capacity .......................................................................................................................................... 6
6. Overall Dimensions ....................................................................................................................................... 7
7. Installation and Removal .............................................................................................................................. 9
7.1 Securing the hopper base........................................................................................................................ 9
7.2 Using the 4mm Holes .............................................................................................................................. 9
7.3 Using the keyholes .................................................................................................................................. 9
7.4 Dismantling the hopper............................................................................................................................ 9
7.5 Hopper Assembly .................................................................................................................................... 9
8. Why Serial ? ................................................................................................................................................. 10
9. Product Features ......................................................................................................................................... 11
10. ccTalk Design Parameters ..................................................................................................................... 13
10.1 Serial Connector Type ........................................................................................................................... 14
10.11 Serial Connector Pinout................................................................................................................. 14
10.2 Auxiliary Connector Type....................................................................................................................... 15
10.21 Auxiliary Connector Pinout ............................................................................................................ 15
10.3 Operation............................................................................................................................................... 15
10.4 Address Selection.................................................................................................................................. 16
10.5 Level Sense Connector ......................................................................................................................... 17
11. Encryption Mechanism ........................................................................................................................... 18
11.1 PIN Number Mechanism........................................................................................................................ 20
12. Power Fail Recovery................................................................................................................................ 22
12.1 Power Fail in Detail................................................................................................................................ 23
13. What happens…? .................................................................................................................................... 25
13.1 What happens after Power Up ?............................................................................................................ 25
13.2 What happens after Software Reset ?................................................................................................... 26
14. Simple Coin Payout ................................................................................................................................. 27
15. Full Initialisation & Payout Sequence .................................................................................................... 28
16. Command List.......................................................................................................................................... 31
16.1 Commands in Detail .............................................................................................................................. 32
17. Power Distribution on a Multi-Drop Bus................................................................................................ 46
18. Electrical Noise - Physical Measures..................................................................................................... 47
19. Electrical Noise - Software Measures .................................................................................................... 47
20. Electrical Specification ........................................................................................................................... 48
20.1 Coin Payout: .......................................................................................................................................... 48
20.2 Product Compliance .............................................................................................................................. 49
20.21 Emissions ...................................................................................................................................... 49
20.22 Immunity ........................................................................................................................................ 49
20.23 Safety ............................................................................................................................................ 49
20.3 Environmental:....................................................................................................................................... 49
21. Maintenance Schedule ............................................................................................................................ 50
21.1 Clearing a coin jam: ............................................................................................................................... 50
22. Fault Finding and Repair......................................................................................................................... 50

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 3 of 61
23. Appendix A............................................................................................................................................... 51
23.1 Conversion Equations & Default Values ................................................................................................ 51
23.2 Limits ..................................................................................................................................................... 51
23.3 Software Reset ...................................................................................................................................... 51
24. Appendix B............................................................................................................................................... 52
24.1 Timing Parameters ................................................................................................................................ 52
24.2 Opto Security Timing ............................................................................................................................. 52
24.3 Hopper Initialisation ............................................................................................................................... 52
25. Appendix C............................................................................................................................................... 53
25.1 ccTalk Interface Circuit ......................................................................................................................... 53
26. Appendix D............................................................................................................................................... 54
26.1 NV Memory Map Description................................................................................................................. 54
27. Appendix E............................................................................................................................................... 56
27.1 Mk2 versus Mk1..................................................................................................................................... 56
28. Appendix F ............................................................................................................................................... 57
29. Appendix G .............................................................................................................................................. 59
30. Appendix H............................................................................................................................................... 60
30.1 Baseplate Dimensions ........................................................................................................................... 60
Figures:
Figure 1: Hopper Dimensions .................................................................................................................................. 7
Figure 2: SCH2 Connector .................................................................................................................................... 14
Figure 3: SCH2 Auxiliary Connector...................................................................................................................... 15
Figure 4: Level Sense Connector .......................................................................................................................... 17
Figure 5: ccTalk Interface Circuit: .......................................................................................................................... 53
Tables:
Table 1: Coin Capacities ......................................................................................................................................... 6
Table 2: Address Selection.................................................................................................................................... 16
Table 3: Command List. ........................................................................................................................................ 31
Table 4: Flag Action Table:.................................................................................................................................... 44
Table 5: Electrical Specification............................................................................................................................. 48
Table 6: Coin Payout Rate..................................................................................................................................... 48
Table 7: Environmental Ranges ............................................................................................................................ 49
Table 8: Maintenance Schedule ............................................................................................................................ 50
Table 9: Fault Finding and repair........................................................................................................................... 50
Table 10: Conversion Equations & Default Values:. .............................................................................................. 51
Table 11: Timing Parameters:. .............................................................................................................................. 52
Table 12: NV Memory Map Description:................................................................................................................ 54
Table 13: Command Set Mk2 versus Mk1:............................................................................................................ 56

