CA2264667A1 - Modular transaction terminal - Google Patents

Abstract

A portable, hand-held terminal comprises a core unit (30) including a keyboard (42), display (60), a microprocessor and memory, and a plurality of communication modules which can be selectively attached to the bottom of the core unit. The communication device may communicate with a cash register, check reader, computer, printer, modem, cash drawer, or biometric device. A
terminal may be fitted with a magnetic strip reader (68), a smart card reader (80), a printer, a network interface card, and/or a modem.

Description

W0 98/ 10368l01520253035CA 02264667 1999-03-04PCT/US97/15514MODULAR TRANSACTION TERMINALFIELD QE IHE INVENTIONThe present invention relates generally to a transaction terminal apparatus andmethod. More particularly, the present invention relates to a modular transactional terminalsuch as a modular point-of~sale terminal.AC 0 D OF T EN NTerminals such as point-of-sale terminals have many applications. One of the mostcommon is in retail transactions. Frequently upgrades to the software and/or hardware aremade. Moreover, merchants have different functional configuration needs. Variousapproaches have been used to provide for upgrades to the software/hardware andreconfiguration of terminals. However, this typically is a time consuming process and oftenrequires the purchase of new and different hardware and software.There is a need for a modular point-of-sale terminal which readily allows upgrades tobe made and the terminal to be readily reconfigured with different functional capabilities.The present invention solves these problems and other problems associated with existingpoint-of-sale terminals.M T NVThe present invention relates to a modular terminal apparatus and method.One embodiment of the invention relates to a terminal apparatus, comprising: a coreunit including;a processor and associated memory,a keypad for inputting data, anda display operatively interconnected to the processor fordisplaying data;a communications module attachable to a bottom surface of the core unit; andthe core unit and the communications module being interconnected by an electricalbus enabling control of the communications module by the processor of the core unit, thecore unit being interchangeable with various communications modules.In one embodiment, the communication module includes a modem apparatus, themodem apparatus enabling communication with a remote host.In yet another embodiment, the communication module includes a network interfacecommunication board enabling a plurality of the core units and their associatedcommunication modules to be interconnected in a local area network arrangement. In oneembodiment, at least one of the plurality of communication modules interconnected in theSUBSTITUTE SHEET (RULE 25)W0 98/ 103681520253035CA 02264667 1999-03-04PCT/US97/155142local area network arrangement include a modem apparatus, the modem apparatus enablingcommunication with a remote host.In one embodiment, the communication module includes a removable integral printerwhereby information can be printed, the integral printer being electrically interconnected tothe processor of the core unit by the electrical bus.In one embodiment, the communication module includes an electrical connection forinterconnection to an electronic cash register.In one embodiment, the communication module is electrically interconnected to abattery pack.In still one embodiment, the core unit includes a magnetic stripe reader and in yetanother embodiment the core unit includes a smart card reader.In one embodiment, the core unit attaches a PIN pad module for entry of a user's PINduring a transaction.In yet another embodiment, the core unit includes a first electrical bus connectorprojecting from its bottom surface and the PINpad and communication module includes asecond electrical bus connector projecting from its top surface, the first and second electricalbus connectors mechanically and electrically connecting to one another to provide anelectrical bus from the processor of the core unit to electrical components in thecommunication module, the core unit and communication module being attached to oneanother by removable fasteners.Yet another embodiment of the present invention relates to a POS modular terminalapparatus, comprising:a core unit including;a processor and associated memory,a key pad disposed on a top surface of the core unit for entry of a user's PINduring a transaction,a display displaying information,a magstripe reader for reading an encoded magstripe on a card, the magstripereader being disposed proximate one side of the core unit,a smart card reader for reading smart cards, the smart card reader beingdisposed proximate a front end of the terminal, anda bottom surface including an electrical bus connector projecting therefrom;andcommunication module including a top surface having an electrical busconnector projecting therefrom and electrically interconnectable to the electrical busconnector of the core unit so as to create an electrical bus between the core unit and thecommunication module, the communication module including communication controlSUBSTITUTE SHEET (RULE 26)W0 98/ 10368101520253035CA 02264667 1999-03-04PCT/U S97/ 155143circuitry for interfacing with the processor of the core unit by way of the electrical bus, thecommunication control circuitry being electrically connected to electrical components in thecommunication module so as to allow control thereover by the processor of the core unit, thecommunication module being interchangeably connected to the bottom surface of the coreunit by fasteners whereby the core unit may be interchangeably connected to differentcommunication modules, the communication module providing power to the core unit, thecommunication module including electrical connectors for interconnection to an electroniccash register.In one embodiment time division multiplexing (TDM) communication protocol isused to communicate between the processor of the core unit and the communication circuitryof the communication module.Another embodiment of the present invention relates to a tenninal apparatus,comprising:a processor and associated memory;a keypad, operatively coupled to the processor, for inputting data to the associatedmemory;a display, operatively coupled to the processor, for displaying data;a communications module; anda time division multiplex (TDM) bus operatively coupled between the processor andcommunications module to enable control of the communications module by the processor,the TDM bus having at least two different data transfer rate channels multiplexed together ina frame.Another embodiment of the present invention relates to a terminal apparatus,comprising:a display for displaying data;a keypad for inputting data; anda processor and associated memory, operatively coupled to the display and keypad,for processing application program functions in accordance with an operating system displaydriver which allows a first application program to exclusively control displayed elementswithin a first portion of the display and a second application program to exclusively controldisplayed elements within a second portion of the display.These and various other advantages and features of novelty which characterize theinvention are pointed out with particularity in the claims annexed hereto and forming a parthereof. However, for a better understanding of the invention, its advantages, and the objectsobtained by its use, reference should be made to the accompanying drawings and descriptivematter, which form a further part hereof, and in which there is illustrated and described apreferred embodiment of the invention.SUBSTITUTE SHEET (RULE 26)W0 98/ 10368101520253035CA 02264667 1999-03-04PCT/U S97/ 15514BRIEF CR1 TI T DRAWINIn the drawings wherein corresponding reference numerals generally indicatecorresponding parts throughout the several views;Figure 1 is an exploded perspective view in of a preferred embodiment of amodular point—of-sale terminal apparatus in accordance with the principles of the presentinvention, the embodiment shown including a core unit;Figure 2 is an exploded view of a display assembly incorporated within thecore unit of Figure 1;Figure 3 is an exploded view of a magnetic stripe reader incorporated withinthe core unit of Figure 1;Figure 4 is an exploded view of a core unit and a communications moduleconfigured to interface with the core unit, the core unit and the communications module areshown separate from one another;Figure 5 is an exploded view showing the mechanical and electrical interfacebetween the core unit and the communications module of Figure 4 prior to interconnection,the bottom of the core unit is shown while the top of the communications module is shown;Figure 6 is a bottom view of the communications module of Figure 4;Figure 7 is a perspective view of a printer module and an assembled terminalcomprising a the core unit and communications module of Figure 4, the printer is shownwithdrawn from the tenninal;Figure 8 is an exploded view illustrating the inner components of thecommunications module of Figure 4;Figure 9 is an exploded view of the core unit and a PIN pad moduleconfigured to interface with the core unit;Figure 10 is an exploded view of the PIN pad module of Figure 9;Figures 11A-11G illustrate various environments suitable for using amodular transaction terminal constructed in accordance with the principles of the presentinvention;Figure 12 is a back view of the communications module showing the variousserial ports and power port;Figure 13 is a block diagram of the interconnection of a main printed circuitboard to one or more communication boards;Figure 14 is a more detailed block diagram of the main printed circuit boardshown in Figure 13;Figure 15 is a more detailed block diagram of one of the communicationboards shown in Figure 13;SUBSTITUTE SHEET (RULE 26)WO 98/10368101520253035CA 02264667 1999-03-04PCT/US97/155145Figure 16 is a diagram showing one implementation ofa TDM bus havingthree tiers of bandwidth; andFigure 17 is a diagram showing representative interactions between anapplication program and an operating system for the modular transaction terminal inaccordance with the principles of the present invention.DET I ON P R O I TReferring now to the figures, there is illustrated a preferred embodiment of a modulartransaction terminal/apparatus in accordance with the principles of the present invention. Forthe purposes of illustration, the modular terminal is described throughout the specification ina point-of-sale environment and is often referred to as a point-of sale terminal. However, itwill be appreciated that the present invention is not limited to the point-of-sale environmentand can be utilized to conduct a variety of alternative electronic transactions within a widerange of fields.As shown in Figures 1-10, the present invention relates generally to a modular point-of-sale system having both smart card and magnetic stripe capabilities. The system includesa core unit that is capable of interfacing with a variety of modular components. Preferably,the core unit does not have any connectivity capabilities other than connecting to the modularcomponents. Exemplary modular components include printer modules, local area network(LAN), modem modules, workstation communication modules and PIN pad modules. Themodular nature of the system allows the system to be configured and customized to meet theneeds of any user.Figure 1 shows an exploded view of an exemplary core unit 30 constructed inaccordance with the principles of the present invention. Generally, the core unit 30 can bedivided into three sub-assemblies which include a core top cover assembly 32, a core printedcircuit board (PCB) assembly 34 and a core bottom cover assembly 36.As shown in Figure 1, the core top cover assembly 32 includes a top cover 38preferably constructed of a plastic material. The top cover 38 includes a rectangular screenopening positioned above a plurality of key openings. A transparent display window 40 ismounted over the screen opening of the top cover 38 while a key pad 42 is mounted withinthe top cover 38. The key pad 42 is positioned such that keys of the key pad 42 projectthrough the key openings of the top cover 38. The core top cover assembly 32 also includesan overlay 44 affixed to the top surface of the top cover 38. The overlay 44 typicallyincludes defining key functions and other related user information.As shown in Figures 1 and 2, the core PCB assembly 34 includes a core PCB 46having suitable bus structure, memory, and processor which control the operation of the coreunit 30. The core PCB 46 includes contacts for receiving input data from the keys of the keySUBSTITUTE SHEET (RULE 26)W0 98/ 10368101520253035CA 02264667 1999-03-04PCT/U S97/ 155146pad 42. The PCB 46 further includes an interface connector 48, such as a male 20 PINelectrical connector, for allowing the core unit 30 to interface with an exterior modularcomponent. Additionally, the core PCB interconnects with a speaker (not shown) forgenerating an audio output.The core PCB assembly 34 also includes a light pipe 50 affixed to the top side of theprinted circuit board 46. The light pipe 50 is preferably aligned upon the PCB 46 by aplurality of tabs 52 that snap within a plurality of corresponding holes 54 in the PCB 46. Thelight pipe 50 and the PCB 46 are securely connected by a pair of screws 56.It will be appreciated that the light pipe 50 of the core PCB assembly 34 defines aplurality of openings 57 for allowing the keys of the key pad 42 to reciprocally engage thekey contacts of PCB 46. The light pipe 50 also defines a rectangular liquid crystal display(LCD) cavity 58 positioned above the openings 57. A glass LCD 60 is mounted in the cavity58. A pair of zebra connectors 62 are mounted on opposite sides of the cavity 58 between thelight pipe 50 and the LCD 60. A plastic bezel 64 fits over the LCD 60. The bezel 64 and thelight pipe 50 are preferably interconnected via a snap fit connection such that the LCD 60and the zebra strip connectors 62 are securely retained in the cavity 58.The core bottom cover assembly 36 includes a bottom cover 66 preferablyconstructed of plastic and configured to mate with the top cover 38 of the core top coverassembly 32. A swipe style magnetic stripe reader (MSR) 68 is mounted within the bottomcover 66. The MSR 68 includes a MSR track 70 and a MSR head assembly 72. The MSRtrack 70 preferably extends longitudinally along the length of the bottom cover 66 andpreferably is positioned adjacent one side of the bottom cover 66. The track 70 is preferablyconstructed of metal and functions to protect the casing from excessive wear generated bythe repeated swiping of magnetic cards through the MSR 68. As shown in Figure 1, the track70 is positioned adjacent to a right side of the bottom cover 66.The MSR head assembly 72 is preferably mounted within the bottom cover 66 by a bracketmember 74 (shown in Figures 1 and 3). It is preferred for the head assembly 72 to bemounted above the track 70 at a location offset from a inner side wall 76 of the bottomcasing 66. In use, a magnetic card is slid along the track 70 and between the head assembly72 and the side wall 76 thereby enabling the head assembly 72 to read the magnetic strip ofthe magnetic card.The core bottom cover assembly 36 also includes a smart card reader (SCR)assembly 80 mounted within the bottom cover 66. It will be appreciated that the SCRassembly is configured to read smart cards, also known as integrated circuit cards. The SCRassembly 80 includes a SCR PCB 82 snapped within the bottom cover 66. The MSR headassembly 72 is preferably connected to the SCR PCB 82 via connector 84 while the SCRPCB 82 is preferably connected to the core PCB 48 via a flex ribbon cable 86.SUBSTITUTE SHEET (RULE 26)W0 98/10368101520253035CA 02264667 1999-03-04PCT/US97/155147The bottom cover assembly 36 can also optionally include a bottom door 88 foraccessing an optional memory PCB 90 and an optional security PCB 92. The optionalmemory and security PCB’s are preferably connected to the core PCB 48 via zebra stripconnectors 94. The bottom door 88 and zebra strips 94 allow the PCB’s 90 and 92 to bereadily interchanged with alternate memory and security PCB’s. In this manner, the level ofmemory and security provided by the core unit 30 can be tailored to a specific users needwithout requiring replacement of the core PCB 48.To assembly the core unit 30, the top and bottom covers 38 and 66 areinterconnected by screws 93 such that the core PCB assembly 34 is captured between thecovers 38 and 66. As assembled, the interface connector 48 of the PCB 46 projects throughan opening in the bottom cover 66 such that the core unit can be readily interconnected witha variety of modular accessories. Also, the top and bottom covers 38 and 66 cooperate todefine a longitudinal slot 96 for receiving magnetic cards into the MSR 68 and a transverseslot 98 for receiving smart cards into the SCR assembly 80. In the assembled embodimentshown Figure 4, the longitudinal slot 96 extends along the right side of the core unit 30 whilethe transverse slot 98 is. formed at the end of the unit 30 opposite from the LCD 60. It willalso be appreciated that the core unit 30 can be equipped with a privacy shield for preventingthird parties from viewing the keypad 42 and display 60 while the core unit 30 is in use.Figures 4-7 illustrate a communications module 100 configured to interface with thecore unit 30. The communications module 100 and the core unit 30 together provide atransaction terminal such as a point-of—sale terminal. The standalone terminal and LANworkstation will be approximately 4.75” in width, 8” in length, and 3.75” in height. With anintegrated printer attached, the length changes to about 11”. The overall unit is lightweightfor ease of portability.The communications module 100 preferably includes an interface connector 102,such as a female 20 PIN connector, suitable for electrically interconnecting with the interfaceconnector 48 of the core unit 30. The interface connector 102 is preferably located within arecessed upper face of the module 100. The communications module 100 and the core unit30 are mechanically interconnected by inserting the core unit 30 within the recessed upperface of the communications module 100 such that the core unit 30 becomes nested in themodule 100. As the core unit 30 is inserted into the communications module 100, theinterface connector 48 of the core unit 30 electrically interconnects with the interfaceconnector 102 of the communications module 100 to provide an electrical interface betweenthe module 100 and the core unit 30. Screws 104 are preferably used to securely retain thecore unit 30 on the communications module 100.The housing of the communications module 100 preferably defines an open endedslot 106 sized to receive a printer module. The slot 106 is formed between a top portion ofSUBSTITUTE SHEET (RULE 26)W0 98/103681015202530CA 02264667 1999-03-04PCT/US97/155148the housing and the bottom of the core unit 30. A printer connector 1 10 is located at aninterior end of the slot 106 for providing an electric connection between the communicationsmodule 100 and the printer module. When the printer module is not in use, the slot l06 ispreferably enclosed by a plug member 112 that snaps within the slot 106 as shown in Figure4.An exemplary printer module 108 is shown in Figure 7. The printer module 108preferably includes a casing 109 containing a printer mechanism and a printer PCB. Theprinter module is also equipped with a printer roll cover 111.As shown in Figures 5 and 6, the communications module 100 is preferably equippedwith a power plug receptacle 1 13 for connecting the module 100 to power source. The powersource may be a conventional wall plug for in-line uses or a battery pack for off-line uses.The communications module 100 also includes a plurality of connectors such as multi-PINserial ports 114 for allowing the communications module 100 to be readily connected to unitssuch as electronic cash registers, magnetic check readers, external printers, PIN pads, barcode readers, cash drawers and other terminals. The communications module 100 alsoincludes phone line connectors 116, such as phone jacks, for providing phone line access toan internal modem of the module 100 and also for connecting the module 100 to an externalphone. The bottom of the module housing also defines a rectangular recess 117 sized toreceive smart cards. A slot 119 at one end of the recess 117 allows smart cards to be insertedinto an optional secondary smart card reader mounted within the module 100.In a preferred embodiment shown in Figure 12, the power plug receptacle 113 is analternating current (AC) power jack. The 3—prong power jack 113 interfaces with 12 Volt(V) AC power supply with the pinouts shown in Table 1.TllName FunctionAC 12 VACAC 12 VACEGND Earth round. The the serial ports 114 include an RS485 port 180, COM1 182 and COM2 184 portsas well as an optional COM3 port 186 shown in Figure 12.The RS485 port 180 supports such as LAN or IBM electronic cash register (ECR)connection. The POS Terminal has its own power supply and will not draw power from theIBM ECR. This port has a 7 PIN mini-din connector including the following cables: LANterminated, LAN unterminated, IBM RS485 and others. The LAN cable ends in a RJ11connector (at LAN connection) and is the same length as the other LAN cables. It isSUBSTITUTE SHEET (RULE 25)W0 98/ 10368101520CA 02264667 1999-03-04PCT/US97Il55l49recommended that LAN terminated cables be used for workstations placed on each end of theLAN, in order to reduce signal levels on the line. Untenninated cables can be used on allworkstations in between. The IBM ECR cable is the same cable as the PIN pad modulecable, but has a mini DIN connector instead of the RJ 1 1 connector the terminal end. Allcommunication through the RS485 port is restricted to half-duplex. It does not providepower other than a low current network bias supply attached to the internal +5 volt supply.The pinouts for this RS485 port are shown in Table 2.Table 2PIN Name Function1 +5V 5 Volts power.2 GND Signal ground.3 RGND Reference signal ground via 100 ohms.4 RT+ RS 485+5 RT- RS 485-6 LAN termination.7 LAN termination.Sheli EGND Earth ground.The COM1 port 182 is the RS232 port that does not supply power. This will supportdevices that have their own power source, including an external printer, an RS232 ECR, orcheck reader. This port has an 8 PIN mini—din connector. The cables might include cablesfor interconnection to various devices such as; DB9 download/debugger cable; VeriFoneP250 Printer; Citizen Printer; Silent Partner Printer; IVI Check Reader; Magtek CheckReader; Checkmate Check Reader. However, it can be used for alternate attachments such asEC'Rs or check readers. Full-duplex communication with transmit hardware flow control isavailable through this interface. The pinout for COM1 port 182 is shown in Table 3.Stable}PIN Name Function1 GND Signal ground.2 PAPER Printer paper alarm; a high level on this PINindicates that printer paper supply is low or out.3 RTS Output to device indicating that Jigsaw hasselected the RS232 interface and is ready4 CTS Input toligsaw indicating that the peripheral deviceis ready to receive data.5 RXD Received data from a peripheral.6 TxD Transmitted data out to a peripheral.7 ‘ No connection.8 Test No connection.Shell EGND Earth ground.SUBSTITUTE SHEET (RULE 26)CA 02264667 1999-03-04WO 93/10351; PCTIUS97/1551410The COM2 port is the RS232 port that does supply power. This will support a PINpad connection, including the SPP, 290, 290E, and POS Tenninal PIN pad. These require apowered port up to 150 mAmps, unregulated 7-14 volts. This port has a 6 PIN mini-dinconnector. The cables might include cables for interconnection to various devices such as:5 DB9 download/debugger cable; IVI Check Reader; Magtek Check Reader; Checkmate CheckReader. Full-duplex communication with transmit hardware flow control is not available.The pinout for COM2 port 184 is shown in Table 4.labiaFunction(7 — 14) VDC, 150S.Receive data from aTransmit data to a SiNo connection.Earth10The COM3 port 186 is an optional RS232 port similar to COM] port 182. It may beused, like COM] port 182, for interfacing to devices such as a check reader or bar codewand. A pinout for COM3 port 186 is shown in Table 5.15 I.alzL¢_§PIN Name Function1 DCD Control line input from a peripheral.2 RxD Serial data input from a peripheral.3 TxD Serial data output to a peripheral.4 DTR Control line output to a peripheral.5 GND Signal ground.6 DSR Control line input from a peripheral.7 RTS Control line output to a peripheral.8 CTS Control line input from a peripheral.Shell EGND Earth ground.Figure 8 is an exploded view illustrating the internal components of thecommunications module 100. As shown in Figure 8, the housing of the module 100 includesa top cover 118 positioned opposite from a bottom cover 120. The top and bottom covers20 118 and 120 preferable mate together and are interconnected via screws 122. Positionedbetween the top and bottom covers 118 and 120 are an input/output PCB 124, acommunications PCB 126, an optional modem PCB 128, and an optional secondary SCRSUBSTITUTE SHEET (RULE 25)W0 98l10368101520253035CA 02264667 1999-03-04PCT/US97/15514llassembly 130. It will be appreciated that the assembled terminal can function as a wallmounted unit or a hand held unit. Additionally, the base of the communications module 130preferably includes rubber feet for supporting the terminal on a structure such as acountertop.The input/output PCB 124 includes a bus structure and other components suitable forinterfacing with the serial ports 114 and power plug 113. The input/output PCB 124 ismounted at a predetermined position within the housing such that the ports 1 14 align withopenings 132 defined by the bottom of the housing. It will be appreciated that the bottom ofthe housing includes a break-out panel 133 positioned adjacent to the openings 132. Bypunching out the break-out panel 133 and replacing the input/output PCB 124 with a newinput/output PCB having four serial ports (180, 182, 184, 186), the communicationscapabilities of the module 100 can be enhanced as required by a user.The communications PCB 126 includes bus structure and other components suitablefor interfacing with the printer connector 1 10, the interface connector 102, the input/outputPCB 124, the modem PCB 128, and the optional