POS-terminal VeriFone Tranz 460 and its programming

Tomcat

Professional
Messages
2,380
Reputation
4
Reaction score
407
Points
83
Greetings to all.

Today we will talk about equipment that is completely atypical for the retro hardware section. Such devices are quite rare, and there are even fewer people interested in them.

So, today we will tell you about an antique representative of banking equipment - POS-terminal VeriFone TRANZ 460. We will try to collect together all the information on these devices.

bgfshh4sspvrqnecyf_rf_dwavi.jpeg


What am I talking about?​


By googling “VeriFone Tranz” you can find a lot of materials on the topic. Various demos, photographs of internals, even complete reverse engineering of the firmware. But most projects in one way or another involve writing your own firmware and loading it into the EPROM of the terminal, or even disassembling the device and using only part of its components. However, if you prefer this option, links will be provided at the end of the post.

I want to tell you how to write something for this device without losing authenticity, using the manufacturer’s standard software. Along the way, we’ll learn what a typical payment application looked like, how to load the program into a POS terminal, where else were these devices used, except in payment solutions, and much more interesting things.

I also recommend reading this article by comrade begoon: Payment terminal OMNI-395 from the inside.

A little history​


VeriFone was founded in 1981 and is the brainchild of William "Bill" Melton. Its first product was a device that made it possible to verify the authenticity of checks over the phone (hence the company name - Verification Telephone). And already in 1984 the POS-terminal VeriFone ZON was released. Later, other similar models appeared - ZON JR XL, ZON II, TRANZ. They all had a lot in common: a processor from Zilog, a small amount of memory, a vacuum-luminescent segment indicator, an identical keyboard layout. And also the programming technique, which will be discussed in this article. TRANZ 330 and ZON JR XL became perhaps the most widespread and longest-used POS terminals in history: having appeared in the mid-eighties, they completely disappeared only at the end of the 2000s.

Equipment overview​


I was unable to find either ZON JR XL or TRANZ 330. There are quite a lot of advertisements on eBay, but taking into account delivery to Russia, this will not be a very cheap pleasure. In general, many models were produced: TRANZ 380 (with increased memory capacity) TRANZ 380 X2 (with support for two applications and switching between them), TRANZIT and PNC (for working in the local network of a proprietary system), TRANZ 340 (also something near the network) .

I got my hands on the TRANZ 460. It's basically a TRANZ 380 with an integrated printer. There was also a model 420, this is the same modification of the TRANZ 330.

vjbkmxvs_6m-t3uu14mabxg7j6u.jpeg


azocrulzxhbl9ugstqt7ru1twi4.jpeg


The device is in very mediocre condition: after being written off, the device lay on the street in the rain for several days, but the water never reached the electronics, which is very pleasing.

In front of it there is a keyboard and a screen (VLI, for sixteen acquaintances). At the top there is a power indicator and a paper feed button.

There is nothing interesting at the back, just a stamping in the case that acts as a carrying handle. In some modifications of the TRANZ 460, a lead-acid battery was located there for backup power.

lcqrfrsqw8_f14dpog1kkxppsdw.jpeg


At the back there are connectors for the telephone line and power supply (oxidized into rubbish). Initially, the terminal operated on twenty-four volts AC, but experience has shown that twelve volts will also work just fine, and there were no problems even when printing.

kwn1ni-rysp0ly-kaslws7zaxz8.jpeg


Let's sort it out. On the back side of the board there are RS-232 level converter chips and a little bit of discrete logic.

fx83oiblz3vjfcqp21ltxejiyi8.jpeg


Motherboard separately. In fact, the socket contains the Zilog Z180 processor itself. Other microcircuits here include:
  • Z86C1112PSC - microcontroller of the Z8 family;
  • Z84C4006PEC - serial port controller;
  • Z84C3006PEC - system timer;
  • Z84C2006PEC - parallel port controller;
  • 73K224L - modem;
  • OKI M6242B - real time clock.

wriasrmaivhn85paylr0lnhtt-e.jpeg


On the top there is a board with a VLI, a speaker, a keyboard and an F/2F decoder for a magnetic reader. A little higher is the printer.

The magnetic reader is quite simple; it only reads the second track.