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 4 of 61
1. Diary of Changes
Issue 1.0 ....................................................................................................................................................... 25th July 2001
Issue 2.0 ............................................................................................................................................. 28th September 2002
¾Information based on SCH2 Product Manual V1.8.
¾Applied TMWP V3.0.
¾Modification to disclaimer.
Issue 2.1 ........................................................................................................................................................15th April 2003
¾Added note on [ rx bad checksums ] counter after sending an encrypted cctalk command to
another peripheral. (V1.9)
¾Applied TMWP V3.2.
Issue 2.2 ....................................................................................................................................................18th August 2003
¾Changed ccTalk®to ccTalk throughout the document.
¾Added section 20.2 Product Compliance.
¾Changed Figure 2: SCH2 Connector.
¾Added Un-Encryption note in sections 8and 10.5.
Issue 2.3 ............................................................................................................................................... 25th November 2003
¾Added section 10.5 Level Sense Connector.
¾Ammended coin sizes in section 5.3.
Issue 2.4 ................................................................................................................................................... 13th January 2003
¾Appendix E – added Polarisation key information.
¾Appendix F expanded.
¾Reference to slow rise time in section 12.1 Power Fail in Detail.
¾Appendix G added for the ‘unencrypted’ version of the product
¾Header 247 Request variable set: [connector address] is updated continuously.
Issue 2.5 ................................................................................................................................................. 26th February 2004
¾Modified Appendix G to try and make clearer.
Issue 2.6 ........................................................................................................................................................ 30th June 2004
¾Changed footer
Issue 2.7 ........................................................................................................................................................... 3rd Nov 2004
¾Added section 3 Safety Note.
Issue 2.8 .......................................................................................................................................................... 15th Jan 2005
¾Added Appendix H Figure 6: Baseplate Dimensions.
Issue 3.0..............................................................................................................26th January 2005
¾Removed reference to Hardware Reset

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 5 of 61
2. Introduction
The Serial Compact Hopper Mk2 or SCH2 is a serially controlled version of the popular
Compact Hopper manufactured by Money Controls and an updated version of the original
‘Serial Compact Hopper’, now known as the ‘Mk1’ version. The serial interface is ccTalk, firmly
established as a leading, low-speed, device control protocol in the money-transaction industry.
A key feature of ccTalk is its optimal balance between simplicity and security.
3. Safety Note
To meet the requirements for EN 60950 the equipment must be installed according to the
following requirements:-
¾The equipment must be protected by a 3A fuse.
¾The equipment must be supplied from a SELV limited power source.
¾The equipment must be installed in an enclosure but positioned so that it is
external to any fire enclosure area within the main enclosure.
4. Mechanical Description
Each disc contains a number of holes in which the coins are held. The disc is driven via a gear
train, by the motor. As the disc rotates, the coin at the bottom of one of the stacks will make
contact with the ejector fingers. The fingers will move back and, at the same time, the coin will
start to move outwards to the exit slot.
Once the coin reaches the exit slot, the spring loaded ejector fingers will be able to return to
their original position and, in doing so, will push the coin out of the hopper.
An optical coin detector is created by infrared transmitters and photo detectors situated on the
PCB. The infrared light beam is routed across the exit slot via a light guide. When a coin passes
through the exit the light beam will be broken and a coin output signal will be generated.
There are a range of discs, ejector fingers and adjuster plates available to provide optimum
performance for coins within the specified range.