secondary SCR assembly 130. It ispreferred for the communications PCB 126 to be mounted on the top cover 118 and orientedsuch that the interface connector 102 extends substantially vertically through an opening 134defined by the top cover 118, and the printer connector 110 extends substantially horizontallythrough an opening 136 defined by the top cover 118. The input/output PCB 124 and thecommunications PCB 126 are preferably interconnected via ribbon cable 138.The modem PCB 128 includes bus structure and other hardware suitable forinterfacing with the phone line connectors 116. The modem PCB 128 is mounted in thebottom cover 120 such that the phone line connectors 116 align with a pair of openings 140defined by the bottom 120 of the housing. The modem PCB 128 is connected to thecommunications PCB 126 via ribbon cable 142. The ribbon cable connection allows themodem PCB 128 to readily be replaced with an alternative modem board. For example, auser may require an upgraded modem board or may need a modem compatible with one ofseveral different phone systems.The SCR assembly 130 is preferably connected to the communications PCB 126 viaribbon cable 144. The SCR assembly 130 is preferably mounted adjacent the slot 119 in thebottom cover 120 such that when a smart card is snapped within the receptacle 117 andpushed into the slot 119, the card is read by the SCR assembly 130. The SCR assembly 130can be readily interchanged and can have a variety of configurations. In one exemplaryembodiment, the SCR assembly 130 is configured to accept both a smart card and a pluralityof security access modules (SAM). If a user does not require the secondary SCR assembly130 or the SCR assembly 130 is not intended to be used, the recess 1 17 is preferably coveredby bottom panel 146.SUBSTITUTE SHEET (RULE 25)CA 02264667 1999-03-04WO 93/10363 PCT/U S97/ 1551412Figures 9 and 10 illustrate a PIN pad module 148 configured to interface with thecore unit 30. The PIN pad module 148 includes a housing cover l49 having an open top side150 configured to receive the core unit 30 such that the bottom of the core unit 30 mates ornests within the top of the housing cover 149. The PIN pad module 148 includes a PIN pad5 PCB 152 including an interface connector 154 configured to connect with the interfaceconnector 48 of the core unit 30 when the core unit 30 is nested in the housing cover 149.Screws 151 are used to securely connect the core unit 30 and the PIN pad module 148together.The personal identification number (PIN) pads PCB 152 also includes a external10 connector 156 for providing an interface between the personal identification number PCB152 and an remote unit such as an electronic cash register, terminal or other communicationdevice. Preferably, the connection between the external connector 156 and the remote unit isprovided via a coiled cord. It will be appreciated that the PIN pad module 148 functions toconvert the core unit 30 into a PIN pad for transferring data to the remote unit and for15 receiving data from the remote unit.It will be appreciated that the PIN pad resulting from the combination of the coreunit 30 and the PIN pad module 148 has a widened head portion that accommodates the LCD60 and a narrow body portion sized to allow the device to be manually held. The corners ofthe device are preferably rounded and the housing is preferably constructed of a durable fade20 resistant plastic material. Exemplary dimensions of one particular PIN pad embodiment willbe approximately 3.45” in width, 8” in length, and 1.75” in height. The PIN pad can be wallmounted, stand mounted, or placed on a counter.The PIN pad module 148 allows the POS terminal to operate as a PIN pad. Itgenerally obtains power from a host device such as a terminal, electronic cash register25 (ECR), or personal computer (PC). In one embodiment, this module will have two differentcase options, one for bonded units and one without bonding. The embodiment of the PINpad module shown has an RJ1 1 modular connector so that different cables can be attached.This allows a customer, such as a bank, to mix and match cables as needed to connect todifferent host devices. This also allows easy replacement of cables if they break. The cable30 fits securely to the PIN pad and does not cause a security risk (one cannot probe through theport to access the secure processor). The RJ11 connector is easy to connect without specialtools, but cannot be taken out by hand (a screwdriver or similar tool is required to pop out).The cable is attached from the back of the core unit.The PIN Pad Module to ECR cables includes cables for interfacing with the various35 makes of ECRs such as: IBM 4680; NCR 2127 (includes power pack); DB9 RS232 (includespower pack); and DB25 RS232 (includes power pack). In one embodiment, these cableshave a 3" straight section, an 18" coiled section (expandable to 10 feet), and a 5 foot straightSUBSTITUTE SHEET (RULE 25)W0 98/ 103681520253035CA 02264667 1999-03-04PCT/US97/1551413section. The two RS232 cables and NCR cable will also support a power pack at thePC/ECR connector end. The IBM cable does not need a power connector.PIN Pad to LAN Cables include a cable for connection to a LAN with power packand connection to a LAN with DB9 RS232 and power pack.A “Y” cable is needed for connecting the PIN pads together on a LAN. The additionalRS232 connection allows the PIN pad to also connect to an ECR or PC.OVERVIEW OF EXEMPLARY COMPONENTS OF MODULAR SYSTEMThe overall features of the various components and features of the POS terminal willnow be described. It will be appreciated that the POS terminal may take on varyingconfigurations and that the following are but a few of those possible configurations and arenot to be construed as limitations upon the scope of the invention.fizxnadIn the preferred embodiment, the keypad 42 is preferably made up of a 19-keysilicone rubber matte with carbon pills which, when pressed, close etched contacts on themain logic board 46. Twelve keys comprise a telephone style numeric pad. The numeric padconsists of keys 0 through 9, plus a Clear and Enter key. One key has a dual function:normal key entry and wake-up initiated from power down mode. This is accomplished witha dual carbon pill and separate circuit board etching. Four additional function keys areavailable for initiating application specific functions. Three soft keys are located directlyunder the display; these keys correspond to software defined commands on the display.In the preferred embodiment, only the numeric and telephone style alpha charactersare printed on the keys. The key matte will have four different colors. Besides the operatorkeys, the keypad will have an extra carbon contact which is used in conjunction with asecurity tamper circuit. When the case is assembled, this contact is permanently activated. Ifa security option board is installed within the core unit 30, this contact becomes one of theswitches in the series circuit that it uses to detect case opening.DisnlaxThe display 60 is preferably a bit mapped liquid crystal display (LCD) panel. Fontdesign and size as well as graphical images have an open format as long as they fit within the128 x 32 pixel matrix provided. The display technology used is based on a Super-TwistNematic (STN) transflective crystalline structure. A backlight is lightpiped from an LEDsource on the main logic board 46 and dispersed along the underside of the display. Contrastadjustments are made through the use of the main logic board's processor.SUBSTITUTE SHEET (RULE 26)W0 98/ 103681520253035CA 02264667 1999-03-04PCT/US97/ 1551414The LCD 60 is preferably controlled by an LCD controller chip. This chipincorporates the display memory, scan timing functions and segment drivers. It connects tothe application specific integrated circuit (ASIC) of the main PCB 46 through an interfacebus. Within the LCD controller chip is memory that is accessed through the interface busand used by the controller to refresh the image on the LCD. Each bit in this memorycorresponds to one pixel in the LCD. The controller can be written and read through theinterface bus.Each character position within the display is capable of displaying the standardASCII character set. Other application defined character sets, not mentioned above, aredownloadable into the operating system. The display offers bit~mapped graphics forinternational languagesand is backlit for low lighting conditions. The display is flush ratherthan tilted, since it will be used in a variety of environments, such as wall mounted. Thedisplay is yellow/green in color with sufficient character contrast so prompts are easy to read.Main PCBThe main PCB 46 interconnection through a time division multiplex (TDM)bus 300and byte bus 302 to one or more communication boards 124, 126, I28, and 130 is furtherdetailed in a block diagram shown in FIG. 13.The TDM bus is a communication protocol assigning bandwidth for movinginformation on signal lines. The bandwidth is allocated and fixed at specific levels for theentire time the TDM is in operation. The advantages of this bus 300 include: scalability todifferent amounts and types of I/O under a common platform, a reduced number of PINSbeing needed for interconnection to other components in the system. The TDM bus usesmultiple tiers of bandwidth allocation to allocate a high bandwidth for high speed signals andless bandwidth for low speed signala. One particular implementation of this TDM bus is athree tier system which_is shown in FIG. 16.The byte-bus 302 is a transaction based communication scheme which allows forexpandability of system communication and other capabilities. It allows expansion ofprocessor connected peripherals through 2 signal lines, one of which is shared with the TDMbus 300. Some of the advantages of this bus 302 are that multiple peripherals can be directlyinterfaced through only 2 signals lines to the processor which reduces the number ofinterconnections needed in the system and reduces overall electromagnetic interference(EMI) emissions by reducing the number of EMI sources (e.g., signal lines). Anotheradvantage is that additional peripherals can be connected to the Com PCB without disturbingthe core design through modifications to the software drivers for transactions on the byte bus302.SUBSTITUTE SHEET (RULE 25)CA 02264667 1999-03-04WO 98/10368 PCT/US97/1551415An ASIC (Application Specific Integrated Chip) 304, along with the processor, is theheart of the main PCB 46, as shown in FIGS 14 and 15. Virtually all communication betweenfunctional circuit blocks occurs through the ASIC. The ASIC is made up of the followingmajor functional blocks shown Table 8.I_abJ_c_8Functional BlockDescriptionReset and PowerStatusGenerates power fault interrupts, appropriate circuitactivation is based on voltage levels determined by thecommunication module.Display Interface Display controller interface, contrast and backlightcontrol.Keypad/Security Provides direct parallel I/O interface between theCPU I/F keyboard and display and an optional security processor.UARTS Six UARTS are provided with independent baud rategenerators. Optional circuit boards are required to accessall UARTs.CPU Bus Interfaces the CPU bus into the internal ASIC bus.Iinterface Unit Responsible for converting word wide CPU operations(BIU) into byte wide operations on the ASIC bus.MMU/Memory Controls mapping of the CPU's 1MB logical memoryProtection space into a 12MB physical memory space. Alsoprovides programmable write protection on a 4K pagebasis.Memory BIU Responsible for interfacing the ASIC internal bus to theexternal memory resources. Includes programmable chipselects and memory bus timing.Interrupt Manages masking and grouping of internal ASICController interrupt sources and drives the group interrupts out tothe CPU interrupt controller.Beeper InterfaceProvides a speaker on/off control.Magnetic Stripe Translates analog signals from two separate readInterface channels using a digital signal processor (DSP). Theanalog signal is analyzed for peaks. Logical data istranslated from the peaks and transferred into the system.Smart Card Specialized interface to a smart card reader, providingReader Interfacefor clocking and interface between one of the standardASIC UARTs and the smart card. In some situations, thedual card reader option may share a common UART.TDM Channel Time Division Multiplexor Channel. Its function is totime slice the I/O connections between boards andserially transfer the information they contain. This is adual channel circuit used to pass information between theCore, Modem, Com and Printer boards.Byte Bus Bi-directional serial data channel between the Com andChannel Core boards.Test Port Manufacturing/service test access port based on IEEEPl 149.1 standard (JTAG).Core to ComInterfaceThis multi-pin interface connects the Core module andthe Com module. It includes the TDM lines, power,ground, unregulated voltage, high speed UART,NMI/Reset and Wake-up line, Byte Bus, and Beeper.SUBSTITUTE SHEET (RULE 26)W0 98/103681020253035CA 02264667 1999-03-04PCTIUS97/15514l6Virtually all communication between functional circuit blocks occurs through the ASIC.Reset Power StatusThe following three signals are driven by the Comm module to direct systemoperations:Hard reset (HRST)Power fail Interrupt (PFI)Battery status (BSTAT)HRST - This signal is activated whenever the unregulated power is below a levelnecessary to produce +5 volts. When power is applied, HRST willremain active for a limited time after the +5 volts have stabilized.PF] — This signal activates 5ms prior to HRST. This signal can be polled by theCore CPU.BSTAT - This signal is only present on battery operated products. It is passedto the Core unit through the TDM port.Panel InterfaceThe panel interface provides the controls for all of the user interface peripherals. Thisincludes the display, keypad, and audio circuitry. The ASIC 304 provides an externalperipheral data bus to these devices as well and the security processor board. Selection of adevice on this bus is done through the registers in the ASIC. All device selecting and strobingis done manually by the processor using programmed I/O. When securing the product, theoptional security board can take over the data bus. Once active, all peripheral circuits areinaccessible to the 80C186. In this mode, the security processor controls user interfacefunctions. Communications with the 8OC186 is limited to a bi-directional byte port in theASIC.DiipiaxThe display circuitry includes the access controls to the external graphics displaycontroller. Internal to the ASIC is a register used to set the contrast voltage applied to thedisplay. Varying the settings of this register will proportionally adjust the intensity of thedisplay image. Another register in the ASIC controls the backlite illumination around thedisplay. The settings provided by this register can turn the LED backlite on, off, or toincremental settings inbetween.SUBSTlTUTE SHEET (RULE 26)W0 98/ 103681020253035CA 02264667 1999-03-04PCT/US97/15514Aud' r lThe audio control within the ASIC activates an external beeper in the communicationmodule. The beeper is a fixed frequency device.EeltmdThe keypad circuit scans a matrix of 19 keys through a set of row and columnconnections on the PCB. A depressed key can be detected by activating one of the threeASIC row drivers and reading back which of the 8 columns had gone high. The columns arereturned on the peripheral data bus. By decoding the row and column positions, the processorcan determine which key is down. Since the data bus is used by other panel circuitry,scanning the keyboard can only be done with those devices off. Having another device activewhile reading the keypad will not damage the keypad or other device; however, it willcorrupt the returned keypad information. Because the panel bus has a small amount ofcapacitance, the ASIC scan outputs should not be changed and re-sampled faster that 10us.S ri PThe main security board provides access control to the user interface peripherals(keypad, display, etc.). There are two different boards that can be added to the system forsecurity. Each security board is installed through a door on the bottom side of the coremodule. This board is attached to the core through Zebra strip contacts. These contacts andthe board are held in place by the door. Connected through these contacts and through specialconnections on the user keypad matte and on the security board itself is a series circuit whosepurpose is to detect the opening of the case.The first board, already referred to, includes a microprocessor. This board has theability to control these peripherals and communicate with the 80C] 86. It also performstamper detection and manufacturing testing.The second security PCB is a “non-intelligent” board. It provides tamper detectionand manufacturing test, but it does not control the peripherals (the peripherals remain underthe control of the 80C186). Additionally, a small serial memory is incorporated into the non-intelligent PCB to store secured information. This memory is powered by the battery backedsecurity circuit. When processor detects a tamper condition, the OS will erase necessarymemeory within the 80C186 memory space.The controls for both of these boards are generated by the ASIC. These controlshandle data exchanges between the two processors and read/write operations to the serialmemory device.SUBSTITUTE SHEET (RULE 25)WO 98/1036810152025303540CA 02264667 1999-03-04PCT/US97/1551418ritB dWhen opened, this tamper detection circuitry causes the security board to erase allLw velinformation it had in storage in a small battery backed memory device it maintains andpresents a tamper signal to the ASIC.High Level fieourjty BoardAs previously described, the high level security board controls peripherals andcommunicates directly with the processor. Also, it stores keys and performs encryption/decryption.To better manage the power consumed by the terminal, this board also allows theDS5002 to be programmed to turn itself on. Awakening the DS5002 is done by the 80Cl86processor.The DS5002 and 80Cl86 share a bi-directional parallel port through which allcommunications take place. This port includes a set of hardware handshaking signals thatrespond to the read and write operations done by the processors.When opened, this tamper detection circuitry causes the security board to erase allinformation it had in storage in DS5002 and presents a tamper signal to the ASIC.aelP ih sThe panel data bus consists of a bi-directional 8 bit path which can be controlled byeinDeither the 80C] 86 or the DS5002. Transactions on the bus are executed manually byactivating the controls necessary to select, enable or strobe panel peripheral devices. Alldevices on the panel bus have the ability to be both written and read.PANEL Control RegisterThe panel control register provides low level controls to peripherals attached to thepanel bus. A number of these controls are disabled when the ASIC is in the secured mode.The settings held by this register can be read back by the 80C 1 86. The values in the registerare described in Table 9.la_b.L¢£KEYH ENB (Bit 0)This bit is used to enable keyhit interrupts to the 80Cl86. Whenenabled, any high signal on the panel bus will result in a keyhitinterrupt. This interrupt is useful when the panel is in protectedmode and the DS5002 is shutoff. While in this mode, the interfacecan be set with all of the keyscan active. If a key is depressed, thisinterrupt is generated. Setting this bit will enable the interrupt. Ahardware reset clears this bit.SUBSTITUTE SHEET (RULE 25)W0 98/1036810152025303540455055CA 02264667 1999-03-04PCT/US97/15514l9IBF ENB (Bit 1)The IBF enable is used to enable an interrupt generated bythe DS5002 when it reads data from the panel data register.When set this interrupt source is enabled. A hardware resetclears this bit. When the DS5002 is not present, this bitshould remain cleared to prevent unwanted interrupts fromoccurring.OBF ENB (Bit 2)The OBF enables is used to enable the interrupt generated by theDS5002 writing to the panel data port. When set this interrupt sourceis enabled. A hardware reset clears this bit. When the DS5002 is notpresent, this bit should remain cleared to prevent unwantedinterrupts from occurring.DATA ENB (Bit 3)This bit is used to enable the panel data register onto the panel bus.When set, the data register is driven out.SK RST (Bit 4)This bit controls the signal level driven by the ASIC’s SKRST pin.When set, the DS5002 is held in a reset state. Hardware reset will setthis bit.T CAP (Bit 5)This bit is used to reset an internal ASIC latch that captures tampercircuit transitions generated during product test. During normaloperations, this control will not be used since a tamper conditionwill remain latched until the backup battery is removed.P MODE (Bit 8)This bit specifies the operational mode of the ASIC IBF and OBFpins. When this bit is high, and the ASIC is in its non-secured mode,the OBF and IBF pins are driven by the ASIC. The OBF and IBFpins’ polarity are determined by bits 11 and 12 in this register.When P MODE is low, the ASIC OBF and IBF pins are inputs. Inthis mode, these pins can read and enabled as interrupt sources.5002 CS (Bit 9)This bit controls the signal level driven by the ASIC’s SKCS pin,which is used to select the DS5002. When this bit is high theDS5002 is selected. A hardware reset will cleared this bit.DISP CS (Bit 10)This bit controls the signal level driven by the ASIC’s DISCS pin.This pin is attached to the display controller on the core board.When this bit is high the controller is selected. This control is usedfor both reading and writing the controller registers.PAN WR (Bit 11)This bit controls the signal level driven by the ASIC’s PANWR pin.Setting this bit will write data into the DS5002 RPC port or it willenable read data or strobe write data from the display controller.When accessing the display controller, the PAN RD bit determinescycle, reading or writing data. This bit acts as a strobe only. It notfunctionally related to the type of operation.PAN RD (Bit 12)This bit controls the signal level driven by the ASIC’s PANRD pin.This pin is used for reading data from the DS5002 and defining thetype of cycle being issued to the display controller. When set, and5002 CS bit is set (non-secured mode), the DS5002 will output itsdata to the panel bus. When accessing the display controller, this bitshould be set for controller writes and cleared for reads. A hardwarereset will clear this bit.SUBSTITUTE SHEET (RULE 26)W0 98/10368CA 02264667 1999-03-04PCT/US97/1551420PAN ADD (Bit 13)This bit controls the signal level driven by the ASIC’s PANADDpin. This pin is used to select one of the multiple registers in eitherthe display controller or the DS5002. Prior to activating either the5 PAN RD or PAN WR bits, this bit should be set. While in securedmode, this bit is inoperative. A hardware reset will clear this bit.IBF OUT (Bit 14)This bit controls the signal level driven by of the ASIC’s IBF pin.The IBF OUT pin is only an output when the P MODE bit is set and10 the ASIC is in a non-secured state. A hardware reset will clear thisbit.OBF OUT (Bit 15)This bit controls the signal level driven by the ASIC’s OBF pin.When the P MODE bit is set, and the ASIC is in non-secured mode,15 this pin becomes an output whose level is controlled by this bit. ThePIN driver is an open collector style output, an external pull-up isused to establish the high state logic level. A hardware reset willclear this port.Panel Data Path20 The panel data register is used hold data to be written into aperipheral on the panel bus. Since the mode of the panel data buscan change, the selectable peripherals can vary as follows. When theASIC is un-secured, this data can be issued to either the displaycontroller, MISC registers or the DS5002. When the ASIC is25 secured, the panel data register is attached directly to the DS5002not to the other peripherals. The panel data register must be enabledon the panel bus using the DATA ENB bit in the panel controlregister.30 on rol Re ' rThis register is used to select features associated with either the display or keypadoperation. As noted below, this register has four levels to it. Selecting a particular level isdone by specifying it using data bits 6 and 7 in the 16 bit port data word. One half of thisregister is affected by the security setting on the ASIC. If security is enabled, only the upper35 eight bits of this register can be read-none of them can be written to. When not secured, allbits are both read and write—ableEmbedded addressing provides a method of expanding the registers availablethrough the panel bus without adding significant decoding requirement to both processors.The register levels and bit assignments are decoded as follows in Table 10.40Iahlsz_l_QName Function B 7 6MISC 0 Keyscan and audio enable 0 045 MISC 1 Unused‘ 0 1MISC 2 LCD contrast 1 0MISC 3 Backlite and readback pointer 1 1SUBSTITUTE SHEET (RULE 26)W0 98/ 103681020253035404550CA 02264667 1999-03-04PCT/US97l155l421KEYSCAN (Bit O-2) (Misc 0)These three bits provide the column selects for the 19 key keypadmatrix. Each bit ties to one of three ASIC PINs. Each PIN, whenenabled by setting its SCAN bit high, drives a high level to thecolumn of keys it is attached to. When low, the ASIC outputs tri-states. When a key is depressed, it will return a high level to itsappropriate panel data bus bit. Reading the panel data port willreturn the depressed key location.KEYHENB (Bit 3) (Misc 0)This bit enables key detection by the 80C] 86 when the panelinterface is secured. Typically, this feature is only enabled by theDS5002 but since the dual processor mode shares these ports, thisbit is visible to the 80C186 when not secured.AUDON (Bit 4) (Misc 0)The bit controls the activation of the beeper. When set, the ASICwill output a high level on the BEEPER PIN. This PIN is attached toa drive transistor on the communication board whose function is toactivate the self—oscillating beeper.CONT [0..5] (Misc 2)These bits set the viewing angle or contrast for the LCD.KEYPTR [O..1] (Misc 3)These bits select which keyscan register is read when the PANRD3register is accessed.PTR l 0 Register0 0 Key scan and misc controls0 1 Audio volumeI 0 Contrast setting1 lBK LITE[2..4] (Misc 3)These bits select the mode of operation for the backlite circuit.Not usedSDIThis status bit indicates the security state of the panel interface.When high, security has been breached.PROGThis status bit indicates panel buses mode of