3wcjj-izbqxu8drduyghggwgwhi.jpeg


Board with buttons separately. The microcircuit from Micrel is a VLI controller.

uqfdipgkajj3my4vcmpdcsqs7y8.jpeg


On the side there are two RS-232 ports with MDN-8P and MDN-6 connectors. Unlike TRANZ 330, their pinouts are modestly omitted in the manual. The pinout here is:
DTR GND TX
RX CTS RTS
DCD GND

swv320n1hiilju5lulykjuedhca.jpeg


The printer is, of course, a matrix printer. VeriFone sold its own cartridges for it (with its own P/N), but we still found the name of the original one: Epson ERC-09B. A new one was purchased without any problems from Citylink; at the time of writing, they were on sale.

f7erdqceae89tgammdc5ymf-2xy.png


zj6sbwoz6t0ue8jwmlhbwsvlzbu.jpeg


bkjend0_nvhody4kgziovjbyfis.jpeg


New cartridge Cactus CS-ERC09.

bem1ynlb-uophueuaq-v9y2xbf0.jpeg


Remove the plastic cover. The printer here is not a very typical design: the needles in the head are located horizontally. The paper pulling motor is a regular collector. On its shaft there is a worm clutch, designed so that when the head passes completely, the paper moves a distance of one point. A conventional reed switch is used as a head zero position sensor. The gears are coated with a thick sticky lubricant.

First start​


Most likely, your device will have a low battery, so when you turn it on, PROGRAMING ERR0 will light up on the screen . Press Function+1, the terminal should start. Next, press *+3, DIAGNOSTICS will light up , press ALPHA. Set the date and time. Or just press CLEAR, this is enough to initialize the memory and RTC.

If you wish, you can disassemble the device and solder a new battery, otherwise these actions will have to be performed every time you turn on the device.

mog9nttuz5ejthz_4q6yoblomxo.jpeg


Passwords​


It is possible that you will never need this item, but it will not be superfluous to indicate.

Standard password: Z66831 (entered as 1 ALPHA ALPHA 66831 ).

Clearing memory: hold down *+CLEAR, enter the following combination: 8 ALPHA 0 ALPHA 8 ALPHA 5361041 ALPHA ENTER .

There are no other passwords in the terminal (but they may be provided by the firmware).

Menu​


Without firmware, you can use the following functions:
Function+7 - view the contents of memory;
Function+8 - editing memory contents;
Function+ALPHA — change password;
Function+* — download software;
Function+0 — download via modem
Function+# — local download.

Function key combinations with numbers 1 to 6 are not used and can be used in the program.

What did you even write for them on?​


Nope. If you thought there were C compilers for it, you are sadly mistaken. This was not provided for him. As, indeed, for BASIC, Pascal or some other common language. The program for any ZON or TRANZ series device was written in the proprietary TCL (Terminal control language). It, of course, has nothing to do with the more widely known Tcl (Tool command language).

Essentially TCL is a scripting language. The program can be typed directly from the terminal keyboard, although this is very inconvenient. VeriFone itself recommends using its PC software for this, which loads the program into memory. In this case, the interpretation is still carried out by the POS-terminal itself; no actions are performed with the code on the computer.

The language is specially created taking into account extremely small amounts of memory: each command takes one or two characters. This is very inconvenient, and also not at all intuitive, but there was no other choice then.

TCLOAD​


There are three main options for loading software into the terminal.
  • Remote. ZonTalk software is installed on the bank's server. The terminal makes a call to the modem pool and receives the firmware. Actually, this method was the most common: it is enough to place a short instruction with the requirement to enter the phone number and terminal ID, and the user can easily download the firmware himself.
  • Local. VeriFone itself positioned it as an option for developers. The terminal is connected to the computer with a cable (the pinout was given a little earlier), and loading is done using the TCLOAD software.
  • From device to device. Two terminals are connected with a null modem cable, after which one transfers its firmware to the other.

Of course, the second option is of greatest interest. For it we only need a cable, a computer with a COM port and the software itself (of course, under DOS).

Initially, in search of a program, I went to the VeriFone website. More precisely, of course, on its archival copy from the late nineties, where there was a section with materials for ZON/TRANZ. Alas, TCLOAD was not found there, but manuals appeared: user manuals for Tranz, TCLOAD Reference Manual, TCL Terminal Control Language Programmer's Manual. In principle, you can write software for loading the firmware yourself, since the manuals describe the format of data packets and the value of the polynomial for calculating CRC-16. But I wanted to find that same authentic software.