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 6 of 61
5. Mechanical Features
5.1 Hopper Dimensions
The hoppers overall dimensions, mounting arrangement, coin entry and exit points are
detailed in Figure 1. Note that, when used in the side exit mode, the rear of the motor
protrudes from the rear of the casing, within the overall dimensions of the hopper envelope.
5.2 Hopper Weight
570 Grams
5.3 Coin Size Range
Hoppers can be configured to pay out coins in the diameter range 16.25 - 31.0mm, and
within the thickness range 1.25-3.20mm. However, each coin needs to be qualified on an
individual coin basis.
For further information on qualification of coins, please contact Money Controls Technical
Services Department.
5.4 Coin Capacity
The coin capacity of the hopper is between 200 and 1000 depending on their physical size.
Table 1: Coin Capacities
Coin
Diameter
(mm)
Thickness
(mm)
SCH2
STD
SCH2
Extended
£2 28.40 2.50 189 252
£1 22.50 3.10 235 314
50p new 27.30 1.80 282 376
20p 21.40 1.80 459 613
10p 24.50 1.83 349 465
5p 18.00 1.73 679 905
2p 25.90 1.80 316 421
1p 20.25 1.43 652 870
Note: these capacities are subject to a +/- 10% error.

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 7 of 61
6. Overall Dimensions
Figure 1: Hopper Dimensions

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 9 of 61
7. Installation and Removal
Warning: Ensure that the power has been disconnected from the hopper before removal.
7.1 Securing the hopper base
¾Two sets of fixing holes have been provided in the base to allow the hopper to be
secured in a host machine.
7.2 Using the 4mm Holes
¾Drill 4 holes on the centres
¾Dismantle the hopper
¾Place base over holes and fix into position using M3 screws
7.3 Using the keyholes
¾Drill 3 holes in the centres shown
¾Align the 3 holes on the centres shown
¾Insert 3 x M3.5 screws. DO NOT tighten
¾Dismantle the hopper
¾Place base over the back and push far back as possible
¾Tighten the screws to fit the base in position
7.4 Dismantling the hopper
¾Gently pull out the securing clips on the back of the base.
¾Tilt the bowl forward until it is clear of the clips.
¾Slide the bowl forward until the locating lugs are clear of the slots in the base.
¾Remove the motor assembly from the base and disconnect the cable.
7.5 Hopper Assembly
¾Connect the cable to the motor assembly.
¾Lower the motor assembly into the base, ensuring the coin exit is in the desired
position.
¾Locate the lugs at the front of the bowl into the slots at the front of the base.
¾Gently press down on the top of the bowl until the securing clips (on the base) click
into the slots on the bowl.

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 10 of 61
8. Why Serial ?
Coin hoppers traditionally have a simple parallel interface. Common methods for paying out
coins include ‘logic motor control’ whereby a low voltage control signal can be used to turn the
motor on and off, and ‘pulse counting’ whereby a stream of pulses is used to dispense the coins
( one coin per pulse ). In the ‘logic motor control’ method it is up to the host software to monitor
and count coins travelling past the payout optos.
Security for the parallel interface method is poor for a determined hacker. Simply drilling a hole
in the cabinet and applying suitable voltages to the interface connector or cables can be used to
empty the hopper of coins. A hopper with a serial interface is usually resistant to this means of
attack due to the sheer complexity of the ‘dispense coins’ instruction.
Another benefit of ‘multi-drop’ serial is the ability to connect several coin hoppers to the same
wiring harness or ‘bus’. This greatly simplifies the cabling within a machine as multiple hoppers
can be daisy-chained together rather than having to branch out from a central star point. The
number of control signals is usually much less with serial than with parallel. The only control
signal in the ccTalk protocol is a single bi-directional ‘data’ line. It is also possible with serial to
connect in other money transaction peripherals such as coin acceptors, bill validators and card
readers.
The inherent ‘expandability’ of serial allows for a much better level of diagnostics and error
reporting than is available on parallel, if it is available at all. Rather than a general alarm
condition, the difference between a coin jam and a deliberate attempt to fraud the hopper can
be reported externally.
Please Note:-
A version of Serial Compact Hopper 2 is available WITHOUT Encryption.
Please refer to cctalk.org for further information.