operation.OBF INThis status bit reflects the state of the OBF handshaking lineassociated with the data port between the 8OC186 and the DS5002.When high, the DS5002 has data available for the 80C186. Whenthe DS5002 is not installed, this bit provides the return data path forinformation from the serial memory device on the low securityboard.IBF INThis status bit reflects the state of the IBF handshaking lineassociated with the data port between the 8OC186 and the DS5002.When high, the 80C186 has written data to the port.T CAPThis status bit reflects the state of the tamper capture register. Thisregister is used when testing the tamper circuit on either the lowlevel security board or the DS5002 security board. This register iscleared by the TCAP ENB bit in the panel control register.SUBSTITUTE SHEET (RULE 25)W0 98/ 103681015202530CA 02264667 1999-03-04PCTIUS97/1551422UARTsThis section describes the six Universal Asynchronous Receiver/Transmitter(UART) channels within the ASIC. Each channel includes a transmit shifter, receive shifter,control registers, status register and baud rate generator. Data is transferred between RX andTX shifting functions independently. This gives each channel full and half duplexcapabilities. All of the UARTs connect to the 80Cl86. Data exchanges can be managedwith either interrupts or polled operations. Additionally, one UART can be programmed totransfer data using the 80C I 86's direct memory access (DMA).Each UART is able to detect framing status, parity, and buffer overflow conditionson the data it has received. Status is collected on a per character basis. For these channels,reading the holding register (16-bit wide) will clear the status flags.UARTS 0,3-5 have transmit flow control which, when enabled and CTS inactive,will prevent the transmit shifter from loading data held in the TX holding register.Characters being shifted will not be affected by CTS inactivating. Disabling the transmitterwill not truncate a character. The RTS enable in the control register is a general purposecontrol--it has no effect on the shifting circuitry.UARTS (0,3,4,5) have a noise filter on the receive serial line. This 3 of 5 vote filterwill prevent serial line noise glitches from starting a false character start bit.The DMA function allows direct transfer of data between a holding register ofUART 0 and memory. The DMA can only be attached to one shifter (80C186programmable, either Tx or Rx buffer). This restricts DMA operations to half duplexexchanges only. DMA can support 8-bit and 16-bit wide transfers on the receive andtransmit. If 8 bit transfers are executed on the receive, the per character status information islost.The DMA circuit has two compare registers which can be used to enable or disabledata transfers based on serial data received. Only compare register 0 can adjust for framesize. With data compare enabled, the 8-bit values loaded into the register are comparedagainst the data transferred into the Rx holding register. The DMA state machine looks for amatch in the holding register only when the protocol bit is set. Once a match is found, allcharacters are transferred until another character with the protocol bit is found; at that point,character transfers are disabled and a DMA completion interrupt is generated. The DMAcontrol bits are found in the upper byte of the secondary control register.SUBSTITUTE SHEET (RULE 26)W0 98/ 10368101520253035CA 02264667 1999-03-04PCT/US97l155l423In the preferred embodiment, the UARTS are assigned the following channels:UART 0 Tailgate/DCN (DMA) Direct connect to Comm and PIN Pad coreboardUART 1 SCR Core ASIC direct connectionUART 2 SCR Comm TDM connect to Comm boardUART 3 Modem/AUX TDM connect to Comm boardUART 4 Pin Pad TDM connect to Comm and PIN Pad boardUART 5 Printer TDM connect to Comm boardThe following data channels can be manually controlled through the TDM registers:UART 1 Core SCRUART 2 Comm SCRUART 3 Modem/AUXUART 4 PIN PadUART 5 PrinterThe TDM output register, when selected to drive these lines, can place the associatedUART output PIN in either a high or low state.'vid r/BThree fractional dividers are supplied to create baud clocks for the Standard andFra ti e Gen r ti 11Smart Card baud rates. The first fractional divider (0) is used to generate the base clock forthe standard baud rates. Its output is brought into a divider to supply all the standard baudrates. The fractional divider should be programmed for the highest baud rate necessary.This configuration will allow all standard baud rates. The second fractional divider (1) isused to generate the baud rates for the core Smart Card UART (l ). The third fractionaldivider (2) is used to generate the baud rates for the Comm module Smart Card UART (2).The outputs are used as the x16 clock for the UARTs.The fractional divider has two registers: an 8-bit schedule and an 11-bitdivider/fraction register. The divider value sets period of the output signal. The fractionvalue is the denominator of desired fraction. The values placed in the divider/fractionregister are one less than the value intended. The schedule value indicates the numerator ofthe fraction.At each Terminal Count (TC) of the fraction reg, the output waveform toggles andinserts an extra PCLK in the timing based on the schedule register. The bit pattern in theschedule register should be evenly dispersed.SUBSTITUTE SHEET (RULE 26)WO 98110368CA 02264667 1999-03-04PCT/US97/1551424The resulting output frequency follows the following formula:F-Min nF = Mn . Md + ZSchedFin = Input Frequency = l2MHzMn = Fraction DenominatorMd = DividerSched = Sum of the Schedule bits10 The Fraction/Divider register bit definitions are:157: - 0: Divider RegisterThis is the whole number part of the divisor. Its value is oneless than the intended value.10: ~ 8: Fraction RegisterThe value placed in this register is one less than thedenominator of the fraction part of the divisor.The Schedule register bit definitions2025307: - 0: Schedule RegisterThe sum of set bits in this register is equal to the numeratorof the fraction part of the divisor. The number of bits usedby the scheduler circuit is equal to the denominator of thefraction. The bits are used from the least significant bit(LSB) on up. The set bits should be evenly spaced in theused bit locations. For example, To generate standard baudrates, an output of l15.2K * 16 = l843200Hz. l2Mhz/1843200 = 6.51. Therefore, Md = 6 (divisor reg = 6 - 1 = 5d(5h)). If 1/2 is used as the fraction, then Mn = 2 (fractionreg = (denominator = 2) — 1 = 1). The schedule registerneeds 1 one—bit in the lower 2 locations (Sched = 1),therefore, the schedule reg = xxxxxx01 (or xxxxxx10). Theresulting frequency is calculated as:SUBSTITUTE SHEET (RULE 26)W0 98/103682025303540CA 02264667 1999-03-04PCT/US97/1551425(l2M * 2)/(2 * 6 + l)= 1846154with (l 843200/1846154) * 100 = 99.84% accuracy (.l6%error).Common Values:FDO, Standard Baud Rates: div/frac = l05h, sched = 01h(. 1 6% error)FD], Smart Card Baud Rate: div/frac = 505h, sched = lFh(. 1 3% error)CPU BIUThe CPU BIU is a circuit used to connect the 80C1 86 to its memory and 1/0. Thedata path components translate the 16-bit processor bus to the 8-bit memories. Thistranslation circuit includes a prefetch queue that fetches the contents of the next memorylocation when a code fetch bus cycle is executed. Since the memory interface is 8 bits, thisqueue provides close to 16 bit performance. I/O devices within the ASIC should only beaccessed as 16 bit registers unless otherwise specified.There are three different levels of performance delivered by the 80C] 86 processor.These levels are controlled by a combination of the processors internal wait state circuitryand the ASIC. The first level is established by the processors internal wait state generator.After reset, this circuit forces each bus cycle to have a minimum of 3 wait states.Performance will remain at this level until the application changes the setting of theprocessor chip select registers. Once disabled, the ASIC will control the length of the buscycles. Table ll listed below indicates the different cycle lengths for various 80Cl86 busexecutions. Before enabling the ASIC mapper and que circuits, the processor chip selectregisters must be disabled from influencing bus cycle lengths.Iahl§_1.lI/O 8 bitsI/O 16 bitsMemory read 8 bits0 wait states0 wait states0 wait states(odd or even)Memory read 16 bits 2 wait statesCode fetch 8 bits 0 wait statesCode fetch 16 bit queue match 0 wait statesCode fetch 16 bit queue mismatch 2 wait statesIt will take two cycles for the queue to fill after it has been enabled. Eight bit codefetches force the queue to purge. Refilling takes two cycles before a match can be made.Once the queue is enabled it cannot be disabled. DMA bus cycles operate under the sameconstraints as the listed CPU cycles.SUBSTITUTE SHEET (RULE 26)W0 98/10368101520253035CA 02264667 1999-03-04PCT/US97/1551426MM!1zErotectjgn SelectsThe memory management unit (MMU) provides programmable mapping of theCPU's 1 Megabyte (MB) logical address space to a 12MB physical address space. The MMUis built around a programmable lookup table that is indexed by the upper 4 address linesfrom the processor. The contents of this table create the extended address and provideselections for the six devices connected to the eight bit memory bus. The extendedaddressing provides up to 2MB of linear space for each of the six devices. From the 4processor address lines, 16 table entries are created. Each entry provides 64K bytes of accessto the device it selects and the extended address selects one of 32 - 64K segments in thatdevice. The mapper has two of these programmable tables. They are selected through themap control register. From power up the MMU is disabled. While disabled, its outputs areforced to select only the boot FLASH device and provide access to its upper 64K segment.From power-up the mapper tables are undefined. prior to enabling the MMU, these tablesmust be initialized.The MMU also provides protection tables that give the operating system the abilityto lock areas of memory from write operations. These tables are also indexed by the upper 4processor address lines. Like the mapping tables, there are two protection tables. The oneselect bit in the map control register selects both map and protection tables. Each bit in atable entry corresponds to one of 16-4k byte segments found in the indexed 64K space.When a protected area is written to, the MMU will generate a non-maskable interrupt (NMI)interrupt and block the write cycle from occurring. DMA operations are not affected by theprotection circuit. These bus cycles can write into protected space without experiencing NMIinterrupts or the failure to store information.Table initialization takes place through independent I/O ports to the mapper andprotection circuits. A table pointer is provided to index the 32 locations in each circuit. Thispointer can be set to any one of the 32 table entries. Each write or read to the associated portwill cause the pointer to advance. The next port access will be to the advanced location.Since this pointer is shared, the mapper and protection tables must be initializedindependently. It would be fatal if an access to one table port was followed by an access tothe other. The resulting condition could produce incorrect table information to be written.When the corrupt table is used, the processor will lose its execution sequence.A Map Control Register controls operations of the MMU. The contents of thisregister are detailed in Table 12.SUBSTITUTE SHEET (RULE 26)CA 02264667 1999-03-04wo 98/10368 PCT/US97/1551427ablMMU ENB (Bit 0)This bit is used to enable the memory management unit. Once set,5 the chip selects, write protection and extended address lines will1520253035activate as instructed by the contents of the MMU tables.PTR LD (Bit 1)This bit is used to preset the initialization table pointer. A low tohigh transition on this bit will load the pointer with the PTR bitsfrom this register. Setting the PTR bits and transitioning this bit canoccur in the same output bus cycle. A hardware reset will clear thisbit.MAP SEL (Bit 2)This bit selects which of the two map and protection tables is used.Low selects PTR entries 0-15, high, select 16-31. The selected tableis taken after this output cycle finishes. A hardware reset clears thisbit.QUEUE ENB (Bit 3)This bit enables the prefetch queue circuit. A hardware reset clearsthis bit. Once the Queue is enabled, only a hardware reset will turn itoff.PTR 0-4 (Bits 8-12)These bits specify the preset value to be loaded into the tablepointer. See PTR LD bit description in this register.abl nt rr t tro eThe PIC is used to manage the interrupts presented to the 80C186. These sourcesinclude both maskable and non-maskable functions. The maskable interrupts are combinedand passed through the PIC and to the appropriate IRQ input on the processor. Mask controlsfor these interrupts are located in the control registers for those particular functions. All non-maskable interrupts are maskable through the PIC's control register. The PIC does notprovide any interrupt prioritization. Statusing both the maskable and non-maskable sourcescan be done through the two PIC status registers. These registers provide both latched andnon-latched signaling for the NMI sources and, non-latched signaling for the non-maskablesources. Clearing a latched NMI source requires applying the appropriate mask. Keeping anNMI mask active will block that interrupts source.SUBSTITUTE SHEET (RULE 26)W0 98/ 1036810202530354045CA 02264667 1999-03-04PCT/US97/1551428Interrupts generated by the maskable outputs connect to the 8OC186 IRQO-3 lines.These signals will require the 80C 1 86 interrupt controller be placed in level mode interruptoperation. To clear the interrupt line, the program must satisfy the source making therequest. Refer to the appropriate section to determine how this is done. Besides the externalinterrupts from the ASIC, the 8OC186 has the following internal interrupt sources tomaintain.Timer 0,1,2 -DMA 0,1 -These sources share a common interrupt controller channel but they vectorto a unique handler location. The three timers share a common priority andmask. Each timer has an enable bit in its control register. In our design, thesetimers are for general purpose use.The DMA controller can be programmed to interrupt the processor upontransfer count depletion. Each DMA circuit has its own interrupt channelwith separate vector and mask bit. Within the DMA control register is aninterrupt enable bit. The DMA terminal count interrupt is whenever a singlebyte is transferred by the Tailgate/DCN UART, or the max transfers haveoccurred while swiping a card.Operations of the PIC are controlled through the PIC Control Register details ofwhich are found in Table 13.Table 13PF ENBThe power fail enable will allow power fail interrupt to generate anNMI. Setting this bit will enable this source to generate an interrupt.The power fail capture enable bit (bit 7) must be set to first capturethe power fail signal. Hardware reset clears this bit.CSER ENBThe Chip select enable allows a program access error to generate anNMI. A program access error is caused by the 8OC186 accessing apage which the mapper has specified as inaccessible. The GNU bitin the mapper select table enables this protection. Setting this bitwill enable this source to generate an interrupt. Hardware resetclears this bit.WRER MSKThe Write protection mask prevents a write protection error fromgenerating an NMI. A write protection error is caused by the8OC186 writing to a mapper protected segment of memory. PO..15 inthe mapper protection table selects this protection. Setting this bitwill mask this source from generating an interrupt. Hardware resetsets this bit.PF CAPTURE ENABLEThe power fail capture enable allows the power fail signal to becaptured. This bit must be set to allow the power fail capture andNM] circuit to be affected by the state of the power fail line.SUBSTITUTE SHEET (RULE 26)W0 98/ 1036810I520253035CA 02264667 1999-03-04PCT/US97/1551429Status of the various PIC operations can be accessed through a PIC Status register 0and PIC Status Register 1S “R cThis section describes the programmable interface and electrical support for the twosmart card readers in the product. The core smart card reader, which is always available, isdirectly controlled by PINs on the ASIC. The Comm smart card reader is also controlled bythe ASIC, but it is remotely attached through the TDM interface. The Comm reader is onlyaccessible when the TDM circuit is running. Both readers share common control and statusregisters and complement each other. Both readers are capable of supporting serial memoryand microprocessor cards. The UARTs for these readers are not described in this section.Refer to the UART section for detailed description of their operation.Serial Memory CardsWhen working with serial memory cards, you must switch the interface to themanual operating mode. To program the SCR interface for manual operations, you must setthe CMX bit in the SCR control register. When set, the constant clock source is blocked andthe CKO bit setting is passed to the card clock PIN (note the CKO bit is also found in theregister). To manually control the data line, the appropriate UART must be programmed toset or clear the output as necessary.The UART output is gated by a transmit enable that is used to control data directionbetween the ASIC and the card. Controls for the UART line level can be found in the UARTcontrol register. When reading a bit from the card, the same UART receive line can besampled. There is a status bit in the UART status register that reflects the state of the dataline. When communicating with these cards, data is typically sent synchronously; that is, onone edge of the card clock new data is either issued or returned. QamWhen compared to the serial memory cards, the microprocessor card has a muchhigher level of sophistication. These cards communicate with their host using somewhatstandard asynchronous frame formats. Also, they require a free running clock to activatetheir internal processing mechanism. When selected, the ASIC provides the servicesnecessary to interact with these cards. Selecting the fixed clocking mode (CMX in the SCRcontrol register) will enable the free running clock source to the card. The associated UARTprovides all of the controls necessary for bi-directional communication, various frameformats, and automatic parity acknowledgment and re—transmission.SUBSTITUTE SHEET (RULE 26)W0 98/ 10368101520253035CA 02264667 1999-03-04PCTIUS97/1551430This means that during transmission (Tx), the UART will check the state of thereceive (Rx) line. If a low Tx/Rx line is detected, indicating the card detected a parity error,the UART will re—transmit the char and interrupt the processor. If a high Tx/Rx line isdetected, the UART will transfer the next char from the Tx buffer into the shift register andinterrupt the processor. The advantage of this is that the UART is able to handle some of thelow level error detection rather than passing this off to the processor. During Rx, if theUART receives a char with a parity error, the UART will enable the Tx driver and drive theline low. The received char is transferred to the Rx FIFO with a parity error indicated.QriflfllionEach card acceptor has a card present contract that is brought into the ASIC tocontrol the card power circuit and provide status to the 80C186. The status from this contactcan be enabled as an interrupt source to the 80C] 86. Once enabled, an interrupt is generatedwhen the card is removed from the acceptor. Likewise, the reset, clock and data lines arelowered, and the card power circuit is turned off (provided they are not already off). For the80C 1 86 to activate card power and enable the drive to the other contacts, it must debouncethe present contact--making sure the card has come to rest in the acceptor (this is a polledoperation). Once stable, power can be applied by setting the PWR bit the SCR controlregister. This bit is an edge-sensitive enable; transitioning it from low to high will activatethe power circuit. If the card is removed while this bit is set, power is forced off (with the bitremaining set). Power status can be qualified by reading the FLT and SW bits in the SCRstatus register.Diagnosing the Qard AcceptorTo assist in problem solving, each card contact can be read back through the ASIC.This includes the RST and CLK PINS which are normally only outputs. The FLT status fromthe card power circuit provides an indication of overcurrent, out of regulation, or thermaloverload conditions. If the FLT was read low (when it should be high), it is important thatthe other card contacts are cleared immediately. Before activating any other card control,good power status should be read.Operations of the core SCR can be controlled through a SCR Control register(SCRWR) which is detailed in Table 14.Table 14SCR] CMX (Bit 0)This bit selects the manual verses fixed clock mode to the card.When high, the fixed clock is output on the CLK PIN from the ASIC(remember, the clock will only be driven after card power isSUBSTITUTE SHEET (RULE 25)W0 98/1036815202530354045CA 02264667 1999-03-04PCT/US97/155143]applied). When low. the CKO bit determines the level output fromthe CLK PIN. A hardware reset clears this bit.SCR1 RSO (Bit 1)This bit determines the reset level output on the ASIC RST PIN afterpower is enabled. If power is disabled, the ASIC RST PIN is low. Ahardware reset clears this bit.SCR] PWR (Bit 2)This bit controls the card power once the card contact has activated.A low to high transition on this bit will enable the card powersupply. Because the card contact gates this bit, being high does notnecessarily mean power is on. A hardware reset clears this bit.CR1 CKO (Bit 3)This bit specifies the level that is driven out of the ASIC, CLK PINwhen the CMX bit is set and power is enabled.SCR] IENB (Bit 4)This bit is used to enable the interrupt from the card contact. Whenthe card is removed, and this bit is set, the 80C186 is interrupted. Ahardware reset will clear these bits.SCR1 DWN (Bit 5)This bit controls the clamp used to crowbar the card power supply.The clamping circuit improves the card inactivation time. When thisbit is cleared, the clamp is on. Before enabling the power, make surethis bit is set. A hardware reset will clear this bit.Status of the SCR can be obtained by accessing the SCR Primary Status Register andSCR secondary status register. The comm SCR control including the SCR/SAMmultiplexing is controlled through the byte bus by the secondary ASIC 306 shown in FIG.15.DMA ControlThere are two DMA channels within the 80C 1 86 processor that will typically beused to transfer data between memory and the Tailgate/DCN serial channels and the MSRand memory. Operation of the 80C186 DMA channels requires programming both a sourceand destination address into their control registers. For memory to I/O transfers, this requiresprogramming the I/O port address. These channels can also be used for memory to memorytransfers.A§IC IDThe ASIC will provide a unique ID for every revision it goes through. The 8 bits ofidentification are found in the Interrupt status register.TDM InterfaceThe TDM serializer provides bit level data exchange between the core andcommunication boards. This serializer runs constantly when enabled to reconstruct theinformation being transferred. For the most part, the majority of this information is static. ToSUBSTITUTE SHEET (RULE 26)W0 98/ 103682025304045CA 02264667 1999-03-04PCT/US97/1551432better utilize the serializer’s bandwidth, the frame has been sub-divided into three levels ofperformance. Listed below in Table 15 are the three levels and their associated hardwareassignments. A visual representation ofthis 80 ms frame is shown in FIG. 16.Iable 15High speed frame 1.25 us update rateCH OUT IN0 SCR2 TXD SCR2 RXD1 MOD TXD MOD RXD2 PP TXD PP RXD3 PRN TXD PRN RXD4 M SPEED SLOT M SPEED SLOTMedium speed slot (M speed) 10us update rateCH OUT IN0 SCR2 DIR EXT] INT1 SCR2 CLK SCR2 CLKIN2 PRN RTS PRN CTS3 PP RTS PP CTS4 MOD TST SCC INT5 TBD1 EXT INT6 TBD2 SCR2 SW7 S SPEED SLOT S SPEED SLOTSlow speed slot (S speed) 80us update rateCH OUT IN0 SCR2 PWR SCR2 FAULT1 SCR2 CLKMX RTC DIN2 MOD TALK MOD IN-USE3 TBD3 PRN PAPER4 SCR RSTO SCR2 RSTI5 RTC CLK AUX DSR6 RTC RST EXT2 INT7 RTC DOUT EXT3 INTIt should be noted that frame update rates are based on a 4 MHz serialization clockrate and would be different if the clock rate were changed.The top level services devices that have the highest switching rate. Within thehighest level, one of its time slots is assigned to the medium level attachments. For everypass through the high level, one medium bit is transferred. Likewise the medium level hasone bit assigned to the lowest level. After all high, medium and low level bits have beensent, one frame pulse is generated.Once the TDM is enabled it will take time to frame periods before data startsupdating at the receiving end. This delay should eliminate spurious data from entering thehardware attached to the TDM registers.At power up the TDM port is disabled. It should remain disabled until the coreapplication has determined the type of device it is attached to. This can be done by readingthe TDM status register and branching on the setting of the TINO input. If this input is high,the device attached has the TDM circuitry and TDM port can be enabled If the input is low,SUBSTITUTE SHEET (RULE 26)W0 98/ 1036815202530354045CA 02264667 1999-03-04PCT/US97/1 551433the TDM port must remain inactive. Without the TDM port, the Core directly drives two ofits UARTs out over the TDM signals.Operations of the TDM bus can be controlled thorugh TDM Control Register whichis further detailed in Table I6 and a second TDM Control register detailed in Table 17.Table I6CTLO (Bit 0)This bit can be used as a general purpose output when the TDM is disabled and theMODE and TDM ENB bits are low. The ASIC TCLK PIN follows the setting of thebit. A hardware reset clears this bit.MODE, TDM ENB (Bit 1, 2)The following defines the function of these two bits. A hardware reset clears both ofthem.Function MODE TDM ENB FRAME TCLK BBD TDMI TDMObit bit PIN PIN PIN PIN PINMan out 0 O CTL1 CTLO PRN RXD SCR2 TXD SCR2 RXDInput 0 I pulldown pulldown PRN RXD SCR2 TXD SCR2 RXDTDM 1 1 0 0 O 0 0TDM 1 0 FRAME TCLK BBD TDMI TDMOpulse pulseMOD TLK (Bit 3)Modem talk control.RTC CLK (Bit 4)Real Time Clock. On the slave/secondary ASIC, this signal is usedto clock data into an out of the RTC. Data is input to the RTC on therising edge of this control. Data is output from the RTC on thefalling edge.RTC RST (Bit 5)Real Time Clock reset. This signal resets and initializes the RTC.When low the RTC is reset and it will ignore all other control inputs.RTC DOUT (Bit 6)Real Time Clock data out. This open collector signal presents data tothe RTC. When low, a low is seen on the RTC bi-directional dataPIN. When high, the data PIN is pulled up by a resistor. Data writtento the RTC must be presented before the RTC CLK is raised.CTLI (Bit 7)General purpose output. This control is output only able when theMODE setting low.MOD TST (Bit 8)Modem Test control.Status of the TDM can be obtained from a TDM status register and a TDM Statusregister.SUBSTITUTE SHEET (RULE 26)WO 98/10368202530354045CA 02264667 1999-03-04PCTIUS97/1551434bllENB SCC,IPTR,EXTl -3These controls are used to enable the interrupts from their applicablesource. When set, the interrupts are passed through to the processor.A hardware reset will clear these bits.B te sThe byte bus is a clocked bi-directional interface used to send high level commandand status information between the core and Comm modules. All bus operations throughthis port are initiated by the core. A bus cycle begins by the core transmitting to the commmodule. As part of this cycle the comm module returns a response. The bus cycle is madeup of 55 clocks. These clocks are associated with 32 bits of information transmitted by thecore. 