Next I went to Yahoo.com, where after a short search TCLOAD was found.
If anything, it was lying around on the file hosting service 4shared.com, where TCLOAD.DBS was also found - an auxiliary file for this program, which is a database of terminal models.
And this discovery brings us to another area of application of these devices.

What is PunchPlus?​


TRANZ is essentially a programmable controller. Not the most powerful, but ideal for a range of tasks. In addition to payment solutions, it was also used, for example, in facility access control systems or as a time and attendance timer. One such system was PunchPlus from Service Info-Rapide (inforap.com). On its website (if you open the French version) both the original TCLOAD and the TCL file with the program were found. You can download the distribution here: link to the distribution (all links will be duplicated at the end of the post).

The program is designed to work with TRANZ 330, but runs perfectly on any device in this series.

What about banking software?​


Everything is sad. Alas. Local downloading was not common at all, so everything was distributed exclusively via modem. No direct links to download the program text were found.

It should also be noted that the terminals were supplied from the factory with firmware (it is described in the manual for the terminal). For most banks, it was completely suitable and did not need modification. The firmware is easy to read (again, because the format of the data packets is described in the TCLOAD Reference Manual), another thing is that there are no more terminals with the firmware left due to the discharge of the internal battery.

At the time of writing, nothing suitable could be found (but I would be very glad to find something).

However, for those who want to see what this software was like, there is still one option. We will talk about it a little later.

TCL files​


TCLOAD does not require any installation (you just need to drop it into the working folder), and is also not at all critical to the processor (it does not throw errors like Runtime errors at startup). You can even run it in DOSbox with port forwarding. There are also no special operating modes for the port.

The TCL file consists of a header (the model number, without which TCLOAD will not load anything, the list is in the manual) and lines with commands. Each line represents the number of a memory cell, followed by the commands themselves, separated by an equal sign. If you write "$" instead of "=", commands can be written with a line feed, which makes working with the script much easier. Comments separated by a leading semicolon are also supported.

Before choosing a memory cell, open the manual and look at its purpose: some of them are reserved and are not suitable for placing commands or data in them.

So, open the folder with the software, where we create a text document, say, 1111.txt. The name and extension do not matter. We open our file and write there: Connect the device with a cable to the PC, start the download mode ( UNIT RECEIVE should be lit on the display ), enter the command: After this, the file should immediately load into the device’s memory. And after clicking “Cancel”, the line specified in the file will appear on the screen. Of course, this file is not exactly a program. In this file, we simply wrote a line into memory cell No. 30. This is IDLE PROMPT, that is, the line displayed on the screen in idle mode (if left blank, the date and time will be displayed). The meaning of other reserved memory locations can be found in the TCLOAD Reference Manual. In total, the Tranz 380/460 has two thousand memory cells (0000-1999), while the Tranz 330/420 has half as many (000-999). ZON has a total of 478. Each memory cell, depending on the software version in the device’s EPROM, holds sixty or one hundred and twenty bytes, while “extra” bytes are discarded during loading.

%9EAEU123
0030=HELLO WORLD

tcload 1111.txt /t1

zcxlblsbru2rzmffl9kky7otnxe.png


Start of execution​


The starting address for program execution is memory cell No. 981. Any commands can be written in it or redirected to another memory cell. What is written in this cell is repeated constantly. When you press the Clear button and exit the program or when it ends, it will be restarted after N seconds, where N is the number written in cell No. 980. If these two memory cells remain empty, the terminal will simply display the date and time or the IDLE string PROMPT.

The program can also be launched by pressing the key combination Function+N, where N is buttons from 1 to 6. Cells 31-36 are responsible for this. The principle of their use is exactly the same.

In addition to functions, they execute commands and simple keystrokes in the normal state. Cells N07 are used for this, where N is the button number from 1 to 9.

If you do not use any of the specified cells, the program will not work.