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 11 of 61
9. Product Features
SCH2 represents to date the most sophisticated serial coin hopper in the world. Responding to
comments from the leading UK machine manufacturers, Money Controls has designed in an
unprecedented level of security.
The following features are available on SCH2…
¾Coin dispensing security. The serial command to pay out a coin uses a 64-bit encryption
key which changes randomly after each operation. This makes serial ‘cloning’ whereby a
handheld terminal listens to the serial bus and plays back dispense commands a fruitless
exercise. A typical dispense cycle will see a total of 192 bits of random information
transferred across the bus.
¾Payout modes. The hopper defaults to multi-coin payout mode which pays up to 255
coins in a single dispense command. For extra security the hopper can be placed in
single coin payout mode which only allows one coin to be paid out at a time.
¾PIN number security. There is an option to protect the hopper with a PIN number so that
if it is stolen from a machine and plugged into another one it cannot be made to work. It is
the equivalent of a mechanical lock with the machine manufacturer generating and
keeping the key.
¾Opto security. During idling ( no coins being paid out ), the exit optos are randomly
pulsed. If a blockage is seen while driving the opto or a short-circuit seen while not driving
the opto then an alarm condition is generated. During pay out, if a short-circuit is seen
while not driving the opto then an alarm is generated. Blockages are usually caused by
inserting objects into the hopper exit and short-circuits by shining torches or lasers into
the optics.
¾Motor terminal protection. A heavy duty mechanical relay protects the motor terminals by
shorting them out during idle. Any attempt to pay out coins by placing a 9V or 12V battery
across the motor terminals will merely short out the battery.
¾Anti-jam operation. If the hopper experiences a coin jam during a payout sequence it will
automatically reverse in order to clear the jam.
¾Software fuse. If an absolute maximum current threshold is exceeded ( factory pre-set )
then the hopper aborts payout with an error code.
¾Polyswitch protection. The motor driver terminals are protected with a polyswitch for
additional overload protection.
¾Power fail protection. A non-volatile memory keeps track of coins paid out. If power is lost
during a payout sequence then the residual number of coins to pay can be read back
after the machine re-initialises.
¾Unique serial number. Each hopper is manufactured with a unique 24-bit serial number
which cannot be modified by external means.
¾Coin counting. Two counters record the number of coins paid out of the hopper. One is
reset-able by the user, the other is a life counter. Both are implemented in NV Memory.
Continued…

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 12 of 61
¾Data integrity. All coin counter values in NV Memory are stored with a 8-bit checksum to
ensure data integrity.
¾Level plate support. There is an option to fit high or low level plates and the status of
these can be read by the host machine on serial.
¾Remote configuration. Motor parameters such as reversing current and payout timeout
can be changed with serial commands. No changes to electronic components are
required.
¾Multi-drop operation. A number of serial hoppers can be connected to the same serial
bus. Device addresses default to those determined by the wiring harness but they can be
changed in software to any 8-bit value.
¾User memory. 10 bytes of non-volatile memory are available for unrestricted use by the
host machine. There are various security and auditing tasks which could be
accomplished with this feature.
¾Extensive command set. Host software can implement a small or large fraction of the full
command set available depending on the application. Commands are available for
inhibiting the hopper, reading the state of the exit optos, checking the software revision
etc.
¾Diagnostic and error reporting. Full access to diagnostic and error codes are made
available over serial.
¾Code protection. The software is protected with an internal, independent, watchdog
circuit. A ‘crash’ in the software will result in a clean reset of code.

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 13 of 61
10. ccTalk Design Parameters
Refer to issue 4.2 of the ‘cctalk Serial Communication Protocol / Generic Specification’ for an
explanation of the protocol and its implementation on any platform.
This product is configured as…
cctalk b96.p0.v24.a5.d0.c8.m0.x8.i1.r3
In other words…
9600 baud / open-collector interface / +24V supply / +5V data /
supply sink / connector type 8 / slave device / 8-bit checksum /
implementation level 1 / spec. issue 3
The hopper can only operate at 9600 baud.

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 14 of 61
10.1 Serial Connector Type
PCB Connector
2.54mm ( 0.1inch ) pitch 10 way with locking wall
Part No.: Molex 22-27-2101 or equivalent
Figure 2: SCH2 Connector
10.11 SERIAL CONNECTOR PINOUT
Pin Function
1 Address select 3 - MSB
2 Address select 2
3 Address select 1 - LSB
4+Vs
5+Vs
60V
70V
8 /DATA ( ccTalk )
9N/C
10 N/C
Operation can be achieved with just 3 wires…
¾+24V to pin 4
¾GND to pin 6
¾Bi-directional serial data line to pin 8
Pins 4 and 5, and pins 6 and 7, are linked internally. The provision of extra pins is to simplify
the manufacture of a multi-drop cable using thicker wire for the power leads. There can be a
‘power-in’ and a ‘power-out’ pin, and the hoppers daisy-chained..
Note: The hopper can only operate at 9600 baud.

