38 replies to this topic

[armeniki]

Hi everyone,

OK .... so I've been searching the net for the past couple of years trying to piece together the various bits of info out there on this elusive software...

For those who don't know exactly what this is, it's the software which runs on a computer equipped with modems (apparently special ones?) that accepts calls and programs/maintains the various line of Millennium Payphones out there in the world.

I'm interested in buying one but as other users have posted on here, getting it to work at home is not exactly as easy as it sounds, unlike most other coin-operated phones.

From what I gathered, these phones require to be programmed to dial into the MM to receive their rate tables, etc. This is all documented in the Nortel Millennium payphone instruction manual which is floating around the Internet, which I have read thoroughly....

I think for those of us who are really interested in getting these phones to work at home, we should probably help eachother out and share some ideas on things we can do.

I remember a while back that there was someone who developed a MM Clone software which these phones can communicate with but have yet to confirm if that's true or not.

In the meantime, has anyone tried to follow the programming instructions in the manual and get the payphone to dial, say your own computer's modem? I'd be interested to see what results you would get (as far as the modem connection and the request for any particular command(s))...

Anyways, hopefully someone out there has the same interest as I do on this!

Cheers

Edited by armeniki, 30 November 2010 - 12:07 AM.

[ThoughtPhreaker]

I snagged a Millennium not too long ago, so I've been trying to find some way to connect with it myself. You'd probably be better off recording Millennium modem transmissions and attempting to make some sense of the protocol than you would actually finding the software. Millennium Manager not only isn't for sale (someone tells me the current deal is you pay Quortech a monthly fee to manage your phones for you), it doesn't run on a standard machine either. It's all written to run on a HP tandem machine. 

Please post the name of the third party software if you ever happen to find it. Dropping $30,000 to let a phone download a configuration file and get rate quotes doesn't sound like a whole lot of fun.

If you're curious about how it communicates, the phone itself uses an off the shelf 1200 baud modem, but unlike a conventional COCOT, it ignores incoming calls - it only communicates whenever it needs help placing a call, there's something wrong with the phone, or it needs to upload CDRs. I've heard that on phones that don't accept incoming calls, you can pick up, start placing a call to something that requires a rate quote, and three-way in another modem if you want to interact with it so long as it hears what sounds like dialtone. If the phone accepts incoming calls, I've heard ringing it while you're at the fake dialtone will work as well.

[PurpleJesus]

I snagged a Millennium not too long ago, so I've been trying to find some way to connect with it myself. You'd probably be better off recording Millennium modem transmissions and attempting to make some sense of the protocol than you would actually finding the software. Millennium Manager not only isn't for sale (someone tells me the current deal is you pay Quortech a monthly fee to manage your phones for you), it doesn't run on a standard machine either. It's all written to run on a HP tandem machine. 

Please post the name of the third party software if you ever happen to find it. Dropping $30,000 to let a phone download a configuration file and get rate quotes doesn't sound like a whole lot of fun.

If you're curious about how it communicates, the phone itself uses an off the shelf 1200 baud modem, but unlike a conventional COCOT, it ignores incoming calls - it only communicates whenever it needs help placing a call, there's something wrong with the phone, or it needs to upload CDRs. I've heard that on phones that don't accept incoming calls, you can pick up, start placing a call to something that requires a rate quote, and three-way in another modem if you want to interact with it so long as it hears what sounds like dialtone. If the phone accepts incoming calls, I've heard ringing it while you're at the fake dialtone will work as well.

I wonder if you could use a cross over cable to bypass the modem and see if anything interesting shows up, like a phone #, commands etc.

[armeniki]

Hey guys,

Well I'm definitely up for some testing and experimenting.

Just purchased one on an online auction... seems that there's quite a few telcos out there who are selling off their Millenniums and other payphones presumably since more and more people have mobiles....

Unfortunately, the one I got was a desktop model, I really wanted a coin model that I can put in my lounge... but that's ok, at least I'll have something to investigate with!

I'll post my findings as soon as I get it and start playing with it.