18 of the bits are returned by the comm, and 5 bits are for line coordination. Thecomm module detects an incoming frame by the reception of the sync field. The pattern ofthis field is unique to the high level idle state of the bus. The frame bit assignments are asfollows:CORE SYNCCORE ADDCORE CMDCORE DATACORE CHECKLINE CONDITIONLINE TURNAROUNDCOMM READYCOMM TX ErrorCOMM DATACOMM CHECKLINE TRI—STATEv--0006--Iv-l\)t~JOOOOl\)O\O6The definition of these bit assignments is detailed in Table 18.Ial2l9_1_8CORE SYNCThe sync field is used to enable the comm receiver to the incomingframe information. This pattern is equivalent to a 81H.CORE ADDThe address field is used to select a byte bus peripheral. This fieldcan address up to eight devices.CORE COMDThe command field identifies the type of I/O operation that theselected peripheral is to perform.CORE DATAThe data field transfers data to the selected device.CORE CHECKThe core check character is an 8-bit CRC used to validate the datasent by the core. This check character is matched by the commandSUBSTITUTE SHEET (RULE 26)W0 98/ 103681015202530354045CA 02264667 1999-03-04PCT/U S97/ 1551435returned as a communication transmission error if it is incorrect.This error code is returned in the same bus cycle.LINE CONDITIONThe line conditioning bits force the level of the bi-directional line toa high state. This conditioning overcomes a possible low level floatstate left by the check character output. Once the line conditioningbits have been issued, the pull—up on the bus will keep the line at ahigh level. Conditioning is necessary since a constant high returnedby the comm module will generate error (check character failure). Ifthe line were left to float up, it might not return high by thebeginning of the comm module’s response.LINE TURNAROUNDThese bits are used as padding to allow the core transmitter to turnoff andthe comm transmitter to turn on. During this interval, theinfomiation on the bus is invalid.COMM READYThis bit indicates the comm ASIC is ready for another transaction.COMM TX ERRORThis bit informs the core that the transmission just sent did notvalidate correctly. Before acting on this setting. The comm checkcharacter must be validated. If the check character is good, thevalue of this bit can be used; if bad, the entire operation is inquestion.COMM DATAData returned by the comm is in response to either the priorcommand or the general status. A valid check character must bereceived before this information can be used.COMM CHECKThe comm check character is an 8-bit CRC used to validate theresponse from the comm module. If this check fails, a system errorresponse should be issued to the operator. Any attempt to recoverfrom this error should assume that the last command issued did notexecute correctly. Recovery includes issuing a soft reset commandto the interface.LINE TRI-STATEThis is the end state to a bus cycle The comm module will releaseits drive on the bus. The core is able to start a bus cycle wheneverthe bus is not busy.For a device in the comm module to request service one of the four TDM interruptsources can be programmed to interrupt the core processor. This interrupt request istransferred through the TDM port. In response, the main PCB will have to query the commperipheral to determine its needs. The comm module cannot initiate a byte bus cycledirectly.The byte bus interface is a single 16-bit read/write port within the 186's I/O space. Itis used to access byte wide peripherals within the communications module. A byte bustransmission is initiated by the processor writing to the byte bus I/O port. A complete writeor read cycle to or from a peripheral is executed within the byte bus cycle. The byte busfront end has a five deep command first in first out (FIFO) buffer for queuing up Byte BusSUBSTITUTE SHEET (RULE 26)W0 98/10368102025303540CA 02264667 1999-03-04PCT/U S97! 1551436instructions. This FIFO should be used only for consecutive writes to byte bus peripherals.The byte bus port is defined as follows in Table 19.T le 1WRITE - Control portBfig Description15-10 Peripheral Address: A5 - A09, 8 Byte Bus Command: read, write or reset7-0 Byte Bus Data: Data to be written to a byte bus peripheral.READ - Status portBxt_e n12 Tx FIFO full: The five deep FIFO is full and cannot accept additionalcommands.l 1 Byte Bus Idle: The byte bus cycle is complete. Data has been written or canbe read.10 CRC error: The CRC check failed on the packet received from the .communication module. The returned data is invalid.9 Tx error: The communication module reports a CRC failure on the packetreceived from the core module. No Byte Bus peripheral cycle wasexecuted.8 RFU:7 - 0 Data: Data returned from a byte bus peripheral.The magnetic card reader 68 is preferably a swipe style magnetic card reader capableof reading cards encoded with data conforming to ISO 7811-4 for IATA (Track 1, 210 BPI)and ABA (Track 2, 75 BPI) tracks, and ISO 7811-5 for the THRIFT track (Track 3, 210BPI). Of the tracks listed, only two can be installed in a product. Configurations are: Tracks1 & 2; andTracks 2 & 3.Software and hardware will preferably support card swipe speeds between 5 and 45inches per second. Thereader life is roughly 300,000 passes. The only ongoingmaintenance required is periodic head cleaning to remove oxide buildup. If a card is put inon top of the magstripe head, the head will not be damaged and will still read future cardsreliably. The reader will also preferably have the ability to read high coercivity magstripecards.IC Card ReaderThe system/terminal can preferably have up to two IC card readers. The Core unit 30will preferably always have the card reader 80. The second reader 130 can optionally beadded to the communication module 100. Both card readers 80 and 130 will conform to theISO 7816 specification. Card clocking is set by the AISC or manually clocked by themicroprocessor of the main board 46. Communication data rates are adjustable to conform toSUBSTITUTE SHEET (RULE 26)W0 98/ 10368l01520253035CA 02264667 1999-03-04PCT/US97/1551437the clock rate. For most microprocessor cards, serial data is exchanged using a typicalasynchronous 10 or I 1 bit format with parity. Detection of improper parity is done by thehardware. If a parity error is detected, the hardware can be configured to re~transmit thesame data. To ensure glitch free operations all driven card contacts are switched using acommon clock source. The affected signals are the power, clock, data and reset. To powerthe card, the interface uses a disable-able linear regulator. This regulator maintains aconstant voltage to the card and, at the same time, it checks for error conditions. Theseconditions include overvoltage and undervoltage, over current and over temperature. A faultdetected by the regulator is returned to the microprocessor.Each card acceptor has a card insert contact. This contact must be made beforepower can be applied to the card. If this contact is broken while the card is powered, thehardware will immediately turn off all driven card contacts including the linear regulator.For diagnostic purposes all driven contacts can be readback. This permits detection offoreign materials placed into the terminal.Since the two card readers are independent, different card types can be read simultaneously.Both card readers expect CR80 card form factors.The embodiment of the POS terminal shown herein includes a standard type of smartcard reader, with a second smart card reader option on the communication modules. Thesesmart card readers are preferably contact readers which do not read contactless cards. Thestandard smart card reader is located at the front of the core unit for easy card insertion bythe operator. The standard IC card reader has a life of preferably about 200,000 inserts,while the second IC card reader has a life of preferably about 10,000 inserts. The standardcard reader will accept the following card specifications: Microprocessor cards (Contact,IS() position, T=0, T=1, meets Europay/MasterCard/Visa (EMV) specifications) and Serialmemory cards. Preferably the smart card reader will read a number of serial memory cards,including the following: GemPlus 416, Thompson ST1305 (without VPP), GemPlusGPM896, and Siemens .E2PROM serial memory cards.The 2nd smart card reader will accept the same microprocessor and serial memorycards specified for the standard smart card reader. Preferably both the smart card readershave a slight card securing mechanism (so the card does not fall out or terminate transactionwhen the POS terminal is bumped) and has a perceived "click" so customer knows card isinserted properly. It is a half insert reader with the card visible at all times. It preferablyincludes error handling software (following EMV and 7816 specifications). The POSterminal will withstand a drop from 48 inches onto the card when card is inserted into POSterminal. The reader has card power management according to the EMV specification. Thecard can be removed by a consumer without special tools if power is lost.SUBSTITUTE SHEET (RULE 26)W0 98/ 10368101520253035CA 02264667 1999-03-04PCT/US97/1551438The optional 2nd smart card reader is located on the bottom of the communicationmodule. This will read a standard size card. There is an optional security door that coversthis reader. This will be used by merchants who do not want the 2nd smart card readeraccessible by consumers. The door can only be opened by inserting the tip of a smart cardinto a small hole next to the reader. When both smart card readers are installed, they can beread “simultaneously” with non-multiplexed ports. Additionally, the 2nd SCR can also holda plurity of SAMS which are multiplexed to a UART through the byte bus and TDM bus.Pmte_rThe printer 108 is a user installable module that can be optionally attached to therear of the Communications module 100. Although the printer 108 can employ a variety ofconventional printing techniques such as dot matrix or laser printing, it is preferred for theprinting process to be done thermally. In the preferred embodiment, printed receipts exit themodule's enclosure from the top of the unit. A serrated tear bar, built into the printerenclosure, will assist in removing forms. Within the printer module 108 is the printingmechanism, printer drive circuit board, and a paper roll. The enclosure is designed around atwo piece ABS plastic assembly. There is space within the enclosure for a 2-inch paper roll.Motor and print head controls, as well as temperature sensors, are part of the printerPCB. The comm board 126 has the control circuits that advance the motors and activate andregulate the print dot thermal process. Power for the printer comes from the communicationmodule 100. The printer PCB and comm board 126 are connected through a card edgeconnector 110. If the printer mechanism fails while it is printing, it can be removed withoutcausing damage to either the control or communication boards.The printing process is preferably done one vertical column of eight bits at a time.The activation and timing of this process is managed by the secondary/slave ASIC 306 onthe Communication (or Comm) board 126. When a row of dots requires printing, thesecondary ASIC serially shifts the necessary data into the printer module print head andturns on the print head power. The activation time varies based on prior bit activity and theprint head and ambient temperature measurements. Upon completion, the print power isturned off and the secondary ASIC advances the head to the next column. This sequencecontinues until an entire row has been printed. At the end of a row, the paper is advanced andthe printing process continues in the reverse direction.The microprocessor of the core PCB 46 is involved with issuing data to be printedand head activation duration. It also controls head and platen advancement by clocking thestepper motor drive circuits on the printer control board. The temperature measurements aresent back to the core microprocessor as well as a head home sensor. In the embodimentshown, there will be two paper roll options. The small paper roll option is 82 feet long andSUBSTITUTE SHEET (RULE 25)W0 98/ 1036810I520253035CA 02264667 1999-03-04PCT/US97/1551439will print approximately 125 receipts (assumes 2 copies of each receipt). The large paperroll option is about twice as long and should print approximately 250 receipts. They bothhave the same 2 1/4” width paper. To fit each size paper, there are two paper roll coveroptions. These snap on easily for replacement purposes.Since this is a thermal printer which can only print on one ply paper, a secondreceipt copy will need to be printed for the customer copy. The paper feed capability will behandled through software. The typical duty cycle will be a 40 line receipt (a 20 line receiptprinted twice for a customer and merchant copy).In environments needing higher speed or other printing functionality, an externalprinter can connected through an RS232 port. In this case, the integrated printer need not bepresent. The POS Terminal might also include a high speed integrated printer.M_€JJ].QE¥The POS terminal memory is made up of a combination of both static random accessmemory (SRAM) and Flash. SRAM is generally used for data that changes (ie. batch data,negative files, application working space). Flash is generally used for the application codeand operating system. This is done for performance reasons--Flash is fine when readingdata, but slower than SRAM when changing data. Flash is less expensive than SRAM,which is why it is preferred for constant data.Since the operating system is in SRAM or flash memory, it can be downloaded to aPOS terminal remotely, without having to physically replace EPROM chips. In oneembodiment, the operating system is approximately 128K in size, with the remainingmemory available for applications and data.Memory can be configured to meet specific application requirements. Thisconfigurable memory is in addition to the memory present in the core PCB. In oneembodiment, memory is expandable up to 3.7MB. For the unbonded POS terminals,memory upgrades can be done by service technicians in a depot environment. For bondedPOS terminals, the POS terminals must be sent back to the factory (or service locations ifthey have bonding equipment).Circuit FeaturesIn the preferred embodiment, an audio transducer allows for an audible beep,activated through software control and used mainly for error conditions. This is not a fullspeaker with multiple tones for use in modem communications. An external speakerattachment might also be used. A real time clock and battery is used in all communicationmodules except the PIN pad module.SUBSTITUTE SHEET (RULE 26)W0 98/ 10368101520253035CA 02264667 1999-03-04PCTIUS97/1551440QonnegtivityA local area network (LAN) capability allows connection of several devices in amulti-lane environment. The POS Terminal might be used in a peer to peer LAN. Theterminal will be able to handle either positive or negative polarity. In one embodiment, up to31 devices can be connected within 3,000 feet of cable. Peripherals supported includeexternal PIN pad, external printer, check reader, bar code reader, and signature capturedevice. The peripherals are preferably connected through a RS232 serial interface. The POSterminal will support connectivity to the IBM 4683 ECR through either a RS232 or RS485(high speed tailgate) interface. It will attach to other ECRS, such as NCR 2127, through astandard RS232 interface.The POS terminal will support two types of ECR connectivity. In semi-integrationconnectivity the sale amount is transferred from the ECR to eliminate duplication entry onthe POS terminal. The receipt information is also sent to the ECR for printing. The terminalstill handles all EFT communication. With total integration connectivity, the ECR handlesEFT communication to the host. The POS Terminal simply handles customer data entryfunctions, such as card acceptance, confirmation of amount, and PIN entry.The PIN pad version will be able to support an RS232 ECR connection and RS485LAN connection at the same time. This will allow the ECR to send transaction data directlyto the PIN pad, which processes the data, sends it off to the host via the LAN, and returns aresponse back to the ECR. A "Y“ cable with power pack might be used for this purpose.ECR interface will be available for various Models of ECRs including the IBM4680, the NCR 2127, etc. The POS terminal PIN pad will emulate the NCR 4430 PIN pad.In one embodiment, it will emulate 12 of the total commands available on the 4430, whichare the most common PIN pad functions.A Multiple Emulation PIN Pad Application (MEPPA) interface is also available.This includes both the Visa command set for DUKPT and the extended command set forMaster Key Session Key. This emulation will allow the POS Terminal PIN pad to connectto various existing terminals. Visa is also a common protocol used to communicate withRS232 "PC type" ECRs.M_QQ_u_|aLiI¥The user or merchant should be able to attach and disconnect the integrated printerand battery pack without needing a service technician. A service technician will be neededto attach/disconnect the communication modules or add memory using special handlingtechniques. If the unit is bonded, the unit cannot be disconnected and must be sent back tothe factory for upgrades or repairs. Also, through a service contact, the modular pieces ofthe OS can be updated through a remote communication link.SUBSTITUTE SHEET (RULE 26)WO 98110368l01520253035CA 02264667 1999-03-04PCT/US97/1551441TelecommonicationsThe standard modem on the communication module supports asynchronouscommunication. The enhanced communication module supports synchronouscommunication. The base modem handles at least 2400 baud, with fallback ability tocommunicate at 300/1200. A typical 256K application should be able to be remotelydownloaded at 2400 bps within 15 minutes.ProcessorOne embodiment of the POS terminal core unit has a 80Cl86 processor and whichruns at 12 Mega}-Iertz (MHZ). It has the capability of performing DES/RSA encryption andhas tamper detection and bonding (PIN pad only) options. There is also a high securityversion of the core unit, which in one embodiment has a Dallas 5002 secure chip in additionto the 80C] 86 processor. This might be used for environments where very high security isrequired, such as PIN encryption in Canada and some parts of Europe. This version willgenerally have tamper detection and be bonded for tamper evidence.Agency CeflificationsThis POS Terminal will preferably be certifiable to meet the following standards:Safety: UL 1950 Listed (U.S.)C222, No. 950 (Canada)TUV EN 60950 (European)Electromagoetic Compatibility; "CE" Mark (Emopoao)Telco: Terminal hardware shall be designed to be registered under the rules for devicesconnecting to the public switched telephone network in the U.S., Canada, and othercountries as required (Canada-IC CS03 for auto dial, IC CS02 for leased line andU.S.-FCC Part 68).A surge protector is recommended to protect against lightning strikes in areas proneto this.Qperating SystemIn the preferred embodiment, the operating system is characterized by multi—taskingavailable at the application level, a flexible development environment with Unix-likeinterfaces and support for C language applications. Multiple applications will be supportedin the same terminal. The different applications can be downloaded separately and areSUBSTITUTE SHEET (RULE 25)W0 98/10368l01520253035CA 02264667 1999-03-04PCT/U S97/ 1551442protected from each other. The operating system supports interchangability of terminals onthe LAN.The workstation will be designed to remember its last default settings--address,printer, other peripherals, etc. On power up, the terminal is designed to auto-install andconfigure from the gateway. Memory overwrite protection on 4K maps for static RAM isincluded.The operating system (OS) consists of a set of objects. Each object is a sub systemof the OS. For example, a particular DISPLAY or a download protocol are objects.Furthermore, each object performs OS work through member functions (alternately justfunctions). A member function is an operation on an object: for example, read ( sc_CARD, )is a member function that reads data from the selected sc_CARD object.This approach allows various operating system models to be built with differentobjects to fit within the same memory constraint. Alternately, several memory constants canbe defined to allow families of operating system models. For example, four OS models (onefamily) can be created that act the same except for different download protocols, as well asanother two models (a second family) that act the same except one model can download witheither protocol A or B, and the other with either protocol C or D.The preferred embodiment OS includes the following identified classes of OSobjects:Input/output deviceskeyboarddisplaytoneclock calendarms__cardsc_cardmodem I/Oserial I/Oprintercommunication layer (e.g., network interface card (N IC))debuggerdiagnosticsdownloader and protocolOS kernel.user interface (e.g., director)SUBSTITUTE SHEET (RULE 26)W0 98/10368I520253035CA 02264667 1999-03-04PCT/US97/1551443Each particular class of objects may have one or more objects; for example, there may betwo display objects because there are two different types of display hardware. Even withthis difference, there can be some functions that are the same for similar objects.Other benefits accrue with this object approach. For those familiar with the ObjectOriented methodology, encapsulation occurs as a by product. Encapsulation hides theinternal workings and data from other object. It permits access only through well definedexternal operations, i.e., member functions. Encapsulation reduces coupling, and henceincreases reliability.Besides previous definitions for objects, classes, and member functions, two otherterms are defined, including interface and vectoring:Interface is the code and data structures set in place to transfer to an OSobject from the application or another OS object, as well as return to originalcaller.Vectoring is one means of transferring control. Vectoring uses addressespre-stored in the interrupt vector locations starting at location zero.Vectoring OS accesses an address with a jump (JMP) instruction forperformance reasons, rather than an interrupt (INT) instruction.Also defined are two data structures, ObjectTable and FctTable:The ObjectTable is an array of far pointers located in the OS data area. Eachfar pointer is the starting address an OS object, which consists mostly of anobject's member functions. The OS object's starting address is obtained byindexing into the ObjectTable, using the object index (which is usually set toa multiple of four for indexing far pointers). To make error checking easier,far pointers to a dummy object, which always return SYSERR, are stored inthe ObjectTable for non-existent objects.A FctTable data structure is an array of near pointers located withineach object. Each near pointer is the offset of one of the OS object'smember function. The member function's starting address is obtained byindexing into the FctTable, using the function index (which is usually set toa multiple of two for indexing near pointers). To make error checkingeasier, near pointers to a dummy function, which always return SYSERR,are stored in the FctTable for non-existent member functions.SUBSTITUTE SHEET (RULE 26)WO 98/10368l01520253035CA 02264667 1999-03-04PCT/US97/1551444Two types of calls within the OS can be done: intra-object and inter—object calls.Intra-object calls are calls within the same object and are translated as near ( l 6 bit) calls.lnter—object calls are calls from one object to a different object. Since each objectwill be linked separately, access to other object's member functions can not be done at linktime. Instead, they will be dynamically linked by vectoring to an OS function (and returningback to the preceding OS function). This is accomplished as follows:1. OS code -> OS stub functionThe OS code first pushes any parameters on the stack. Then it calls the "OS stubfunction". For example, there could be a wait( ) or read( ) OS function called:call _waitcall _read2. OS stub function -> Function table jump codeThe OS stub function, representing the OS function, is linked into the first object'sspace with the OS library, os_fcts.lib to satisfy the linker. On entry, a register is first set tothe index member function index.There are two cases depending whether the OS call is for device input/output or not.If it not a device input/output call, the object index is used as is. If it is a device input/outputcall, the first parameter'(the device descriptor number) becomes the object index. Then theaddress of the OS object is detennined by indexing into the ObjectTable with the objectindex (modified for far pointer indexing, that is, multiplied by four). In both cases, controltransfers to the function table jump code.Case (2a) non—device input/output:_wait proc;mov ax, OFCT_INDEX__FOR_wait * 2;jmp ObjectTable+(OBJ_INDEX__FOR_os * 4)];_wait endp;Case (2b) device input/output:_read proc;mov ax, OFCT_INDEX_FOR_read * 2;jmp go_io;_read endp;SUBSTITUTE SHEET (RULE 26)W0 98/ 1036810I5202530354045CA 02264667 1999-03-04PCT/US97/1551445go_io proc;mov bx, sp;mov bx, word ptr ss:[bx+4];shl bx, 2;jmp ObjectTable[bx];go_io proc;3. Function table jump code -> Actual OS functionThe function table jump code transfers to the actual OS function by using themember function index-into the object's FctTable. The function tablejump code is requiredto be at the start of each object, followed by its FctTabIe containing near pointers (offsets) toevery externalized member function. This implies that all member functions of an object arecontained in one segment (64K maximum). The function table jump code is:mov bx, ax;jmp word ptr cs:[FctTable+bx];4. Actual OS function -> OS codeThe actual OS function is executed. Then the actual OS function returns to theprevious OS code, which resumes by popping any parameters off the stack.The interface of vectoring to an OS function from an application (and returning backto the application) is discussed below in reference to Table 6.Table 6Application to OS Interface Example: read( CARD, ..)IIII II------------ --Ireturn status;I II I |F012:3456 I int card_read( CARD ...)IIIII< ........... --I I I II I I II I I II I _ I IIF012:0013 I 7—WrIte() Offset = xxxx I II I I IIF012:00l1 I 6-Read() Offset = 3456 I II I I II I“ I I|F012:0007 | 1-Control() Offset = xxxx I II I I|F012:0005 I 0-C_Iose() Offset = xxxx |FctTable[0] |SUBSTITUTE SHEET (RULE 26)CA 02264667 1999-03-04WO 98/1036815202530354045|ApToOsEntryIPCT/US97/1551446I I I I II I Card- imp csI[FctTable+bx] |-—-—_ _ ---- --|F012:0000 I Object: mov ax, bx I < ......... -_I ' |v I OS ROM code and constants I I__________ _- I I * _IApToOsExitI I I------------------ --I I _ _I I I AI I _ II I Imp es:[OFctVecNbr*4] ------------- --I I . mov es, dx II I xor dx, dx II I mov ax, OFctlndex*2 II I mov bx, Olndex*4 II I _read proc I< ....... --I I I II I I II I I I---------- -->I I I II read(ms_CARD, ...)