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 15 of 61
10.2 Auxiliary Connector Type
Figure 3: SCH2 Auxiliary Connector
PCB Connector
2.54mm ( 0.1inch ) pitch
Part No. : TBD
Keying Information
10.21 AUXILIARY CONNECTOR PINOUT
Pin Function
1 High Level Plate
3 Low Level Plate
5 Plate Common
2 High Level Link
4 Low Level Link
6LinkCommon
10.3 Operation
To notify the hopper software that level plate sensors are fitted, the link pins should be
connected as follows…
Mode Connections
High level plates only pin 2 to pin 4
Low level plates only pin 4 to pin 6
High & low level plates pin 2 to pin 4 to pin 6
Otherwise, no connections should be made.
The level plates themselves should be connected through the corresponding plate pin ( pin 1
for high level, pin 3 for low level ) and the plate common ( pin 5 ).
1 3 5
2 4 6

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 16 of 61
10.4 Address Selection
The default ccTalk bus address for a ‘Payout’ device is 3. This is the address of the Serial
Compact Hopper if no connections are made to the address select pins (pins 1 to 3) on the
connector.
For applications requiring more than one hopper on the serial bus, one or more of the
address select lines may be connected to +Vs. A total of 8 unique bus address may be
generated in this way, in the range 3 to 10 inclusive.
Table 2: Address Selection.
X = Connect to +Vs (Pins 4, 5)
Address select 3 Address select 2 Address select 1
Serial
Address
3
X4
X5
XX6
X7
XX8
XX 9
XX X10
A number of mating connectors on a multi-drop bus cable may each be wired uniquely to
allow operation of multiple hoppers. Since address selection is done externally, any Serial
Compact Hopper may be plugged into any position on the bus and the host machine will
know which one is paying out a particular coin.
Address determination from the connector is only done at power-up or reset. Changing the
address select lines afterwards has no effect.
Note : Addresses may be changed in software to values other than those in the above
table. Refer to the ‘Address change’ and ‘Address random’ serial commands. These
values are lost at power-down or reset.

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 17 of 61
10.5 Level Sense Connector
Figure 4: Level Sense Connector
Pin Function
1 High Level Plate
3 Low Level Plate
5 Plate Common
2 High Level Link
4 Low Level Link
6LinkCommon
Operation
To notify the hopper software that level plate sensors are fitted, the link pins should be
connected as follows…
Mode Connections
High level plates only pin 2 to pin 4
Low level plates only pin 4 to pin 6
High & low level plates pin 2 to pin 4 to pin 6
Otherwise, no connections should be made.
The level plates themselves should be connected through the corresponding plate pin ( pin 1
for high level, pin 3 for low level ) and the plate common ( pin 5 ).