Cheers

[armeniki]

I wonder if you could use a cross over cable to bypass the modem and see if anything interesting shows up, like a phone #, commands etc.

Hmm.. interesting point but I suspect you'll need to know exactly where to connect to on the circuit board... not sure.

[Afterm4th]

not sure but this may be of interest

http://www.hackcanad...nes/craserv.txt

[armeniki]

Hey thanks although I've already seen that particular file (it's actually in my favourites)

I've been doing a lot searching and have probably milked Google dry LOL but am totally open to people posting any links, you never know!

Cheers

[Afterm4th]

Hey thanks although I've already seen that particular file (it's actually in my favourites)

I've been doing a lot searching and have probably milked Google dry LOL but am totally open to people posting any links, you never know!

Cheers

fuck yeah, THIS was the one i was actually looking for:

http://payphone-directory.org/nortel_millennium.pdf

[armeniki]

Yes I've got that too!

From my first post:
"This is all documented in the Nortel Millennium payphone instruction manual which is floating around the Internet, which I have read thoroughly...."

Tell you what though, if you have a copy of the Millennium Manager manual THAT would be really cool!! LOL

Anyways, still waiting on my phone to arrive in the mail...

[Andrew]

There is no way to obtain a copy of Millennium Manager, like TP said it is software that runs only on the Tandem NonStop Himalaya series servers (bought by Compaq, then HP.)
https://home.comcast...yaServerspd.pdf
https://home.comcast...NonStopOVPD.pdf
https://home.comcast...mdevsuiteov.pdf

Quortech bought the Millennium line from Nortel when they diversified their portfolio in 2000. Since Nortel was really up tight about their products, there is no documentation on the Millennium phones (other than that manual that was stolen and scanned in.)
http://www.thefreeli...ETS.-a061565798
http://investing.bus...rivcapId=701260

I believe that I have some pictures of the insides of a few if anyone is interested.

-Andrew

[armeniki]

Hi guys,

Ok my phone has FINALLY arrived... and I've got it all setup to connect to my PC.

So in the midst of trying to figure out how to communicate with it and try get some programming into it, I was wondering if anyone has any ideas or knows what terminal emulation I should be using?

I've got the phone trying to dial my modem and I'm just using HyperTerm at the moment. I've set it for 8N1 and 7E1 (they're the most common) but when it connects (at 1200 baud) the phone displays "Please wait download in progress" and then I get the following prompts:

CONNECT 1200/NONE
QC7W)$J2
QC7W)$J2
xpTvch#Sw/9wMbj
NO CARRIER

then I tried another setting.. and got (the boxes below were actually hearts - they don't seem to copy/paste here)

CONNECT 1200/NONE
$xcu*Q#a[f!X.
NO CARRIER

Anyways, I'm going to keep experimenting with this as time permits but ideally i'd like to get it at least to produce it's recorded dial tone and then even let me dial some numbers out.

Cheers

[armeniki]

Hi there,

So here are some photos of the outside and insides..... along with some some info I've found:

There are two chips (UV/OTP EEPROMS ST m27c4001) about 15x15 which are for the Firmware and I'm assuming Voiceware (since it's labeled V/W).
Data sheet can be found here: http://www.datasheet...ronics/2385.pdf

The phone will not start up with the F/W chip removed... however, it will start up with the V/W chip removed, I'm assuming because it's not needed in its 'not installed' state.

There's also a part made by Elctotel which appears to be a programmable number/toll dialing blocker. These are quite commonly available in many telecom equipment catalogues. Basically, they operate without power and once programmed can restrict any type of calls. This is how this phone does it. It's not a part of the phone itself but connects to it and is between the telephone line and the phone. So when the system programs the phone to restrict calls of certain types during power outages, it programs this module instead, which means that it can be removed.

Part numbers: 111-5126 and 6002809528 (Elcotel)

The display is the standard 2x20 VDF part number: qdvf220a-2

The main board is part number: nt5u1028

There are part numbers which I'm not sure of: nt5u1021 01, nt5u01ja 01, and nt5u1018

Finally, there are two batteries on the main board. They are both soldered on and one is located in the area just behind where the handset would be, about 3mm in diameter, and the other is much larger and is located beneath the card reader module. Not sure what would happen if these were removed/shorted out...