=>call _read I -------- --I II I _ IApp Start I Application code and data II II II II I0070:1010 I 4-ms_CardObject = F012:O000 II II II I0070:1004 I l-DispIayObject =xxxx:xxxx II I0070:1000 I 0-KeyboardObject = xxxxzxxxx IObjectTable[0]I II 0000:0000 I OS data areaconjunction with the following steps.Application code —> application stub functionTable 6 shows a preferred method for the application to OS interface, which is used inThe application code first pushes any parameters on the stack. Then it calls the"application stub function". The application code is:call _readSUBSTITUTE SHEET (RULE 26)W0 98/ 1036810152025CA 02264667 1999-03-04PCT/US97/15514472. Application stub function —> ApToOsEntryThe application stub function, representing the OS function, is linked intoapplication space via the application library, app.lib. Indexes to the object and memberfunctions are passed via registers and control is given to the common entry, ApToOsEntry,of the operating system with an interrupt vector. A far indirect jump instruction (with someallied code) is used for performance, rather than an actual vectored interrupt instruction (INTOFctVectorNbr). The code is:_OsFunction proc;mov bx, OINDEX_FOR_object * 4;mov ax, OFCT_INDEX_FOR_function * 2;xor dx, dx;mov es, dx;jmp es:[OFctVectorNbr * 4];_OsFunction endp;The interrupt vector address (OFctVectorNbr*4), set at terminal start up, transferscontrol to the operating system at its common entry, ApToOsEntry.3. ApToOsEntry -> Function tablejump codeApToOsEntry is the common entry into the operating system. Its module file alsocontains the common exit. This single point design permits different hardwareapplication/OS modes, as well as easier implementation of certain debugging techniques.The responsibility of ApToOsEntry is to give control to the proper OS function.Table 7 shows sample ApToOsEntry code in the C programming language. It will beappreciated by those skilled in the art that assembly code could be used for improvedperformance.SUBSTITUTE SHEET (RULE 26)CA 02264667 1999-03-04WO 98/10368 PCT/US97/1551448Table 7//10152025303540455055// ApToOsEntry — Application to OS vector entry to call a object member fct.//int huge ApToOsEntry( //CAUTION: assumes registers bp, si, di, & ds pushed by prolog code.Uint IODevice0Index) // If io call, object/dev idx/no.{Uint Olndex = _BX; // Passed in as far pointer idx.Uint Flndex = _AX; // Passed in as near pointer idx.//// Get actual object index if object is an i/o device.//if( Olndex == 0 ){if ( IODeviceOIndex >= MAX_OBJECTS ){goto exit; // Device object does not exist.}Olndex = IODeviceOIndex * sizeof(void far *);}//// Save caller's return in its proctab entry & set to return back here.//proctab[currpid].paddr = *StackVoidPtr(2);*StackVoidPtr(2) = OsToApExit;//// Restore regs, push address and goto object's function tablejump code.//asm { pop dx; pop di; pop si; pop bp }; _*StackVoidPtr(0) = Ob3ectTable[OIndex / sizeof(void far *)];asm { mov ds, dx; mov ax, Flndex; ret };exit: // Error: device object does not exist; return with error.return SYSERR;}//// OsToApExit - Return to application caller after an OS call.//// On entry and exit, the stack (sszsp) points to caller's first paramerer.//static void huge OsToApExit( void ){ //CAUTION: assumes registers bp, si, di, & ds pushed by prolog code.asm { pop dx; pop di; pop si; pop bp };*StackVoidPtr(2) = proctab[currpid].paddr;asm { mov ds, dx; ret };This ‘c’ code is designed to accomplish several tasks. First, if the object is aninput\output device, the caller's first parameter (the device descriptor number) is used as theSUBSTITUTE SHEET (RULE 26)WO 98/10368l01520253035CA 02264667 1999-03-04PCT/US97/ 1551449actual object number, unless the device number is illegal. In this case, return is made to theapplication caller with error; otherwise the object number is converted to a far pointer index.Next, the application caller's return address is saved in the process table (proctab)entry corresponding to the current OS process; and the caller's return address on the stack isoverlaid by the common exit address, ApToOsExit, in order to regain control after the OSfunction completes.Then the address of the OS object is determined by indexing into the ObjectTable,using the object index (modified for far pointer indexing, that is, multiplied by four).Finally, control transfers to the function table jump code.4. Function tablejump code —> Actual OS functionThe function table jump code transfer to the actual OS function by using the memberfunction index with the ‘object's FctTable. The function table jump code is required to be atthe start of an object, follow by its FctTable containing near pointers (offsets) to everyex.ternalized member function. This implies that all member functions of an object arecontained in one segment (64K maximum). The code is:mov bx, ax;jmp word ptr cs:[FctTable+bx];5. Actual OS function -> ApToOsExitThe actual is OS function is executed. When it exits, it returns to ApToOsExit.6. ApToOsExit —> Application codeApToOsExit does any final bookkeeping processing. Then ApToOsExit returns tothe application, which resumes by popping any parameters off the stack.DiagnosticsIn the preferred embodiment, three levels of diagnostics will be provided:1. At power up, the operating system will automatically perform a series of diagnosticssuch as checking RAM, ROM, processor and configuration.2. Diagnostics will be available from the director menu for the operator to access whenneeded. This will include diagnostics such as gathering statistics, keypad test, and checkingfor security keys.3. Several applications will also be available for service and manufacturing personnelto load for advanced diagnostic tests and troubleshooting.SUBSTITUTE SHEET (RULE 26)W0 98/1036820253035CA 02264667 1999-03-04PCT/US97ll551450Software Libraries and ToolsThe POS Terminal preferably uses "off the shelf“ PC based tools such as:0 Borland C++ compiler0 Paradigm debugger0 Together C++ design toolExtensive library routines, objects, and utilities are available that make the new terminal"easy to program". Software development kits will be provided for application softwaredevelopment.Smart card drivers will be utilized for various types of smart cards such as EMV,MPCOS, PCOS, and SCOS cards.An OS application has the following system functions available. The OS functionsinclude the system calls for the XINU functions and OS supplemental functions, as well asOS application library functions. The OS functions are grouped functionally with a briefdescription, and later some of the particularly interesting ones are listed again with a detaileddescription.The 1/0 functions are: close, control, getc, getcwait, init, open, putc, read, and write.Note that a unique subset of these functions is meaningful for each device. For example,associating the getc (get a character) function with the keyboard is meaningful, whereasassociating the putc (put a character) function with the keyboard is not.The OS supplemental functions provide further functionality for the application andthe OS Director, such as date/time, downloading, and miscellaneous features.Unlike the other OS functions, the OS application library functions, if used, willhave their code linked into the application space. To access these functions, the applicationprogrammer links the OS application library with the application.Other application library functions, such as RAM Disk and Indexed Files, are alsoavailable for linking with application programs.In ut t S em llclose Device independent close routine.control Device independent control routine.fgetc Get character from a device (same as getc).fputc Put a character to a device (same as putc).getc Device independent character input routine.getchar Get character from the keyboard device.getcwait Device independent character input routine with timeout.open Device independent open routine.putc Device independent character output routine.SUBSTITUTE SHEET (RULE 25)W0 98/ 10368101520253035putcharreadwritetwork nnic_closenic_controlnic_countnic_createnic_deletenic_freebufnic_getbufnic_opennic_readnic_writeOS Proces stadd_stack__spacechpriocreategetpidgetpriokillesumeuspendS ter r ess S"receiverecvtimsendsendfsendnCA 02264667 1999-03-04PCT/US97/1551451Put a character to the display device.Device independent input routine.Device independent output routine.ace 'c't D LiDe—registers a higher level protocol from NIC data link layer.Change parameters or clear statistics of a NIC physical device.Check the number of packets waiting at a NIC message type.Initializes the NIC variables and creates NIC processes.Removes NIC support from the given device.Return packet to the NIC buffer pool.Get a buffer from the NIC buffer pool.Registers a higher level protocol handler with the NIC data linklayer.Read a packet from a message type of a NIC message type.Sends a packet to the NIC process and waits for a response.Add system heap space for application process stacks.Change the priority of a process.Create a new process. The process stack size, ssize, must beat least 256 bytes.Return the process ID of the process currently running.Return the scheduling priority of a given process.Terminate a process.Resume a suspended process.Suspend a process to keep it from executing.e M SReceive a (one word) message.Receive a (one word) message with timeout.Send a (one word) message to a process.Force a message to be sent to a process, even if doing so destroys awaiting message.Send one word message to process. Do not force a resched().SUBSTITUTE SHEET (RULE 26)WO 98/10368l01520253035CA 02264667 1999-03-04PCT/US97/ 1551452OS Interprggggg Port (Mail) System gallsget_dir_portid Get the Director port identification.pcountpcreatepdeletepreceivepresetpsendReturn the number of messages currently waiting at a port.Create a new port. DMOS supports up to 32 ports. The maximumnumber of message nodes on all ports at any one time is 32.Delete a port.Get a message from a port.Reset a port.Send a message to a port.OS Interprocess Semaphgrgs System Callsscount Return the count associated with a semaphore.screate Create a new semaphore.sdelete Delete a semaphore.sreset Reset semaphore count.signal Signal a semaphore.signaln Signal a semaphore n times.wait Block and wait until semaphore signal.M ent S st allsfreemem Free a block of application heap space.freestk Free a block of application heap space (same as freemem).getmem Get a block of application heap space.getstk Get a block of application heap space (same as getmem).lheap_init Initialize the application's heap space.OS Buffer P99! Management System Callsbufcount Get the number of free buffers of a pool.delpool Delete a buffer pool.freebuf Free a buffer and return it to a pool.getbuf Get a free buffer from a pool.mkpool Create a number of buffers for a buffer pool.poolinit Initialize the entire buffer pool manager.OS Tim nd te S s emdatetos Convert a date and time to a fomratted string.day_of_year Convert date to the day-of-year index.SUBSTITUTE SHEET (RULE 25)W0 98/ 10368101520253035get_dateet__tickset__usecsmonth__dayset_datesleepsleeptstodate'on Callconf1g_controlget_restartsget_system_informationset_startup__modesystem_contro1OSI t ri_do_crc__checkSst_do_init_same_valuescalc_crcchk__chksumset_chksumOS Dow oget_dial_stringSseget_dnld_infoget_terminal_idset_baud_rateset_dial_stringset_dnld_infoset_terminal_idget_baud_rateCA 02264667 1999-03-04PCT/US97/1551453Convert the current date and time to a formatted string.Get system clock in ticks (number of tenths of a second).‘Get system clock in microseconds.Convert day-of—year index to the month and the day.Set the current date and time from a formatted string.Go to sleep for n seconds.Go to sleep for n ticks.Convert a formatted string to a date and time components.Controls configuration memory area(keypad type and Director password).Get number of restarts since last startup.Get DMOS system information.Set the startup mode for the terminal.Configure the internals of the system.HCalculate Cyclic Redundancy Code (CRC) of one or morespecified segments.Initialize one or more data areas, each to their same value.Calculate CRC for a given string.Check computed checksum of a block with a checksum.Compute and store the checksum of a block.IGet the Director download dial information.Get the Director download information.Get the Director download terminal information.Set the Director download baud rate information.Set the Director download dial information.Set the Director download information.Set the Director download terminal information.Get the Director download baud rate information.SUBSTITUTE SHEET (RULE 26)W0 98/ 10368101520253035CAOS Securi allsec_des_decryptsec_des_encryptsec_dukpt_clearsec_dukpt_initsec_dukpt_smidsec__get_informationsec_key_clearsec_key_set_mgmtsec_key_submitsec_mac_datasec_PIN_encrypt02264667 1999-03-04PCT/US97ll551454Decrypts data with a key injected earlier.Encrypts data with a key injected earlier.Clears and resets the Derived Unique Key PerTransaction security functions.Initializes the Derived Unique Key Per Transaction(DUKPT) key management system.Returns the current SMID.Gets information on the current state of the securityfunctions.Erases the security key.Sets the security key management mode.Saves the given key information.MAC’s data with a key submitted earlier.Encrypts the PIN data using an account number.sec_serial_num_submit Sets the serial number.OS Miscellaneous gallsformat Format a string according to a fonnat mask.fprintf Formatted output conversion to a device.printf Formatted output conversion to the display device.set_roll_cmnds Set printer command characters for roll printer.set_slip_cmnds Set printer command characters for slip printer.visa_recv Read into a buffer using the VISA II message protocol.visa_send Write from a buffer using the VISA II message protocol.One of the more interesting sets of software library class or object are those relatedto the display driver. The display driver object performs the display activity for the OS. Itoperates intandem on two conceptual levels: the upper and lower. The upper level containsthe external interface display functions and executes the application or operating systemrequests for writing characters to the display along with statusing and mode setting. Thelower level outputs characters to the hardware display, as well as handling cursor movement,contrast, and back lighting control.Briefly as shown in FIG. 17, an application’s display call, as are all OS system calls,resolves to an OS app.lib function that uses an interrupt vector to “bridge” from applicationspace to OS space. Once within this space, the OS kernel vectors the display call to thedisplay driver object, then to one of the display driver functions (all termed the upper level).SUBSTITUTE SHEET (RULE 25)W0 98/103681520253035CA 02264667 1999-03-04PCT/U S97/ 1551455Each display function makes use of its data structure, the display Device Control Block(DCB) to manage the display mode setting and statusing, items that are unique to the display.The lower level functions are called by the upper level to handle the hardware interface tothe display itself. Note that the application is never blocked when using any displayfunctions.Features of this preferred embodiment display object include:Graphical display of any set of characters, including bit graphics.Up to four rectangular screens with possibly of a different character set in eachscreen.Each of four processes can control or own at least one screen of the four screens ofthe display.One process can control or own one, two, three, or all four screens.Up to six different character sets, four user defined and two default sets.Ability to uninstall character sets to install new ones.Character sets can specify size and number (maximum of 64K characters in a set).Optional display of a horizontal and/or vertical cursors.Variable horizontal and/or vertical spacing around characters and between lines.Cursor movement commands from character set or control function.Optional automatic wrapping of characters to next line.Setting of display’s contrast and its back light.The following define the display operating system calls that an application oroperating system can make. The calls are identical to other device calls except for the deviceparameter, which here would specify the DISPLAY.Open Open a screen for the current process.Control Set mode or return status (see next section).Putc Output one character.Write Output a specified number of characters.Close Close screen to allow another process to use.A special call is also defined to permit display access without control or ownership.It is used by the OS when the device could be opened by an application; or by applicationlibraries for displaying warning messages. It is not normally used by an application per se.Display_io Generalize output or mode setting without ownership.SUBSTITUTE SHEET (RULE 25)WO 98/103681520253035CA 02264667 1999-03-04PCT/US97ll55l456The functions done with a display control call, allowing modes to be set and status tobe returned, are:0 CHECK_DEV__STATUS Get the device’s status.0 CLEAR_SCREEN Clear the selected screen and set cursor home.0 CSR_OFF Do not display cursor.0 CSR_ON _ Display cursor if option selected on open.0 CURSOR_HOME Set cursor to top-left position in selected screen.0 GET_DISPLAY_SIZE Return selected screen’s column and row size.0 INSTALL_CI-IAR_SET Install a character set.0 MOVE_CSR Set cursor to requested spot in selected screen.0 RESET Reset the display device.0 SET_BACKLITE Set display’s backlight to requested value.0 SET_CONTRAST Get display’s contrast to requested value.0 SET_SCREEN Set (select) a screen that this process opened.0 UNINSTALL_CHAR_SET Uninstall a character set.0 WRAP__OFF Do not wrap a line to next line.0 WRAP_ON If cursor at end of line, move to next line.The display object consists of the software display driver code that manipulates thehardware display device, or the display for short. The display is organized into rectangularsections called screens. A particular screen may encompass all or part of the display, and isdefined when a process executes an open() display function. The entire display can beopened as one screen by:open ( DISPLAY, NULLPTR, NULLPTR );A part of the display can be opened as a screen by supplying screen parameters:open ( DISPLAY, &screen_ptr, sizeof (screen _ptr );The screen parameters specify the starting screen coordinates on the display and thehorizontal and vertical lengths of the screen, as well as optional amount of inter-spacingbetween columns and lines.A standard screen configuration can done as follows.open ( DISPLAY, &std_screen_config, NULLPTR );SUBSTITUTE SHEET (RULE 26)WO 98/10368l520253035CA 02264667 1999-03-04PCT/US97/1551457More than one process may open a screen, and more that one screen may be openedby a particular process. However, there may be at most four screens and they may notoverlap.Even though the display’s dot resolution does not really permit different font styles(such as Times Roman or Courier) without using a large portion of the display, each screencan specify a different character set.Character sets are installed with a control function and are given a character setindex. When installed, they specify the number of characters (maximum 64K) and the firstdisplayable character index, as well as horizontal and vertical pixel sizes, and the actualgraphic characters themselves. To use an installed character set, you must open a screen withscreen parameters and select the character set by its character set index. A character size canbe defined to be lxl, 128x32 (the entire screen), or anything in between.If the character set is larger than 256, each character is assumed to be two bytesinstead of one, when a putc() or write() is executed. This can be done, for example, usingBorland’s wide character option.Two character sets are preferrably provided: the 5x9 and the 5x7 ASCII charactersets. The first character set is index one and is the default for opening the display withoutparameters; the second character set is index two. Other character sets for other language orgraphic sets and sizes can be added. There may be at most four additional character setsinstalled at any one time; however, a character set may be uninstalled and new one installedwith control functions. Of course, the selected screen must be closed and re-opened to use anewly installed character set.For the two provided characters sets, certain characters (Backspace, \b; Formfeed, \c;Newline \n; and Return, \r) are not displayed, but instead move the cursor backwards oneposition, home, beginning of the next line, or beginning of the current line, respectively.Also, there are six special characters: up/down arrow (‘\l ’), up arrow (‘\2’), down arrow(‘\3 ’), left arrow (‘\4’), right arrow (‘\5’), and arrow body block(‘\6’). The rest of the othernon—printing characters are treated as spaces.Each screen is organized by columns and lines. Their maximum Values aredependent on the character size and the inter-character spacing. The 5x7 character set, withone pixel spacing in both directions, allows a total of 84 characters (21 columns by 4 lines),while the 5x9 character set allows a total of 63 (21 columns by 3 lines).The cursor position is determine by its column and line. Both column and line startat one and go up to their respective maximum. The upper left position of any screen isalways (1, 1).Each time a character is output to the display, the positioning of the next character isadjusted. By default, the positioning is rightward one character, then to beginning of the nextSUBSTITUTE SHEET (RULE 26)WO 98/1036810152025303540CA 02264667 1999-03-04PCT/US97/1551458line when at the end of a line, and finally to beginning of screen when at the end of the lastline. If wrap is turned off, the positioning does not goes to the next line; instead it re-positions to the same character just displayed.Optionally, the cursor is display in the currently selected screen. For this to occur, aroutine must be provided when the screen is opened. Then a control call is used to have itdisplayed. The cursor can be displayed as either a horizontal or vertical line, or both. Thecursor can be positioned where it is displayed when the screen is opened.A typical flow of control through the display object is as follows:1. Process zero initializes the display (display_access) on start up.2 ' Process X opens a screen of the device (display_open).3. Process X optionally executes control call (display_control).4 Process X calls an output function (display_write/display_putc)which places the data on display.5. Process X repeats step four and possibly step three until it displayingis completed.6. Process X closes the selected screen (display_close) to release it foruse by other processes.7. During the same time frame, process X may do the same calls forusing up to three more screens. Note that it will have to do step 3 toselect an alternate screen.8. During the same time frame, processes A, B, and/or C may do thesame calls.Some routines are only available for calls from other operating system objects, aswell private calls within the display driver object itself, including Display_access andDisplay_io. Each of these functions is briefly described below.Display_openSynopsisint display_open( int object_id, struct dsp__parameters *sparm_ptr,*sp1en__ptr );DescriptionAssign part or all of the device, represented by the object_id, to the calling process,clear any previous data, and create a screen for the hardware display. If thedesignated portion of the display is free, the calling process owns the newly createdscreen, and a screen index (one through four) is returned; otherwise, an error isreturned.If the pointer sparm_ptr is NULLPTR, the entire display is assigned to the callingprocess. For this case, the default character set is 5x9 with one horizontal pixelSUBSTITUTE SHEET (RULE 26)W0 98/ 1036810152025303540CA 02264667 1999-03-04PCT/U S97/ 1551459space between lines, and one vertical pixel space between columns (characters). Thisimplies three lines of 21 columns each. Also the cursor option is not selected, so nocursor can be displayed.If the pointer sparm_ptr is not NULLPTR, the dsp_parameters structure pointed toby sparm_ptr specifies how the screen is to be defined (see below), and the length ofthe dsp_parameters structure is pointed to by splen_ptr.If the splen_ptr is NULLPTR, but sparm_ptr is not, then sparm_ptr is a pointer to aninteger representing a standard configuration. Currently, there is one standardconfiguration, whose integer is one. If this is selected, two screen are created: Onescreen is at the top, using a 5x9 character set with three horizontal spaces betweenlines, including an optional cursor, and one vertical space between columns. Thisscreen has two lines of 21 columns each. The second screen is at the bottom, uses a5x7 character set with one horizontal space between lines and one vertical spacebetween columns. This second screen has one line of 21 columns with the ability todisplay both a horizontal and vertical cursorParameter Xal_ue Meanmgobject_id DISPLAY Specified object or device identification.sparm_ptr NULLPTR Opens the entire display as one screen.splen_ptr NULLPTR lmplies opening of a standard screen.