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 18 of 61
11. Encryption Mechanism
A 64-bit encryption mechanism is used to ensure that an illegal attempt to dispense coins from
SCH2 is a hugely difficult task. The key to this mechanism is a secret algorithm, not published in
this document, which may be obtained from Money Controls after suitable approval procedures
have been gone through.
To show the procedure for dispensing a coin an example is shown here with a ‘trivial’ encryption
mechanism but the overall procedure is the same. Byte values between brackets are shown in
hex.
First of all we pump the random number generator of the hopper by sending 8 bytes of random
data to it…
Command = Pump RNG
Transmitted data : [ 34 ] [ A2 ] [ D7 ] [ 0F ] [ 35 ] [ 17 ] [ 55 ] [ 94 ]
Received data : ACK
This is not an essential step but is useful to broaden the spectrum of cipher keys that are
transmitted along the serial bus and which may be ‘recorded’ by a hacker. As the host machine
is likely to be an AWP machine with a sophisticated random number generator, way beyond the
capability of the hopper microcontroller, we may as well make use of it. Note that the pump
value does not pre-set or ‘seed’ the RNG as that would defeat the security mechanism, but only
scrambles it further. The exact details of the scrambling algorithm will not be documented.
Then we request a key cipher key…
Command = Request cipher key
Transmitted data : <none>
Received data : [ E5 ] [ 88 ] [ 13 ] [ 07 ] [ 46 ] [ FE ] [ 29 ] [ 05 ]
A new cipher key must always be requested prior to dispensing coins. There is no point using
an old copy as it changes after every dispense command. The ‘Request cipher key’ command
itself can be repeated in the event of a communication error and the cipher key will be re-
transmitted rather than regenerated.
Now we combine the cipher key with the number of coins to pay out ( in this example 20 coins
or the value 14 hex ) by tagging it onto the end of the data block…
Non-encrypted data [ E5 ] [ 88 ] [ 13 ] [ 07 ] [ 46 ] [ FE ] [ 29 ] [ 05 ] [ 14 ]
In this case we will assume that the CMF ( Cryptographic Mapping Function ) is simply inverting
all the bytes ( new data = FF - old data ).
Performing this calculation on each of the bytes we obtain…
Encrypted data [ 1A ] [ 77 ] [ EC ] [ F8 ] [ B9 ] [ 01 ] [ D6 ] [ FA ] [ 14 ]
Note that the number of coins to pay out is unencrypted but its value is used in the real CMF.
Now we send that data to the hopper to pay out a coin…
Continued…

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 19 of 61
Command = Dispense hopper coins
Transmitted data : [ 1A ] [ 77 ] [ EC ] [ F8 ] [ B9 ] [ 01 ] [ D6 ] [ FA ] [ 14 ]
Received data : [ 5 ] - example event counter
The next time we pay out a coin the cipher key will have changed, so unless the algorithm is
known, simple command ‘cloning’ will not work.
In practice, the CMF will be far more complex than this example and will require considerable
computing power and a long observation period to ‘crack’. Firing random data at the hopper will
also prove fruitless as there are astronomical odds against a successful code match.
Money Controls is realistic enough to appreciate that eventually the CMF may fall into the wrong
hands whether though huge computing resource or through leaked documentation. We have
embedded into our system an undocumented mechanism for changing the CMF in response to
future industry needs without any change to hardware.
An obvious hack would be to intercept and change the number of coins dispensed by the
‘Dispense hopper coins’ command to a greater value. This has been taken care of in the
security algorithm and will not work.
Please Note:-
A version of Serial Compact Hopper 2 is available WITHOUT Encryption.
Please refer to cctalk.org for further information.

SCH2 Technical Manual TSP016.doc Issue 3.0 – January 2005
Money Controls 2005. All rights reserved.
Page 20 of 61
11.1 PIN Number Mechanism
A PIN number is provided on SCH2 as an optional security feature. By default, units are
shipped without the PIN number mechanism enabled. If this feature is not required or its use
is too restrictive then it can simply be ignored.
By programming a PIN number into the device, if the hopper device is subsequently powered
down or removed to another location then unless the PIN number is known, no coins can be
dispensed. This is another layer of defence against the determined hacker who wishes to
experiment with the encryption mechanism. However it does require the host machine
keeping track of the PIN numbers of any hoppers used in that cabinet.
Various possibilities include…
1. Don’t use a PIN number
Nice and easy that one.
2. Fix the PIN number to the same value always
This can be done but is not very secure. Once the PIN number is known then there is
effectively no PIN number protection on any of the hoppers. It is simple to manage though
and the ‘master’ PIN number is unlikely to be forgotten.
3. Scramble the PIN number and store in the user memory
This is quite a clever idea because it means you can randomise the PIN number on each
hopper and as long as you know how you scrambled it, it can be recovered, unscrambled
and sent to the hopper during the initialisation routine. Security relies on keeping this
scrambling algorithm secret.
4. Log the PIN number versus serial number
As each hopper has a unique serial number then this gives a convenient method of storing
the serial number against a random PIN number in a central database which all the
machines have access too on a network. This is the most secure method because unless
the PIN number transaction is captured on the bus at just the right moment in time, and for
that particular hopper, the only way to obtain the PIN would be by exhaustive searching.
With 4.3 billion combinations at 245ms per guess would take on average 16.7 years.
If you are unfortunate enough to have a hopper for which you have forgotten the PIN number
then contact Money Controls for details of any possible recovery mechanism that we may
have in place at the time.
Continued…..