Attached Files

•  IMAG0002.jpg   240.67K   11 downloads
•  IMAG0004.jpg   223.52K   7 downloads
•  IMAG0005.jpg   325.23K   5 downloads
•  IMAG0006.jpg   283.59K   5 downloads
•  IMAG0007.jpg   299.11K   4 downloads
•  IMAG0008.jpg   333.25K   5 downloads
•  IMAG0009.jpg   408.82K   8 downloads
•  IMAG0010.jpg   266.72K   5 downloads
•  IMAG0011.jpg   378.44K   7 downloads

Edited by armeniki, 17 February 2011 - 06:56 PM.

[nyphonejacks]

Hi there,

So here are some photos of the outside and insides..... along with some some info I've found:

There are two chips (UV/OTP EEPROMS ST m27c4001) about 15x15 which are for the Firmware and I'm assuming Voiceware (since it's labeled V/W).
Data sheet can be found here: http://www.datasheet...ronics/2385.pdf

The phone will not start up with the F/W chip removed... however, it will start up with the V/W chip removed, I'm assuming because it's not needed in its 'not installed' state.

There's also a part made by Elctotel which appears to be a programmable number/toll dialing blocker. These are quite commonly available in many telecom equipment catalogues. Basically, they operate without power and once programmed can restrict any type of calls. This is how this phone does it. It's not a part of the phone itself but connects to it and is between the telephone line and the phone. So when the system programs the phone to restrict calls of certain types during power outages, it programs this module instead, which means that it can be removed.

Part numbers: 111-5126 and 6002809528 (Elcotel)

The display is the standard 2x20 VDF part number: qdvf220a-2

The main board is part number: nt5u1028

There are part numbers which I'm not sure of: nt5u1021 01, nt5u01ja 01, and nt5u1018

Finally, there are two batteries on the main board. They are both soldered on and one is located in the area just behind where the handset would be, about 3mm in diameter, and the other is much larger and is located beneath the card reader module. Not sure what would happen if these were removed/shorted out...

those pics look very much like a Meridian phone...

[ThoughtPhreaker]

Finally, there are two batteries on the main board. They are both soldered on and one is located in the area just behind where the handset would be, about 3mm in diameter, and the other is much larger and is located beneath the card reader module. Not sure what would happen if these were removed/shorted out...

One of those is to keep the phone running when the power dies. If you're interested, that seperate board with the 27C256 EPROM is the inferred answer supervision module.

In the meantime, has anyone tried to follow the programming instructions in the manual and get the payphone to dial, say your own computer's modem?

Yup. It'll spit out a handshake of some sort. Oddly enough, if you try pasting in something from a conversation with a Millennium receiving a rate quote from the millennium manager software, it seems to just ignore it. I wonder if I have the parity settings wrong.

In any case, the error codes from the millennium manager are human readable, oddly enough. If you'd like to take a stab at it, though, I've attached a recording of a real, in-service Millennium trying to get the price for a number in the 458 NPA (it's the only way I could get this particular one to call out). Let me know if you want another one of these, I pass by a bunch of Millenniums daily that want a real rate quote for every call.
 miltran_2.zip   1.22MB   8 downloads

EDIT: By the way, I like your number card

Edited by ThoughtPhreaker, 18 February 2011 - 08:06 AM.

[armeniki]

Thanks ThoughtPhreaker for that!

I wonder if I have the parity settings wrong.

You know, I remember someone saying that these modems run at 1200 baud BUT they use 5-bit code?? Not sure how modems work in that much detail so I'm going to have to read up on that... I was presuming that setting my Terminal software to 5 bit would work??? However, now that I have seen the interaction in your audio file, I'm convinced that's part of the problem.... have you noticed that when your phone dials into your computer the handshake is much longer? In this recording, it's not... there's the initial beep and then that's it.. whilst with the computer it's the first beep, then the higher pitched beep, and then some more handshaking... hmmmm

I noticed the numbers being dialled out were only 9 digits?? I may have missed one but I was trying to see what the number was to the MillManager it was dialling to...

