Embedded Files
Baud rate and CPS
Baud rate and CPS
The Gap between each 10 bit character is around 10 mili seconds...
Which means characters are sent round every 18.5 milli seconds or at 15.4 Hz
CB comments on 297C packets
CB comments on 297C packets
EPROM EXTRACT
EPROM EXTRACT
info from CB
info from CB
297E issue 8
F or PCO set starts at 0F00h
the data is sent out to the phone exactly as it is in the eprom with "baked in" parity.
; 0F00 8A 8A 43 08 C4 8A 8A 8A 8A 8A 8F 0D 8F 8F 8F 8F ..C.............
; 0F10 83 8F 8F 8F 8F 8F 8F 8F 8F 07 8F 0D 8F 8F 85 85 ................
; 0F20 89 02 86 8F 8F 8F 8F 8F 8C 8F 83 8F 8F 8F 8F 8F ................
; 0F30 8F 8F 8A 0D 07 8F 0E 80 80 80 83 80 80 80 8A 08 ................
; 0F40 80 80 8A 8A 85 80 8A 8A 08 8A 8A 86 02 04 01 80 ................
; 0F50 89 85 04 01 80 80 02 86 07 80 89 85 86 07 02 83 ................
; 0F60 02 85 01 01 83 89 08 01 01 83 89 86 07 80 01 89 ................
; 0F70 85 04 01 80 02 89 85 04 01 80 04 89 85 04 01 80 ................
; 0F80 85 89 85 04 01 80 08 89 85 04 01 80 80 80 02 8A ................
; 0F90 08 80 01 83 02 86 07 80 04 83 02 86 07 80 07 83 ................
; 0FA0 02 86 07 80 8A 83 02 86 07 83 08 FF FF FF FF FF ................
; 0FB0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0FC0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0FD0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0FE0 FF FF FF FF FF FF FF FF 32 39 37 45 00 69 73 73 ........297E.iss
; 0FF0 75 65 20 37 00 53 31 38 32 39 42 00 06 91 95 08 ue 7.S1829B.....
DATA IN THE PACKET
DATA IN THE PACKET
297E issue 8
The following data is the observed if its an 8 bit byte with no parity..
8A 8A 8A 43 8 C4 8A 8A 8A 8A 8A 8F 0D 8F 8F 8F 8F 83 8F 8F 8F 8F 8F 8F
8F 8F 7 8F 0D 8F 8F 85 85 89 2 86 8F 8F 8F 8F 8F 8C 8F 83 8F 8F 8F
8F 8F 8F 8F 8A 0D 7 8F 0E 80 80 80 83 80 80 80 8A 8 80 80 8A 8A 85
80 8A 8A 8 8A 8A 86 2 4 1 80 89 85 4 1 80 80 2 86 7 80 89 85
86 7 2 83 2 85 1 1 83 89 8 1 1 83 89 86 7 80 1 89 85 4 1
80 2 89 85 4 1 80 4 89 85 4 1 80 85 89 85 4 1 80 8 89 85 4 1
80 80 80 2 8A 8 80 1 83 2 86 7 80 4 83 2 86 7 80 7 83 2 86 7
80 8A 83 2 86 7 83 8 7F
With 7 data bits and odd parity it look like this..
0A 0A 0A 43 8 44 0A 0A 0A 0A 0A 0F 0D 0F 0F 0F 0F 3 0F 0F 0F 0F 0F 0F
0F 0F 7 0F 0D 0F 0F 5 5 9 2 6 0F 0F 0F 0F 0F 0C 0F 3 0F 0F 0F
0F 0F 0F 0F 0A 0D 7 0F 0E 0 0 0 3 0 0 0 0A 8 0 0 0A 0A 5 0
0A 0A 8 0A 0A 6 2 4 1 0 9 5 4 1 0 0 2 6 7 0 9 5 6 7
2 3 2 5 1 1 3 9 8 1 1 3 9 6 7 0 1 9 5 4 1 0 2 9
5 4 1 0 4 9 5 4 1 0 5 9 5 4 1 0 8 9 5 4 1 0 0 0
2 0A 8 0 1 3 2 6 7 0 4 3 2 6 7 0 7 3 2 6 7 0 0A 3
2 6 7 3 8 7F
The last 7F I believe is from the payphone to the tester to say "rxed ok"
then [OK] and [ENT] dot appears to let us know write went ok
More info form CB
More info form CB
So, in the Issue 8 code there are indeed, as I suspected, four
configuration data sets. These correspond to RCB (renters) 0, 1, 2 and PCO (kiosk).