*sparm_ptr structure Display parameters structure for a screen.*splen_ptr Integer Length of display parameters structure.*sparm_ptr Integer Open the entire display as two screens.splen_ptr NULLPTR lmplies opening of a standard screen.ggmm Value Meaningreturn value integer Screen index used selecting screen in control().BAD_PARM Device screen overlaps or mismatch in size.BAD_USER Device screen owned by another process.Display screen parametersstruct dsp_parameters{The following structure defines the display parameters used to open a generalizedscreen for the display.int x_start__pointint y_start_pointint x__lengthint y_lengthint char_set_selection// X start coordinate (range:0-127 )// Y start coordinate (range:0- 31 )// X size of screen (range:1-128 )// Y size of screen (range:1- 32 )// Char set select (range:0-user)SUBSTITUTE SHEET (RULE 26)CA 02264667 1999-03-04W0 98/ 10368 PCT/US97/1551460// default values:1-5x7, 2-5x9int line_space // Y inter-line space (range:O-127 )int char_space // X inter-char space (range:0- 31 )int line_cursor // line cursor option (range:0- 1 )5 int char_cussor // char cursor option (range:0- 1 )int line_cursor_space // line cursor space (range:0- 31 )int char_cursor__space // char cursor space (range:0- 127)};10 Display open example152025303540struct dsp_parameters s1_parameters[] ={ 0, 0, 128, 24, 2, 2, 1, TRUE, FALSE, 1, O };struct dsp_parameters s2_parameters[] =//{ 0, 24, 128, 8, 1, 1, 1, TRUE, TRUE, 0, O };void open_example(){////Uint size_sp1 = sizeof( s2_parameters );Uint size_sp2 = sizeof( s2 _parameters );Uint screen_1;Uint screen_2;Uint screen_option = 1;//// Open entire display as one screen.//open ( DISPLAY, NULLPTR, NULLPTR );////Open entire display as two default screens.//open ( DISPLAY, &screen_option, NULLPTR );SUBSTITUTE SHEET (RULE 25)W0 98/103681520253035404550CA 02264667 1999-03-04PCT/US97/1551461//// Open the display (open main screen last for it to be selected).//screen_2 = open( DISPLAY, s2__parameters, &size_sp1 );screen__l = open( DISPLAY, 51 _parameters, &size_sp2 );////// Select screen 2 to do display within screen 2.i:/ontrol( DISPLAY, SET_SCREEN, &screen_2, NULLPTR );////x Select screen 1 to do display within screen 1.control ( DISPLAY, SET_SCREEN, &screen_1, NULLPTR );//};Display_controlSynopsisint display__control( int object_id, int function, void far *parm_ptr,void far *parm2_ptr );DescriptionPerform a function to set a mode or return a status. The control function for thedevice, represented by the object_id, is done possibly using parameters referencedvia the pointers parm_ptr and parm2_ptr.Baum Yams Meaningobject_id DISPLAY Specified object or deviceidentification.function CHECK_DEV_STATUS Get the device’s status.CLEAR_SCREEN Clear the selected screen and setcursor home. 'Do not display cursor.Display cursor if option selected onopen.Set cursor to topleft position inselected screen.Return selected screen’s columnand row size.Install a character set.Set cursor to requested spot inselected screen.CSR_OFFCSR_ONCURSOR_HOMEGET_DISPLAY_SIZE.’;INSTALL_CHAR_SET1. MOVE_CSR.’;SUBSTITUTE SHEET (RULE 25)W0 98/ 1036820253035404550CA 02264667 1999-03-0462RESETSET_BACKLlTETSET_CONTRASTTSET_SCREENTUNINSTALL_CHAR_SETTWRAP_OFFWRAP_ONRequires parm_ptr to not be a NULLPTR, see below.1‘ Requires both parm__ptr and parm2_ptr to not be NULLPTR, see below.Parameterparm_ptrparm2_ptrFor FunctionGET_DISPLAY_SIZEINSTALL_CHAR_SETMOVE_CSRSET_BACKLITESET_CONSTRASTSET_SCREENUNINSTALL_CHAR_SETAll other functionsGET_DISPLAY_SIZEINSTALL_CHAR_SETMOVE_CSRAll other functionsReturn Egr Functionreturn valueINSTALL_CHAR_SETPCT/US97/ 15514Reset the display device.Set display’s backlight to requestedvalue.Get display’s contrast to requestedvalue.Set (select) a screen that thisprocess opened.Uninstall a character set.Do not wrap a line to next line.If cursor at end of line, move tonext line.Value and MeaningPointer to integer to return max.columns.Pointer to char array of a characterset.Pointer to integer number ofcolumns value.Pointer to integer backlight value.Pointer to integer contrast value.Pointer to integer screen index fromopen().Pointer to integer of a character setindex.Pointer set to NULLPTR.Pointer to integer to returnmaximum lines.Pointer to integer of character setsize.Pointer to integer number of linesvalue.Pointer set to NULLPTR.Value and _l\_'1egningCharacter set index to use in anopen screen.For all other functions without error an OK implies function completed withouterror. For all functions with error BAD_USER, this means a non-owner is trying to use ascreen. For all functions with error BAD_CMD, this means illegal function or parameters.New character set install exampleThe first step is to define a character array for the character set; see example below.The first five bytes define its characteristics: the number of characters in thecharacters set, the first legal index, and the character size in pixels. For the examplebelow, there is just one character (an ‘S’). You must specified two bytes for thelength, the least significant byte first. The first legal index is 83 (0x53) because thatSUBSTITUTE SHEET (RULE 25)WO 98/10368I0152025303540455055CA 02264667 1999-03-04PCT/U S97/ 1551463is the value of an ASCII ‘S’. Of course, you could change the ‘S’ value to zero andset the first legal index also to zero. Finally, the size of a character is six pixels wideand ten pixels long.After this, the character set is specified. Because the display hardware outputs bytesvertically, the characters must be rotated 90 degrees clockwise. Also, due to howmemory is accessed, the most significant byte must stored in memory first. In thisexample, the bytes must be swapped. Note: A possible future project will be toautomate the generation of user defined character sets.Once the array has been generated, execute the following control call to install thecharacter set.char_set_index = control( DISPLAY, INSTALL_CHAR_SET,dsp_char_set_special,sizeof ( dsp_char__set_special ) );Then execute an open command to use the special character set within the selectedscreen.display_parameters.char_set_selection = char_set_index;open( DISPLAY, &display_parameters, sizeof( display _parameters ) );character set examplechar dsp_char_set__special[] =I, //=DSP_MAX__CHARACTERS & OXFF, //Low byte of # charactersin set.0, //=DSP_MAX_CHARACTERS / 0x100 //High byte of # charactersin set.83,//=DSP_FIRST__CHAR_INDEX, //First legal character codeindex.6, //=DSP_CHAR_X_SIZE, //Horizontal char size inpixels.10,//=DSP_CHAR_Y_SIZE, //Vertical char size inpixels.//// Character set values://// Characters rotated 90 degrees l Chars rotated | Characters as they// clockwise and bytes swapped] 90 degrees. I appear on display.//0x8E,0x00, // l000l1l0b,0bj 0l000lll0b| 0l1l0b0x11,0x0l, // 000l0001b,1b] l000l000lb| 1000lb0x1l,0x0l, // 000l0001b,1b| 10001000lb] l0000b0x1l,0x0l, // 0001000lb,lb] l0001000lbl l00O0b0xE2,0x00, // 1l1000l0b,0b| 0lll000l0b| 01110b// | 1 00001b// | | 0000lb// 1 | 10001b// | | 01110bSUBSTITUTE SHEET (RULE 26)WO 98/1036810I5202530354045CA 02264667 1999-03-04PCT/US97/ 1551464Display_putcSynopsisint display_putc( int object_id, char ch );DescriptionOutput one character, ch, to the device, represented as object_id. The callingprocess is never blocked.&raI_n_ete_t .\lal_ue Meaningobject_id DISPLAY Specified objector device identification.ch character Character to be output.Bejem Value MeaningOK Function completed without errorBAD_USER Non-owner attempting to use the screen.Display_writeSynopsisint display_write ( int object_id , char far *buffer, int count );DescriptionWrite the count characters from buffer to the device, represented as object_id. Oncethe function returns, the buffer may be reused. The calling process is never blocked.Parameter Value Meaningobject_id DISPLAY Specified object or device identification.buffer pointer Pointer to buffer of characters to be written.count integer Number of characters to be written.Betnm Maine Meamngreturn value OK Function completed without errorBAD_USER Non-owner attempting to use the screen.BAD_CMD Count is less than zero or more charactersthan screen can hold.Display__closeSynopsisint display_close ( int object__id );DescriptionReleases control of the currently selected screen, represented by the object id, thatwas previously opened by the calling process. This portion of the display is availableas a portion of a screen that may be opened by a process for its use.SUBSTITUTE SHEET (RULE 26)CA 02264667 1999-03-04wo 98/10368 PCT/US97ll551465et r Value Meaningobject_id DISPLAY Specified object or device identification.__¢1L_R rn Y_aliI_e M_ea_ning5 return value OK Function completed without error.BAD__USER Non-owner attempting to close screen.10I52025303540Display_accessSynopsisint huge display_access ( int object_id, int fct_type );DescriptionThe protected display_access() function is used to indicate that the object,represented by the object id, exists or to initially construct the display object byallocating and initializing the display DCB. The particular function is determined byfct_type.BaLa_metsLr Yjlueobject__id DISPLAY Specified object or device identification.fct_type OBJ_EXISTS Request for device object’s existence.OBJ__CONSTRUCT Request to construct the device object.Return. Liam: Mmmngreturn value OK Function completed without error.BAD_USER Non-null process trying to construct device.Display_i0Synopsisvoid huge display_io ( int parameter );ApplicationsVarious applications will be developed for use with the POS terminal of the presentinvention. For example network applications will be developed such as retail/restaurantapplications on VISANET, GPS, and NOVUS. These applications will include standardcredit, debit, and check authorization capabilities, along with an American Express PluralInterface Processing (PIP) option. A single application will support retail and restaurantfunctionality. In some embodiments to save on memory, different application files will beused for the gateway, LAN workstation, and standalone environments. The user interfacewill be essentially the same in all configurations and on all networks. Preferably theapplications will be developed using object oriented programming. Additional applicationsmight include storing and transporting applications on a smart card, storing and transportinga batch file, and diagnostics. Applications are preferably loaded in 64K blocks due to flashSUBSTITUTE SHEET (RULE 26)W0 98/ 10368l0l520253035CA 02264667 1999-03-04PCT/US97/1551466requirements. Multiple applications might also run together on the POS terminal includingsuch applications as: Credit/debit card application; Electronic purse application; Frequentshopper application; Check guarantee application; Customer survey; EBT program;specialized transactions such as Petroleum card applications; etc. There would probably beonly 2-3 of the above applications used at once, but the list indicates some possibilities.Each application would likely communicate to a different host.Multiple applications might also include different functions requested by a customer.For example, the customer could choose from the following functions:1. Visa/MasterCard acceptance2. American Express acceptance3. Check guarantee4. ECR integrationThe same host may process for all these functions, but it eliminates the need tocontrol multiple applications with different combinations of features.SecurityThe core unit with all module configurations can be used for PIN entry by theconsumer. It will support DES and public key for encryption of secure data and handleUnique Key Per Transaction and Message Authentication (MAC).There are several levels of security available:0 Basic security-Single processor, no tamper detection or bonding0 Tamper detection switches—One switch that detects when top enclosure is separatedfrom the main board and another switch that detects when the bottom enclosure or"trap door" is opened. If either of the switches are activated, the operating systemwill clear all required memory.0 Bonding-Ultrasonic bonding provides tamper evidence if someone tries to open upthe case. The core unit can be bonded to the PIN pad cable module. The core unitcannot be bonded to the other communication modules.0 Second processor-A Dallas 5002 chip is added to handle security functions. Allencryption keys are held securely in this chip and cannot be accessed by the 80C186application processor. All communication from the keypad and display is handledby the Dallas 5002 processor. The application processor and security processor canbe downloaded separately from each other. If tampering is detected, the Dallas 5002memory is immediately deleted and the O/S will not allow the application to run.The security processor option is appropriate if a private key is needed for PINSUBSTITUTE SHEET (RULE 26)W0 98/10368101520253035CA 02264667 1999-03-04PCT/U S97/ 1551467encryption or for software downloads. The second IC reader can also be used forthis purpose.The second processor option will generally be used with the tamper switch andbonding options. Two daughter board configurations will be available for the higher securityoptions: One configuration will have tamper detection logic, the other will have both tamperdetection and the second processor.Once a tamper switch has been activated, the service organization will have to reloadapplications and keys before re-deploying the unit. If the unit was bonded, this would needto go back to the factory (or Service organization if they have bonding equipment).It is recommended that applications put all secure information (ie. keys) in SRAMrather than flash. Since tamper detection does not protect against re—downloading a“dummy” application, MACing is used for PIN pad applications. A "trap door" in the coreunit bottom cover will allow the tamper detection switches, security processor, or additionalmemory to be added after initial assembly. It will have an optional privacy shield that cansnap on around keypad area.The way the PIN pad conceals an entered PIN is through encrypting it. Encryptiontakes normal readable data called plain text (or clear text) and scrambles it into anunreadable form called cipher text. The process of converting cipher text back into itsoriginal plain text is called decryption. The encrypted PIN is secure from an attackerbecause they are unable to read it. Many algorithms can be designed for encrypting text.An encryption algorithm may be written that transposes each character by one (i.e.‘a’ becomes ‘b’ and ‘b’ becomes ‘c’, etc.). This algorithm relies on the secrecy of its methodfor its security. If an attacker knows that every character gets transposed by one, they candetermine the plain text.Other algorithms can be written that combine data, called a key, with the plain textin such a way as to produce cipher text. One such algorithm may exclusive—OR the plain textwith the key to produce the cipher text. The method of encrypting the data may be providedto the public (i.e. XOR the data with key), but if they do not know the key, they will beunable to learn the plain text. Algorithms that depend on the secrecy of a key are moresecure than those that depend on the secrecy of the algorithm itself.The Data Encryption Standard (DES) algorithm is one such algorithm. DES hasbecome the standard encryption scheme in the banking community. This algorithm requiresa 56 bit key for encrypting and decrypting data. Generally the 56 bit key is expanded to a 64bit (8 byte) key with the extra bits indicating the parity of the individual bytes. Thisdocument will refer to all keys as has having 64 bits, although the DES algorithm will onlymake use of 56 of the bits. The DES algorithm encrypts 64 bits of data at a time.SUBSTITUTE SHEET (RULE 26)WO 98/103681020253035CA 02264667 1999-03-04PCTIU S97/ 1551468The DES algorithm’s security is only as good as the security of the key. Keymanagement describes the system used in distributing and maintaining keys. The more oftena key is changed the less likely that an attacker could discover the key, and if they had, theless information they would have access to. Both the sender and the receiver must know thesame key in order to decrypt (or encrypt) the transmitted data. The transfer of the keybetween parties must be done in a secure environment. If the key is changed often this canbe a problem.The basic DES algorithm can be used in several different ways or modes. The twomodes used by the PIN pad are Electronic Code Book (ECB) mode and Cipher BlockChaining (CBC) mode.. In ECB mode, the DES algorithm is used to encrypt or decrypt eachindividual block of data. This is similar to looking up the cipher text form of a block of plaintext in a code book. PIN encryption uses ECB mode.CBC mode, on the other hand, takes all of the data and computes, in essence, acipher text checksum. This is useful to protect the integrity of the data. An attacker is stillable to read data but may not alter it without the cipher text checksum, or MessageAuthentication Code (MAC), changing. The new MAC can only be calculated if the key isknown. The MAC is used to provide some measure of security in knowing that an unalteredapplication has been loaded into the terminal.The DES algorithm encrypts 64 bitsof data using a 64 bit (only 56 bits of which areused) key. The DES algorithm is design so that the same algorithm is used for bothencryption and decryption. The DES algorithm requires frequent bit manipulations. TheDES engine functions available for use include:int sec_des_decrypt (Uchar key_id, Des_Data far *buf)The sec_des_decrypt function decrypts the data passed in the Des_Data buf, with thekey injected earlier and identified as key_id. The decrypted data replaces the data inbuf. The data in buf is treated as binary 8 byte data and no conversion is performed.The key_id parameter is a number between 0 and 31, APP_MASTER_KEY,APP_WORKING_KEY, or VISA_DUKPT_KEY. It specifies which key is used todecrypt the data. A key must have been submitted to this key_id before thesec_des_decrypt function is called or else an error is returned. The process will beblocked if security is being used by another process. The buf parameter is a pointerto a structure containing a buffer for the 8 byte binary data to be decrypted. The 8byte binary result is placed in this buffer.sec_des_decrypt returns the following:SUBSTITUTE SHEET (RULE 26)W0 98/10368CA 02264667 1999-03-04PCT/US97/1551469Return MOK Operation completed successfullyINVALID ID key_id is out of rangeKEY_NOT_LOADED key_id has not been loaded with sec_key_submit()INVALID_PARAM Pointer to buf is NULLOVERIMILLION Over one million DUKPT keys have been generatedint sec_des_encrypt (Uchar key_id, Des_Data far *buf)102025The sec_des_encrypt function encrypts the data passed in the Des_Data buf, with thekey injected earlier and identified as key_id. The encrypted data replaces the data inbuf. The data in buf is treated as binary 8 byte data and no conversion is performed.The key_id parameter is a number between 0 and 31, APP__MASTER__KEY,APP_WORKING_KEY, or VISA_DUKPT_KEY. It specifies which key is used toencrypt the data. A key must have been submitted to this key_id before thesec_des_encrypt function is called or else an error is returned. The process will beblocked if security is being used by another process. The buf parameter is a pointerto a structure containing a buffer for the 8 byte binary data to be encrypted. The 8byte binary result is placed in this buffer.sec_des_encrypt returns the following:ReturnOK Operation completed successfullyINVALID_ID key_id is out of rangeKEY_NOT_LOADED key_id has not been loaded with sec_key_submit()lNVALID_PARAM Pointer to buf is NULLOVERIMILLION Over one million DUKPT keys have been generatedApplications can use the public encrypt and decrypt functions which in turn call the privatefunctions which encrypt or decrypt the data.30of data.The Message Authentication Code (MAC) is used to verify the integrity of a seriesApplications downloaded to the terminal are verified using the MAC. If the MACthat the terminal calculates does not match the MAC sent in the application, the applicationis cleared. The MAC function may be used to insure the integrity of any set of data. Someof the available MAC functions include:35int sec_mac_data (Uchar key_id, char far *buf_ptr, int len, Des_Data far *mac_ptr)40The sec_mac_data function will use the key submitted earlier and identified bykey_id to MAC the data. The function will MAC len bytes of the data contained inthe buffer pointed to by buf_ptr. The 8 bytes of data in mac _ptr are used as theinitial MAC value when calculating the MAC. The MAC of the len of buf_ptrreplaces the initial MAC value in mac _ptr. In this way, data may be MAC’d overSUBSTITUTE SHEET (RULE 26)W0 98/ 10368152025303540CA 02264667 1999-03-04PCT/US97ll55l470several calls to sec_mac_data. The first call will pass mac _ptr containing zeros (orsome other initial value). Subsequent calls to sec_mac_data then continue thegeneration of the MAC by passing the MAC from the previous sec_mac_data call inmac_ptr. The key_id parameter determines which key is used when MACing data.The process will be blocked if the security functions are being used by anotherprocess. The buf_ptr parameter is a pointer to a buffer containing the data to beMAC'd. The data will be treated as binary when MAC’d. The len parameter definesthe number of bytes in the buffer to be MAC'd. Note: the MAC function operates in8 byte increments. If the length is not divisible by 8, the remainder will be filledwith zero before that block is MAC’d. Care must be taken if the original MAC wasnot calculated in this manner also. Note: the application may still pad the data in adifferent manner and pass the data in multiples of 8 bytes to sec_mac_data. Themac_ptr parameter is a pointer to a structure containing a buffer that will contain theaccumulated MAC. The accumulated MAC is combined with the passed data andencrypted to create a new accumulated MAC which replaces the one passed. TheMAC should be initialized to zero to begin MAC-ing. The result is in 8 byte binaryformat.Sec_mac_data returns the following:Return MeaningOK Operation completed successfullyINVALID_ID The specified key ID is not validKEY_NOT__LOADED The key specified has not been loaded usingsec_key_submitEither the buf_ptr parameter or the mac _ptrparameter is a NULLPTRThe sec_mac_data function is initially called with the mac _ptr parameter pointing toINVALID_PARAMa structure containing zeros. This is the initial accumulated MAC. After each call the newaccumulated MAC will be written into the mac _ptr parameter. The application isresponsible for ensuring that the current accumulated MAC is passed to the function forupdating with each call. The accumulated MAC is the resultant MAC after all MACing hasbeen completed. This ‘MAC may be compared to the MAC calculated when the data wasoriginally MAC’d. If they are different then the data has been corrupted. The MACfunctions will be used when downloading an application to verify its validity. If the MACdoes not equal the MAC originally generated then the application will be erased.The security of the DES algorithm is only as strong as the security of its keys. Tolimit the probability of a key being discovered it is best to change keys often. This presentsa problem in that both parties must agree and know what key to use. Several keymanagement schemes are in use by PIN pads. These are: Fixed Transaction Keys, MasterSUBSTITUTE SHEET (RULE 25)W0 98/ 10368101520253035CA 02264667 1999-03-04PCT/US97/1551471Key/Transaction Keys, Derived Unique Key Per Transaction (DUKPT), and Non-ReversiblyTransformed Unique Key Per Transaction.In Fixed key management, only one key is used. This key must be injected into theterminal in a secure environment. This is the simplest method, but the most risky. Shouldan attacker discover the key, all is lost.Master Key/Transaction Key (MK/TK) management uses several keys. One key isinjected into the terminal in a secure environment. This key is the Master key. Other keysmay then be injected into the terminal in a non secure environment if they are encrypted withthe Master key first. When the terminal receives these keys they are decrypted with theMaster key to obtain the actual plain text key. The Master key may also be called a keyencrypting key or KEK. This two stage method allows the transaction keys (or workingkeys) to be changed regularly.The application MAC keys have been pre-defined to follow the MK/TKmanagement method. The application master key (AMK) must be injected in the clear. Theapplication working key (AWK) is encrypted with the AMK and its encrypted form isinjected into the PIN pad. The plain text AWK is used to MAC the application.DUKPT management changes the key after every transaction. An initial key isinjected into the terminal along with Security Management Information Data (SMID) in asecure environment. The SMID contains the ID of the terminal, a key set ID, and atransaction counter. The initial key is assigned by a third party and is derived from the keyset ID and the terminal ID encrypted with a base key not known to the terminal. TheDUKPT method uses the initial key and the transaction counter to generate the current key.This method allows for 1 million different keys to be used. After 1 million keys have beengenerated (i.e. I million transactions), the PIN Pad initial key must be reloaded. Each keygenerated provides no information of past keys or of future keys. These means that if anattacker were to learn the current key they would only have access to one transaction.Non-Reversibly Transformed UKPT also changes the key after every transaction.This method uses data from the transaction itself to create the new key. Because of this bothparties must