Let me know if you want another one of these

You know, I remember that these phones took forever when I tried to dial an overseas call... for example, if I dialled 01161294620300 which is a landline in Australia, it would take a while for it to get the rates for it.. so maybe you can record a call like that to see how much data it's getting? If you can also record the part where it says "Please insert your card" before dialilng that would be nice too!

By the way, I like your number card

Thanks!! I was wondering if someone would notice that I'm still working on the design for the small card below and the one underneath the handset.

Cheers

Edited by armeniki, 19 February 2011 - 04:14 AM.

[chronomex]

By the way, I like your number card

Thanks!! I was wondering if someone would notice that I'm still working on the design for the small card below and the one underneath the handset.

Yeah, tooootally bitchen. Post more pictures when you've got something finalized for those, I look forward to seeing how it turns out What software do you use for it?

[armeniki]

ThoughtPhreaker: I've taken a look at the modem communications and have played it back a few times getting the following:

[Connection êm 1111111qŸÖÀ¬WÝ8@N6ÛrßHM¯ÎÔfܽ²»ûª!o´ö29¡+.1,Ê}È'!±
NO CARRIER

NO CARRIER

CONNECT 1200

[Connectionà]Ö 11111111¤¦tw=;o=/jb6>í̧AGÌ‚1vÊx´Z~ø
NO CARRIER

This was a crude setup however with microphones taped to handsets.. I'm actually going to setup the recording to playback as an extension on my Asterisk box... hopefully my modem can get more out of it with a quieter and "direct" connection....

By all means if you do get any more of these please send through

Cheers

PS Now that I think about it.. maybe the 5-bit thing isn't true... since I'm able to read the first word "[Connection]" I'm pretty sure that the modem configuration is indeed 8N1 at 1200bps. When answering using a modem however, make sure to type in ATB1 to force US Answer Mode.

Edited by armeniki, 23 February 2011 - 11:03 PM.

[armeniki]

By the way, I like your number card

Thanks!! I was wondering if someone would notice that I'm still working on the design for the small card below and the one underneath the handset.

Yeah, tooootally bitchen. Post more pictures when you've got something finalized for those, I look forward to seeing how it turns out What software do you use for it?

Hi Chronomex,

Just plain old MS Word! Will take more pics ones finalised..

Cheers!

[PurpleJesus]

ThoughtPhreaker: I've taken a look at the modem communications and have played it back a few times getting the following:

[Connection êm 1111111qŸÖÀ¬WÝ8@N6ÛrßHM¯ÎÔfܽ²»ûª!o´ö29¡+.1,Ê}È'!±
NO CARRIER

NO CARRIER

CONNECT 1200

[Connectionà]Ö 11111111¤¦tw=;o=/jb6>í̧AGÌ‚1vÊx´Z~ø
NO CARRIER

This was a crude setup however with microphones taped to handsets.. I'm actually going to setup the recording to playback as an extension on my Asterisk box... hopefully my modem can get more out of it with a quieter and "direct" connection....

By all means if you do get any more of these please send through

Cheers

PS Now that I think about it.. maybe the 5-bit thing isn't true... since I'm able to read the first word "[Connection]" I'm pretty sure that the modem configuration is indeed 8N1 at 1200bps. When answering using a modem however, make sure to type in ATB1 to force US Answer Mode.

I used to have a similar problem on my c64 when doing 1200 bps.. I found that if I manually set it to something like 1210 bps it cleared up junk like that.. just a thought.

[armeniki]

I used to have a similar problem on my c64 when doing 1200 bps.. I found that if I manually set it to something like 1210 bps it cleared up junk like that.. just a thought.

Hey there, which terminal software do you use?? To date I haven't seen one that you can manually set to 1210... I've also checked my modem's instructions (it's an External USR) and there's no command to set it to 1210....

Cheers