The four config sets start at 0C00h, 0D00h, 0E00h and 0F00h. I will
refer to them as the C, D, E and F sets. Each appears to have 170 (AAh)
bytes. From the end to the next set is uninitialised, except for the F
set which has the issue strings from 0FE8h to 0FFAh, that is followed by
five unknown data bytes, 0FFBh-0FFFh, 00 06 91 95 08. 00h is commonly
used, e.g. by C, as the end of string marker. The remaining four bytes
could be a CRC/checksum or even a date code or something.... My guess is
that its a 32 bit CRC over the contents of the EPROM not including
itself. This could be used by the code to check itself.
Extract from the end of my dump of your 297E Issue 8 code:
Config sets start at 0C00h, 0D00h, 0E00h and 0F00h
; 0BB0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0BC0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0BD0 FF FF FF FF FF FF FF FF D3 D5 D6 D3 D0 D0 D1 D7 ................
; 0BE0 D4 D3 D7 D0 D3 D2 D2 D2 D7 D2 D2 D7 D6 D3 D1 D0 ................
; 0BF0 D3 D7 D6 D3 D7 D2 D0 D0 D0 10 4A 30 18 14 20 11 ..........J0.. .
; 0C00 8A 8A 43 08 C4 8A 8A 8A 8A 8A 8F 0D 8F 8F 8F 8F ..C.............
; 0C10 83 8F 8F 8F 8F 8F 8F 8F 8F 07 8F 0D 8F 8F 85 0D ................
; 0C20 89 02 86 8F 8F 8F 8F 8F 8C 8F 83 8F 8F 8F 8F 8F ................
; 0C30 8F 8F 8A 8F 07 8F 0E 80 80 80 83 80 80 80 8A 08 ................
; 0C40 80 80 8A 8A 85 80 8A 8A 08 8A 8A 86 02 04 01 80 ................
; 0C50 89 85 04 01 80 80 02 86 07 80 89 85 86 07 02 83 ................
; 0C60 02 85 01 01 83 89 08 01 01 83 89 86 07 80 01 89 ................
; 0C70 85 04 01 80 02 89 85 04 01 80 04 89 85 04 01 80 ................
; 0C80 85 89 85 04 01 80 08 89 85 04 01 80 80 80 02 8A ................
; 0C90 08 80 01 83 02 86 07 80 04 83 02 86 07 80 07 83 ................
; 0CA0 02 86 07 80 8A 83 02 86 07 02 08 FF FF FF FF FF ................
; 0CB0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0CC0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0CD0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0CE0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0CF0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0D00 8A 8A 43 08 C4 8A 8A 8A 8A 8A 8F 0D 8F 8F 8F 8F ..C.............
; 0D10 83 8F 8F 8F 8F 8F 8F 8F 8F 07 8F 0D 8F 8F 85 0D ................
; 0D20 89 02 86 8F 8F 8F 8F 8F 8C 8F 83 8F 8F 8F 8F 8F ................
; 0D30 8F 8F 8A 8F 07 8F 0E 80 80 80 83 80 80 80 8A 08 ................
; 0D40 80 80 8A 8A 85 80 8A 8A 08 8A 8A 86 02 04 01 80 ................
; 0D50 89 85 04 01 80 80 02 86 07 80 89 85 86 07 02 83 ................
; 0D60 02 85 01 01 83 89 08 01 01 83 89 86 07 80 01 89 ................
; 0D70 85 04 01 80 02 89 85 04 01 80 04 89 85 04 01 80 ................
; 0D80 85 89 85 04 01 80 08 89 85 04 01 80 80 80 02 8A ................