keep a record of the history of transactions in order to determine the currentkey. This requires a lot of overhead and is usually not used because of this.The security functions will support 32 keys that can be used in either fixed key orMK/TK mode by the application. The keys are referred to by key IDs 0 through 31. Inaddition, several keys have been assigned that have special purposes. The application masterkey (AMK) is used as the master key for the application working key (AWK). The AWK isused for calculating the MAC for applications that are downloaded into the PIN pad. TheDUKPT management mode also has its own key. These pre-assigned keys have a key IDthat is not in the range of 0 to 31.SUBSTITUTE SHEET (RULE 26)WO 98110368102025303540CA 02264667 1999-03-04PCT/US97/ 1551472Doubling the length of the keys to 16 binary hexadecimal bytes increases thesecurity. The security functions will accept either double length or single length keys. Toprovide for maximum flexibility, no structure has been defined for the 32 keys that can bestored. The key structure can be determined by the application when the keys are submitted.When submitting a key, the key is assigned a key ID which is the number of the keysubmitted (0 to 31). In addition the key may have a KEK assigned to it. These means thatthe application can have a single level of keys, or a multiple level (Fixed Key or MK/TK), orany combination. The only restriction is the number of key storage areas (IDs) available.If a KEK is changed, all keys that depend on that key are cleared. In other words, ifthe Master key is changed, then all Transactions keys that were encrypted with that Masterkey are erased. This also applies to the AMK and AWK. In addition, if either the AMK orthe AWK is changed, the application will be cleared.The keys must be stored in OS data memory (i.e. independent from the application).The stored keys must be erased if the terminal is tampered with. An array of key flags willalso be stored. These flags will indicate whether or not the key has been injected and alsowhether or not it is a double length key. These flags can be used to review the status of theloaded keys. The flag byte is defined as follows:Bit 7 ‘ - Set ifthe key has been loadedBit 6 - Set if the key is double length (16 bytes)Bits 0-5 - Set to the KEK ID for the key.A director menu option will allow the user to see which keys have been loaded. Thefunction called by the director will use the key flags to determine their status. Several keymanagement functions will be available, including:int sec_get_information (struct security__info *sec_info_ptr, Uint si_size)The sec_get_information function fills the passed security_info structure withinformation on the current state of the security functions. The struct security_info isdefined as follows:// This is the structure for holding security information.struct security_info {Uchar key_info[32];Uchar awk_info;Uchar amk_info;Uchar dukpt_key;char dukpt_status;char key_mgmnt_mode;char serial__num[l 7];SUBSTITUTE SHEET (RULE 26)W0 98/ 10368l0152025303540CA 02264667 1999-03-04PCTIUS97/1551473The key_info array contains the key flags described above.sec_get_information returns a status.Retum MsmngOK The structure was loaded successfullySYSERR The pointer to the structure was a NULLPTRint sec_key_clear (Uchar key_id)The sec_key_clear function erases the security key with the given ID. Any keyshaving the key_id as a KEK is recursively cleared also. The key_id parameterspecifies which key to clear. The key_id may be a number from 0 to 31. Note thatAPP_MASTER_KEY andAPP_WORKlNG_KEY) cannot be cleared. The process will be blocked if thesecurity functions are being used by another process.the application master and working keys (IDssec_key_clear returns a status.Return MeaningOK Key management mode change complete.INVALID_ID Invalid key ID was given.int sec_key_set_mgmnt_mode (enum mgmnt_modes mode)Sets the security key management mode to be used by the PIN pad. This function isnot used internally but the flag is needed by some applications and is included herefor compatibility with the MEPPA application. The mode parameter selects whatkey management mode to use. The enumerated type is defined as follows:enum mgmnt_modes {FIXED__KEY_MODE, MK_TK_KEY_MODE,VISA_UKP'I‘_MODE, KEYED_MK_TK_MODE}Where:FIXED_KEY_MODEMK_TK_KEY_MODEVISA_UKPT_MODEKEYED_MK_TK_MODEsec_key_set_mgmnt_m0de returns a status.Fixed key modeMaster key/Transaction key modeVISA unique key per transaction modeKeyed Master key/Transaction key mode.R_ctum_ MeaamgOK Key management mode change complete.int sec_key_submit (Uchar key_id, Uchar kek__id, char far *key_data)The sec_key_submit function saves the given key information under the passed keyID. This function also associates a key with its key encryption key (KEK). ThisSUBSTITUTE SHEET (RULE 26)W0 98/ 1036810152025CA 02264667 1999-03-04PCT/US97/1551474function must be performed before any functions requiring a key ID are performed.The key_id parameter determines under which key ID the key information is stored.Valid numbers are 0 through 31. In addition, the APP_MASTER_KEY orAPP_WORKING_KEY may be specified.security functions are being used by another process. The kek_id parameter definesThe process will be blocked if thethe key ID of the key encryption key to be used to decrypt the key being submitted.If no key encryption key is required, NO_KEK should be used. The key encryptionkey must have been submitted before a key, using it as a key encryption key, issubmitted. The key_data parameter is a pointer to a NULL terminated stringcontaining the ASCII hex key data. The string length must be 16 or 32 characters(single or double length). Note: Any keys which were previously submitted withIf the APP_MASTER_KEY issubmitted, the application and all other keys are cleared from memory after thisoperation. The kek_id parameter is ignored for the APP_MASTER_KEY andAPP_WORKING_KEY keys. Defaulting the NO_KEK for theAPP_WORKING_KEY and AWK for the APP_MASTER_KEY.key_id as a kek_id are cleared from memory.tosec_key_submit returns the following:Return MeaningOK Key was successfully submitted.INVALID_KEY The length of the key is not 16 or 32 characters.INVALID_ID The key_id or kek_id parameter is out of range.KEY__NOT_LOADED The key encryption key has not been loaded.int sec_serial__num_submit(char *ser__num_ptr)3035Sets the serial number stored in security_dcb. This function is included forcompatibility with 290E applications. The ser_num_ptr parameter is a pointer to aNULL terminated ASCII string containing the serial number. The serial numbermay be up to 16 digits in length.sec_serial_num_submit returns a status.ImamOKSYSERRMeaningSerial number was updated.The length of passed security number is too large.The sec_key_submit function is used to inject keys at any time.The DUKPT management mode changes the key used to encrypt the PIN after everytransaction. The key ID and the terminal ID along with a transaction counter are used to40generate each key. The transaction counter will allow up to 1 million transactions before theSUBSTITUTE SHEET (RULE 26)W0 98/ 10368CA 02264667 1999-03-04PCT/US97/1551475initial key must be reloaded. Only one DUKPT initial key is allowed to be in use at a time.Some DUKPT functions are:void sec_dukpt__clear (void)Clears and resets the derived unique key per transaction security functions. TheDUKPT functions must be re-initialized before the VISA_DUKPT_KEY is used.The process will be blocked if the security functions are being used by anotherprocess.int sec_dukpt_init (Uchar key_id, char far *init__key, Smid_Data far *smid)I52025303540The sec_dukpt_init function initializes the Derived Unique Key Per Transaction(DUKPT) key management system by internally storing the initial key, the key serialThe key_idparameter is used to select which method is used. Currently, only VISA DUKPT issupported and the parameter must be set to VISA__DUKPT_KEY. The process willnumber (SMID) and resetting the DUKPT transaction counter.be blocked if the security functions are being used by another process. The init_keyparameter is a pointer to a NULL terminated ASCII hex string containing the 16The smidparameter is a pointer to a NULL terminated ASCII hex string containing the 20character initial key to be used (only single length keys are valid).character key serial number (SMID) to be used. Leading ‘F's must be pre-pended topad the SMID to 20 characters.sec_dukpt_init returns the following:lictum McmingOK DUKPT system initialized correctlyINVALID_K.EY The initial key is invalidINVALID_SMID The smid parameter is invalidINVALID_ID Unsupported DUKPT typeint sec_dukpt_smid (Smid_Data far *buff)The sec_dukpt_smid function returns the current SMID, and calculates a newderived unique key per transaction SMID and key. This function is used toincrement the transaction counter. The process will be blocked if the securityfunctions are being used by another process. The buff parameter is a pointer to astructure containing a buffer that is 21 characters in length. The buffer receives theASCII NULL terminated string containing the SMID, pre—padded with ‘F’ ifnecessary.sec_dukpt_smid returns the following:SUBSTITUTE SHEET (RULE 26)W0 98/ 103682025CA 02264667 1999-03-04PCT/US97/1551476Return MeaningOK Completed successfullyKEY_NOT_LOADED The DUKPT system has not been initialized withthe sec_dukpt_init function.The DUKPT system has encrypted more than 1million transactions and must be re-initializedBuff pointer passed is a NULLPTROVER 1 MILLIONINVALID_PARAMTo use DUKPT, the initial key must be injected using the sec_dukpt_init function.This resets the transaction counter and stores the initial key and SMID. Next the encryptfunction is used as normal. To update the transaction counter the sec_dukpt_smid functionmust be used. This will also return the SMID used for the encrypt just performed (before thetransaction counter was updated). This SMID should be sent along with the encrypted datato the host.Smid_Data is a structure defined as follows:// This is the data structure for SMID Data.typedef struct {char data[2 l ];} Smid_Data;The PIN entered by the customer is not just encrypted on its own. The entered PIN(4 to 12 digits) is expanded into a 64 bit block as follows:SUBSTITUTE SHEET (RULE 26)CA 02264667 1999-03-04PCTIUS97/1 S514WO 98/1036877N_< 2.4. c2 3. M2 5.4. o< m< << 9. N< _< o o o oE 8 8 mm Ms E» 3 mm mm 3 E om 3 N_-3 -3 -mm -3 -2 -3 -3 -2 -3 -3 -_N -2 LS -m 3 v;“mum“m>»o=£ mm M0050 2: wG_fi:_UE_ 85 «mos. w—._w_.~ OJ“ mam: M005 Q Ca voosuo. mm #58:: Esoooa ask."2. as has has has has has mé.5 .5 .5 .5 .5 .5 .5 Ho cog"U5 is Z3 Z5 Z3 Z3 Z5 Z3 Z5 ZE Z3 Z.E Z5 Z5 Z5 owe 8 om mm 3 Eu 3 mm mm mm «N om E Q-5 -3 -3 -3 -3 -3 .2 .mm aw .mm .3 -2 -2 -m m-m V;EmSUBSTITUTE SHEET (RULE 26)W0 98/1036815202530354045CA 02264667 1999-03-04PCT/US97/1551478The two blocks are exclusive OR’d together and encrypted using DES in ECB mode. Theresult is the encrypted PIN block. The PIN security functions include:int sec_PIN_encrypt (Pin_Data far *p_data)The sec_PIN_encrypt function encrypts the PIN data using the account numberpassed in the Pin_Data structure. The encrypted PIN is stored in the PIN_blockarray in the Pin_Data structure. The process will be blocked if the security functionsare being used by another process. The p_data parameter is a pointer to a Pin_Datastructure defined as follows:// This is the data structure for encrypt PIN.// PIN_block will be returned for all keys.// smid will be filled for DUKPT keys.// All strings are NULL terminated ASCII either numeric// or hex.typedef struct {Uchar key; //Encryption key numberchar acct[20]; //ASCII Account#, no check// digitchar PIN[13]; //ASCII PIN numberchar PIN_block[l 7]; //ASCII The encrypted PIN// blockchar smid[2l]; //ASCII hex key serial number} Pin_Data;sec_PIN_encrypt returns the following:Return MeaningOK PIN encrypted successfullyOVERIMILLION Over 1 million encryptions have been processed bythe DUKPT system. DUKPT must be re-initialized.KEY_NOT_LOADED Specified key has not been loaded withsec_key_submit()INVALID_PARAM P_data pointer passed does contain valid dataSec_PIN_encrypt requires the entered PIN and the account number before it can beused. Care must be taken to not leave the PIN in the clear in memory. The sec_PIN_encryptfunction will clear the PIN entry in the structure but the user must be sure that it is clearedelse where.The preferred embodiment terminal features a single processor. Thus the securitycode and the application code will reside in the same processor. The application will havethe ability to display any message that is desired and to receive any key presses the customerenters. This opens up the possibility for an application to prompt the customer to enter a PINand to then pass the entered PIN on to an attacker in the clear. The only way to prevent thisSUBSTITUTE SHEET (RULE 26)W0 98/ 10368l01520253035CA 02264667 1999-03-04PCT/US97/1551479is to verify that the application does not contain any rogue code that might do this. Once thecode has been proven to be valid and ‘clean’, it must be MAC’d so that it would be obviousif it was tampered with after approval. The terminal must insure that the application itreceives has the proper MAC and therefore is a valid application before the application isinitiated.The terminal will assume that a security breach will not originate from theapplication (after all, the application has been MAC’d indicating that it will not breach thesecurity). This must be assumed as there is always a chance that the application couldaccess/alter critical pans of the OS even with extensive firewalling, as they both reside in thesame processor.The downloader on the terminal will MAC incoming application data. It is criticalthat this always takes place. The downloader can then clear the application if its MAC is notvalid.When the downloader receives the EDIR it will store the MAC contained in theextended download information record (EDIR) and then initialize the MAC routines usingthe sec_mac_data function with the APP_WORKING_K.EY ID and an accumulated mac ofall zeroes. Each record the downloader receives will be MAC’d using the sec_mac_datafunction with the accumulated mac. Upon completion of the download the downloader willcompare the accumulated MAC against the MAC received in the EDIR. If they do notmatch, the application is cleared. Otherwise downloading completes as normal. The data isMAC’d in its compressed form. The MAC does not include the EDIR or the NDCB packetheaders.The terminal preferrably will initially only have the default AMK and AWK keysloaded. By having default application master key (AMK) and application working key(AWK), the user may download applications without dealing with the AMK and AWK whilestill having a terminal secure from casual application downloading. Should more security beneeded, the AMK and AWK may be changed by the user.The first keys injected into the terminal must be injected in the clear (plain text) in asecure area. This needs to be done before an application has been loaded into the terminal,so that the key is independent from the application. At minimum the capability of injectingthe AMK and AWK before the application must exist.Keys injected in the clear are normally injected using a key loading device (KLD).The director will have a menu option to Inject Keys. This may be password protected.When the Inject Keys option is selected, the sec_l<ey_inject function will be called. Thefunction will then monitor the director selected port for messages from a KLD (or similar)device at standard baud rates with 7 bits, even parity, one start bit, and one stop bit. Once thefirst keys have been injected, the application can take over the injecting of further keys. TheSUBSTITUTE SHEET (RULE 26)WO 98/10368152025303540CA 02264667 1999-03-04PCT/US97/1551480keys injected by the application normally will have been encrypted using one of the keysfirst injected into the terminal and not in the clear.The application will have access to the following functions which will be included inthe bridge. These functions are described in detail above.int sec_des_decrypt (Uchar key_id, Des_Data far "‘buf)int sec_des_encrypt (Uchar key_id, Des__Data far *buf)void sec_dukpt_clear (void)int sec_dukpt_init (Uchar key_id, char far *init_key, Smid_Data far *smid)int sec_dukpt_smid (Smid_Data far *buff)int sec__key_clear (Uchar key_id)int sec_key_set_mgmnt_mode (enum mgmnt_modes mode)int sec_key_submit (Uchar key_id, Uchar kek__id, char far *key_data)int sec__mac_data (Uchar key_id, char far *buff, int len, Des_Data far *mac)int sec_get_information (struct security__info *sec_info_ptr, unsigned int si_size)int sec_serial_num_submit (char *ser_num_ptr)int sec_PIN_encrypt (Pin__Data far *p_data)The security class or object must include several operating system support functions.These functions support the object interaction in the operating system. These functionsinclude the following.void sec_key_inject (void)This function will be called by the director ‘Inject Keys’ menu option. The InjectKeys menu option will be under the parameters option in the director. This InjectKeys option may be password protected. When called, the function will operate asdescribed in the Key Injection section above.void sec_key_display_status (void)The sec_key_display_status function is also called from the director. This menuoption will be under the diagnostics menu. It indicates which keys have been loadedinto the terminal on the display.PC UtilityA PC Utility will support full downloads of applications and parameters. Downloadswill be supported over phone lines, locally, or over the LAN. The PC Utility can alsodownload the operating system, since it is stored in flash ROM. The O/S and softwareshould support download of the application when required, initiated by either the host or theW0 98/ 1036820253035CA 02264667 1999-03-04PCT/US97/1551481terminal (gateway if on LAN). The application can request this download to occur. If noapplication is loaded, a terminal operator would have to manually start the download throughthe director. Remote download of a typical application file (256K) should take within 15minutes (compression will be used to reduce download time). A communication modulehaving ISDN capability or utilizing a diskette might be used for large downloads. Theseapproaches will be looked at more closely if customers begin moving toward higher memoryconfigurations.The PC Utility will also be used for key creation and key injection into the PIN padmodule. It might support common key systems such as DUKPT, Master Key, Session Key,Fixed Key. A preferred embodiment of the invention also supports RACAL.For secure downloading of an application, MACing is used. A specific encryptionkey for MACing is stored in the POS terminal or PIN pad module. The same key is usedwhen downloading an application to create a MAC value. When a new application isdownloaded, the MAC value is compared against the MAC key received in the EDIR toensure that the code did not change during transmission and that the application was sent byan approved source.EXEIVIPLARY USER ENVIRONMENTSThe modular POS terminal allows for many different uses in different userenvironments. A few of these different user environments will now be discussed. It will beappreciated that the environments are purely exemplary and are not intended to be construedas a limitation on the field of use of the invention.1. PIN Pad Module—Electronic Cash Register (ECR) IntegratedIn this environment as illustrated in Figure 1 1A, the POS terminal includes a coreunit 30 which interconnects with a PIN pad module 148. The POS terminal is operativelyconnected to an electronic cash register 170 (ECR) which has electronic funds transfer (EFT)software and handles all host communication. The POS terminal connects to the ECR 170through an appropriate ECR interface such as an RS485 interface (IBM 4680 tailgate), anRS232 interface (most other ECRS), etc. A retail clerk operates the ECR 170. The saleamount is transferred to the POS terminal for display on the POS terminal to the customer.The customer confirms the sale amount, selects payment type, and enters his/her PIN on thekey pad of the POS terminal. A receipt is printed on the ECR printer.2. Local Area Network (LAN)As illustrated in Figure 11B, multiple POS terminals are interconnected asworkstations in a LAN environment with one of the POS terminals functioning as a gatewaySUBSTITUTE SHEET (RULE 26)W0 98/ 103681520253035CA 02264667 1999-03-04PCT/US97l1551482terminal 172 for external communications with a remote host. The POS terminalworkstations each include a core unit 30, a communications module 100, and an externalprinter 174. It will be appreciated that only the POS terminal used as the gateway 172 needsa communications module equipped with a modem PCB. An external PIN pad might beused for convenience.The aforementioned environment is used for multi-lane environments with POSterminals networked together and when ECR integration is not needed. The POS tenninalworkstations in different lanes have no modem or communications module but communicatewith a remote host through a POS tenninal which has a communications module including amodem and serves as the gateway terminal. A POS terminal with its PIN pad module isclerk activated and may be passed to the customer for PIN entry or an optional PIN pad mayThe gateway POSterminal 172 provides external communications with an external host for verification of anybe used. Magnetic stripe or integrated circuit (IC) cards can be read.transactions conducted. The external printer 174 is typically attached for added printingcapability such as higher speed printing.3. LAN--ECR semi-integratedAs illustrated in Figure 11C in a variation of the above environment, the POSterminals interface to an ECR 170 for transfer of sale amount and use of the ECR printer.Host communication isstill handled by the POS terminal functioning as the gatewayterminal 172. In this environment, no external printer is required since the ECR printer isused, although additional external printers might be utilized.A plurality of the POS terminals might be connected to each other in a local areanetwork (LAN). The ECR might be connected either directly to a POS terminal or throughthe local network controller which communicates with the networked POS terminals via oneof the POS terminals which serves as a network gateway.4. POS Terminal OfflineFigure 11D illustrates an environment in which there is no access to telephone lines.In this environment, the POS terminal includes a core unit 30, a communications module 100with battery pack 176 as a power source, a second IC card reader incorporated within thecommunications module 100, and a charging stand (not shown). An integrated printer 108 isoptional. This user environment is suited where small cash transactions are done (ie. outsidefood stands, newspaper stands, buses, flea markets). These environments need portabilityand cannot access phone lines. The merchant does not need to do authorization onlinebecause of small transaction amounts and use of integrated circuit (IC) cards. ThisSUBSTITUTE SHEET (RULE 25)W0 98/10368I01520253035CA 02264667 1999-03-04PCT/U S97/ 1551483configuration might be used in other environments simply because of the unreliability of thetelecommunications systems.Transactions may be stored in a second IC card (“retailer card”) or in POS terminalmemory for later transfer to a host. PINs may or may not be used in this environment. Theclerk enters the sale amount, then hands the device to the customer for inserting his/her cardand PIN entry if any.5. POS Terminal OnlineIllustrated in Figure 1 IE is an environment where the POS temiinal is used online.In this environment, the POS Terminal includes a core unit 30, a standard communicationmodule 100 including modem, and integrated printer 108. Optional elements are an externalhigh speed printer as opposed to an integrated printer, an external PIN pad, and a secondIC/smart card reader. When IC cards are used as bank cards or for larger electronic pursetransactions, online authorization is needed periodically; i.e., when the transaction exceeds acertain amount or number of times used daily. This is advantageous when IC cards are usedin conjunction with magstripe cards for bank cards. The POS terminal does not need to beportable in many retail sites where placed at point of sale. The clerk enters sale amount onthe POS terminal and then gives the customer the POS terminal for card insert and PIN entryon the key pad of the POS Terminal, or an external PIN pad can be attached when preferred.A second IC card reader can be used to store keys and encrypt data sent to the host.6. POS Terminal Online--ECR semi—integratedFigure 1 IF illustrates the same user environment as shown in Figure 11E except thePOS terminal interfaces to an ECR 170 for transfer of sale amount and receipt printing bythe ECR. All host communication is still handled by the POS terminal. In this environment,the POS terminal includes a core unit 30 and a standard communications module 100. Thisenvironment is typical with older ECRs that can't handle EFT or when the retail operatorchooses to separate the EFT function from the ECR and have it handled by the POS terminal.7. POS Terminal--Online IC Terminal/PortableAs illustrated in Figure 11G, in this environment the POS terminal includes a coreunit 30, a portable communications module 100 with wireless communication capabilitysuch as RF, IR, etc., a battery pack 176, and a charging stand (not shown). An integratedprinter is optional. This environment requires portability in addition to the ability to handlelarge transaction amounts which require periodic online authorization. Typicalenvironments would be restaurants, temporary retail sites, arenas, etc. For example, ordersmight be taken and paid for while a person is standing in line waiting for their food.SUBSTITUTE SHEET (RULE 26)CA 02264667 1999-03-04WO 98/10353 PCT/US97ll55l484It is to be understood, that even though numerous characteristics and advantages ofthe invention have been set forth in the foregoing description, together with details of thestructure and function of the invention, the disclosure is illustrative only, and changes maybe made in detail, especially in matters of shape, size, and arrangement of the parts within5 the principles of the invention to the full extent indicated by the broad general meaning ofthe terms in which the appended claims are expressed.SUBSTITUTE SHEET (RULE 26)