Writing the first program​


So, having familiarized yourself with the structure of TCL files, you can write something of your own.
We create a text document and write there something like the following: Load the program, press Function+1. After which something like the following will appear on the screen: Now let’s figure out what’s going on here. Our string is indicated in a separate memory cell. Pressing Function+1 executes command L446 - jumps to address 446, where our program is located (it should be noted that if the program occupies more than one memory cell, at the end of each block you need to specify the address of the next one using the L command). Just in case, I’ll note: the addresses for the line and commands were taken arbitrarily from the list of those for general use, which is in the manual. You can use other suitable ones, this will not cause any problems. At address 446 there is, in fact, a program consisting of the following commands: B.5 - select buffer No. 5; G — delete its contents; A231 - place the contents of memory cell No. 231 (where our line is located) into the buffer; V — display the buffer on the screen; G - clear the buffer. Quite simple, although inconvenient. True, because of such a language, it is absolutely impossible for an untrained user to cope with reading a program of a couple of hundred lines (especially if all memory cells are written in one line).

%9EAEU123
231=HELLO HABRAHABR
31$ L446
446$
B.5
G
A231
V
G

bt2ngsl0or_gelqszrvmnxz_hf8.jpeg


Seal​


Well, where there is a display, there is a printer. And the program, in general, is similar: So, the N command is responsible for printing. In terminals with a built-in printer, the selected buffer is printed, and in instances without one, the buffer is sent to the serial port, after which the Line Feed control character is thrown there. A more correct option would be this: The Z and W commands are also used here (pad the buffer with spaces to align it and pause the program until the end of printing). So, load it, press Function+1, after which OUT OF PAPER will light up on the display, our line will be printed. The N command also uses several arguments here: one indent when printing, print immediately and when printing display PRINTING , if there is no paper, print half a second after insertion (the last argument is the number of seconds / 2). Arguments are separated by dots.

%9EAEU123
231=HELLO HABRAHABR
31$ L446
446$
B.5
G
A231
N
G

%9EAEU123
231=HELLO HABRAHABR
31$ L446
446$
B.5
G
A231
Z40.2
W
N1.1.2
G

zj-qmvd6ynue9sbl4g9cl4yyilu.jpeg


Speaker​


Well, everything here is very, very simple: Argument “0” of the *G command allows you to call a high sound, argument “1” - low.

%9EAEU123
31$ *G0
32$ *G1

Keyboard​


To enter data from the keyboard, there is a command K.
Actually, an example: First, we display the line “ENTER DATA”. After pressing the Enter key, keyboard input will begin to wait. And after confirmation, the entered value will be entered into the buffer and sent to the printer.

%9EAEU123
231=ENTER DATA
31$ L446
446$
B.5
G
A231
V
G
K
N
G

Magnetic reader​


Now let's try to read the card: To enter data from a magnetic reader, there is the M command. You can also use the E command, which allows you to use the magnetic reader or keyboard directly. For example, to provide the ability to enter a number or immediately swipe a card.

%9EAEU123
231=SWIPE CARD
31$ L446
446$
B.5
G
A231
V
G
M
N
G

Preset messages​


Of course, VeriFone understood that a bunch of messages for all menu items would take up a lot of memory, which could be used more efficiently. Therefore, the EPROM contains a number of system messages that can be displayed on the screen using the F command. The full list is given in the manual.

kgevq085nzt9nrxyssrnq0fkvjq.png


DDSTRANZ​


“This, of course, is good, but what to do if such a terminal is not at hand?” - you say. In this case, something can be suggested. A certain DDSTRANZ was discovered in the open spaces - software authored by Dave Dunfield, which is a simulator of a terminal, pin pad and processing center. The free version has some limitations, but is quite suitable for playing with it to your heart's content. Test firmware is also included. To run you will need DOSbox and a program like Virtual Serial Port Driver.

I recorded a video demonstrating the operation of the test firmware:

There is also a demo mode in the terminal itself - press *+3, DIAGNOSTICS will light up on the screen , then press 9.

1zoj9_rz7vur5tcpr0t0enshvvq.png


hy0esxxxk4vnaomrjtmeizwvbdu.png


aonbwvl77rg64yg_knnqtl551ds.png


rw7gpouek6nbma1cz9710kw8ham.png


So what should we do now?​


Actually, all this has no practical application for a long time. The terminals themselves are already quite rare in this country (however, there are still plenty of them on eBay), and they do not have any incredible capabilities. However, it can be interesting to try to write something for them or see how existing firmware is designed.
So it goes.

Links​

 
Top