; 0D90 08 80 01 83 02 86 07 80 04 83 02 86 07 80 07 83 ................
; 0DA0 02 86 07 80 8A 83 02 86 07 01 08 FF FF FF FF FF ................
; 0DB0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0DC0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0DD0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0DE0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0DF0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0E00 8A 8A 43 08 C4 8A 8A 8A 8A 8A 8F 0D 8F 8F 8F 8F ..C.............
; 0E10 83 8F 8F 8F 8F 8F 8F 8F 8F 07 8F 0D 8F 8F 85 85 ................
; 0E20 89 02 86 8F 8F 8F 8F 8F 8C 8F 83 8F 8F 8F 8F 8F ................
; 0E30 8F 8F 8A 0D 07 8F 0E 80 80 80 83 80 80 80 8A 08 ................
; 0E40 80 80 8A 8A 85 80 8A 8A 08 8A 8A 86 02 04 01 80 ................
; 0E50 89 85 04 01 80 80 02 86 07 80 89 85 86 07 02 83 ................
; 0E60 02 85 01 01 83 89 08 01 01 83 89 86 07 80 01 89 ................
; 0E70 85 04 01 80 02 89 85 04 01 80 04 89 85 04 01 80 ................
; 0E80 85 89 85 04 01 80 08 89 85 04 01 80 80 80 02 8A ................
; 0E90 08 80 01 83 02 86 07 80 04 83 02 86 07 80 07 83 ................
; 0EA0 02 86 07 80 8A 83 02 86 07 80 08 FF FF FF FF FF ................
; 0EB0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0EC0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0ED0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0EE0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0EF0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0F00 8A 8A 43 08 C4 8A 8A 8A 8A 8A 8F 0D 8F 8F 8F 8F ..C.............
; 0F10 83 8F 8F 8F 8F 8F 8F 8F 8F 07 8F 0D 8F 8F 85 85 ................
; 0F20 89 02 86 8F 8F 8F 8F 8F 8C 8F 83 8F 8F 8F 8F 8F ................
; 0F30 8F 8F 8A 0D 07 8F 0E 80 80 80 83 80 80 80 8A 08 ................
; 0F40 80 80 8A 8A 85 80 8A 8A 08 8A 8A 86 02 04 01 80 ................
; 0F50 89 85 04 01 80 80 02 86 07 80 89 85 86 07 02 83 ................
; 0F60 02 85 01 01 83 89 08 01 01 83 89 86 07 80 01 89 ................
; 0F70 85 04 01 80 02 89 85 04 01 80 04 89 85 04 01 80 ................
; 0F80 85 89 85 04 01 80 08 89 85 04 01 80 80 80 02 8A ................
; 0F90 08 80 01 83 02 86 07 80 04 83 02 86 07 80 07 83 ................
; 0FA0 02 86 07 80 8A 83 02 86 07 83 08 FF FF FF FF FF ................
; 0FB0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0FC0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0FD0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
; 0FE0 FF FF FF FF FF FF FF FF 32 39 37 45 00 69 73 73 ........297E.iss
; 0FF0 75 65 20 37 00 53 31 38 32 39 42 00 06 91 95 08 ue 7.S1829B.....
28 May 2025 - TESTER 297 NEWS from CB
28 May 2025 - TESTER 297 NEWS from CB
CB has been doing some excellent work on reverse engineering the CT24/25 hardware and software as well as the tester 297 s/w and h/w.
CB has been doing some excellent work on reverse engineering the CT24/25 hardware and software as well as the tester 297 s/w and h/w.
please see https://github.com/PhotoCB/CDP1802-CT24-25
I have sussed the odd READ 4X requests. They effectively display the
last two bytes of the four fixed datasets. In fact they show the lower
nibble of the second to last byte in digit 6, blank digit 7 then display
the upper nibble of the last byte in digit 8 and the lower in digit 9.