Claims (14)

WHAT IS CLAIMED IS:

1. A terminal apparatus, comprising:
a core unit including;
a processor and associated memory, a keypad for inputting data, and a display operatively interconnected to the processor for displaying data;
a communications module attachable to a bottom surface of the core unit;
and the core unit and the communications module being interconnected by an electrical bus enabling control of the communications module by the processor of the core unit, the core unit being interchangeable with various communications modules.

2. An apparatus in accordance with claim 1, wherein the communication module includes a modem apparatus, the modem apparatus enabling communication with a remote host.

3. An apparatus in accordance with claim 1, wherein the communication module includes a network interface communication board enabling a plurality of the core units and their associated communication modules to be interconnected in a local area network arrangement.

3. An apparatus in accordance with claim 3, wherein at least one of the plurality of communication modules interconnected in the local area network arrangement include a modem apparatus, the modem apparatus enabling communication with a remote host.

4. An apparatus in accordance with claim 1, wherein the communication module includes a removable integral printer whereby information can be printed, the integral printer being electrically interconnected to the processor of the core unit by the electrical bus.

5. An apparatus in accordance with claim 1, wherein the communication module includes an electrical connection for interconnection to a device selected from the group consisting of: an electronic cash register, check reader, computer, external printer, modem, cash drawer, and biometric devices.

6. An apparatus in accordance with claim 1, wherein the communication module is electrically interconnected to a battery pack.

7. An apparatus in accordance with claim 1, wherein the core unit includes a magnetic stripe reader.

8. An apparatus in accordance with claim 7, wherein the core unit includes a smart card reader.

9. An apparatus in accordance with claim 8, wherein the core unit includes a PIN pad module for entry of a user's PIN during a transaction.

10. An apparatus in accordance with claim 1, wherein the core unit includes a first electrical bus connector projecting from its bottom surface and the communication module includes a second electrical bus connector projecting from its top surface, the first and second electrical bus connectors mechanically and electrically connecting to one another to provide an electrical bus from the processor of the core unit to electrical components in the communication module, the core unit and communication module being attached to one another by removable fasteners.

11. A POS modular terminal apparatus, comprising:
a core unit including;
a processor and associated memory, a key pad disposed on a top surface of the core unit for entry of a user's PIN during a transaction, a display displaying information, a magstripe reader for reading an encoded magstripe on a card, the magstripe reader being disposed proximate one side of the core unit, a smart card reader for reading smart cards, the smart card reader being disposed proximate a front end of the terminal, and a bottom surface including an electrical bus connector projecting therefrom; and a communication module including a top surface having an electrical bus connector projecting therefrom and electrically interconnectable to the electrical bus connector of the core unit so as to create an electrical bus between the core unit and the communication module, the communication module including communication control circuitry for interfacing with the processor of the core unit by way of the electrical bus, the communication control circuitry being electrically connected to electrical components in the communication module so as to allow control thereover by the processor of the core unit, the communication module being interchangeably connected to the bottom surface of the core unit by fasteners whereby the core unit may be interchangeably connected to different communication modules, the communication module providing power to the core unit.

12. An apparatus in accordance with claim 11, wherein time division multiplexing (TDM) communication protocol is used to communicate between the processor of the core unit and the communication circuitry of the communication module.

13. A terminal apparatus, comprising:
a processor and associated memory;
a keypad, operatively coupled to the processor, for inputting data to the associated memory;
a display, operatively coupled to the processor, for displaying data;
a communications module; and a time division multiplex (TDM) bus operatively coupled between the processor and communications module to enable control of the communications module by the processor, the TDM bus having at least two different data transfer rate channels multiplexed together in a frame.

14. A terminal apparatus, comprising:
a display for displaying data;
a keypad for inputting data; and a processor and associated memory, operatively coupled to the display and keypad, for processing application program functions in accordance with an operating system display driver which allows a first application program to exclusively control displayed elements within a first portion of the display and a second application program to exclusively control displayed elements within a second portion of the display.