So, 83h 08h in FFA9and FFAA are displayed as "3 08". I have a suspicion
why they do this. The requests are:
READ 40 - reads back last bytes of E dataset
READ 41 - reads back last bytes of D dataset
READ 42 - reads back last bytes of C dataset
READ 43 - reads back last bytes of F dataset
READ 44 - reads back first two bytes of RAM
Yes the order is a bit funky, but it is what it is. It also preserves
some compatibility with 297C which just has E and F datasets. I think E
is the RCB set equivalent to that in the 297C, with the D and C sets
being the extras added in the 297E. The PCO set is thus at F in both
tester versions.
These read commands are in the E firmware only. The C firmware gives
error if you attempt to read any of these.
I suspect they are readback of issue/ID for the datasets. I think, but
have not yet proved, 44 displays the ID of the most recently entered
dataset so you can check you downloaded what you meant to. I think this
is a result of a) the extra datasets and the risk of not being sure
which was downloaded to the phone. b) confirms the contents of the
tester are the intended one for the phone. Of course this is based on a
sample of one so may not be right but I think its likely this, or
something like it is what's going on.
Also I've been thinking. PhONE Day might not necessarily have been the
end for the 297 and the phones that use it. The reason is that all
national numbers started with 0 and so, with an update of firmware, the
leading 0 can be assumed and just the remaining ten digits stored for
the reporting numbers.
Your Tester 297E EPROM is dated 1998, so it WAS in use after PhONE Day.
RCA data codes are, I'm told, difficult to pin down, but most of the ICs
in your 297E appear to be from 89/90/91, making a mid-to late-1991 date
seem about right. My 297E has ICs all from, probably mid-late 1985 but
the box it came in is dated March 1986. This means I need to get in to
your V15 phone firmware to see if its 297E compatible... but not just yet.
Chris
28 MAY 2025
Protocol Notes / History
Protocol Notes / History
The Tester 297 is a handheld programmer for the GPT/Plessy type payphones, but was originally for programming the Coin Telephone 22B
The Tester 297 is a handheld programmer for the GPT/Plessy type payphones, but was originally for programming the Coin Telephone 22B
In December 2019 PE said
In December 2019 PE said
"It was developed by Autelca, Gumligen, Berne (German Speaking Switzerland!) for the Blue Payphone 1 - large stainless steel coin box, with RED LED display showing Minimum Fee, and money remaining etc. This was known as the "Coin Telephone 22A" and was used in London Railway Termini, and a few airports. The phone accepted UK Decimal coins: 2p 10p and 50p (if I remember correctly). Minimum call fee was I think 8p. All these settings were communicated to the telephone from the memory chip in the Tester 297.
When you plugged in a Tester, there was an initiation data exchange. I think the Tester sent ^E (Hex 05) and the payphone responded with a code to say what model it was, what the latest tariff was in its memory etc.
The Coin Telephone 22B came along soon after from Autelca, which was in the same type of metal case, and worked with the Tester 297. The payphone had grey numerals (Liquid Crystal Display) to advise the customer. More widely used than the 22A.
Then the Landis & Gyr Cardphone 1A came along, and was designed to work with the Tester 297. The Cardphone 1C (with colouring of front case and back case reversed when compared with a 1A) also used the Tester 297. There were several thousand of those in service.
Now, we are coming to the Plessey Payphones. The Blue Payphone 2 (Coin Telephone 24 or Payphone 600) had the phone mechanism in its upper box, and the lower box was the cash container. The Plessey payphones were generally designed to work with the Tester 297. There was then the Payphone 500, similar technically, but with less armouring of the case, Intended to be used inside buildings where supervised.
This also used the Tester 297. By now, the Tester 297 could send ^E (Hex 05) or ^F (Hex 06) to say if it had enough tariff memory on board to enable 0800 and other free codes to be called with no money in the coin box. I assume all but the CT 22A were updated to match the later standard.
There was then a cheapened version of the Payphone 600, the coin Telephone 34A, known as "The Low Take". Not sure how that was programmed.
Finally, there were "Table Top" Payphones 100 from AGI in the UK, which had a new memory chip put in (instead of using Tester 297) and the Payphone 200, a wall-mounted version of the 100 design. Plessey made a Payphone 300, being a smaller version of the 500, and that did not need a Tester 297."
Page updated
Google Sites
Report abuse