armeniki

Millennium Manager Application

40 posts in this topic

Hi everyone,

OK .... so I've been searching the net for the past couple of years trying to piece together the various bits of info out there on this elusive software...

For those who don't know exactly what this is, it's the software which runs on a computer equipped with modems (apparently special ones?) that accepts calls and programs/maintains the various line of Millennium Payphones out there in the world.

I'm interested in buying one but as other users have posted on here, getting it to work at home is not exactly as easy as it sounds, unlike most other coin-operated phones.

From what I gathered, these phones require to be programmed to dial into the MM to receive their rate tables, etc. This is all documented in the Nortel Millennium payphone instruction manual which is floating around the Internet, which I have read thoroughly....

I think for those of us who are really interested in getting these phones to work at home, we should probably help eachother out and share some ideas on things we can do.

I remember a while back that there was someone who developed a MM Clone software which these phones can communicate with but have yet to confirm if that's true or not.

In the meantime, has anyone tried to follow the programming instructions in the manual and get the payphone to dial, say your own computer's modem? I'd be interested to see what results you would get (as far as the modem connection and the request for any particular command(s))...

Anyways, hopefully someone out there has the same interest as I do on this! :)

Cheers

Edited by armeniki
0

Share this post


Link to post
Share on other sites

I snagged a Millennium not too long ago, so I've been trying to find some way to connect with it myself. You'd probably be better off recording Millennium modem transmissions and attempting to make some sense of the protocol than you would actually finding the software. Millennium Manager not only isn't for sale (someone tells me the current deal is you pay Quortech a monthly fee to manage your phones for you), it doesn't run on a standard machine either. It's all written to run on a HP tandem machine. 

Please post the name of the third party software if you ever happen to find it. Dropping $30,000 to let a phone download a configuration file and get rate quotes doesn't sound like a whole lot of fun.

If you're curious about how it communicates, the phone itself uses an off the shelf 1200 baud modem, but unlike a conventional COCOT, it ignores incoming calls - it only communicates whenever it needs help placing a call, there's something wrong with the phone, or it needs to upload CDRs. I've heard that on phones that don't accept incoming calls, you can pick up, start placing a call to something that requires a rate quote, and three-way in another modem if you want to interact with it so long as it hears what sounds like dialtone. If the phone accepts incoming calls, I've heard ringing it while you're at the fake dialtone will work as well.

0

Share this post


Link to post
Share on other sites

I snagged a Millennium not too long ago, so I've been trying to find some way to connect with it myself. You'd probably be better off recording Millennium modem transmissions and attempting to make some sense of the protocol than you would actually finding the software. Millennium Manager not only isn't for sale (someone tells me the current deal is you pay Quortech a monthly fee to manage your phones for you), it doesn't run on a standard machine either. It's all written to run on a HP tandem machine. 

Please post the name of the third party software if you ever happen to find it. Dropping $30,000 to let a phone download a configuration file and get rate quotes doesn't sound like a whole lot of fun.

If you're curious about how it communicates, the phone itself uses an off the shelf 1200 baud modem, but unlike a conventional COCOT, it ignores incoming calls - it only communicates whenever it needs help placing a call, there's something wrong with the phone, or it needs to upload CDRs. I've heard that on phones that don't accept incoming calls, you can pick up, start placing a call to something that requires a rate quote, and three-way in another modem if you want to interact with it so long as it hears what sounds like dialtone. If the phone accepts incoming calls, I've heard ringing it while you're at the fake dialtone will work as well.

I wonder if you could use a cross over cable to bypass the modem and see if anything interesting shows up, like a phone #, commands etc.

0

Share this post


Link to post
Share on other sites

Hey guys,

Well I'm definitely up for some testing and experimenting.

Just purchased one on an online auction... seems that there's quite a few telcos out there who are selling off their Millenniums and other payphones presumably since more and more people have mobiles....

Unfortunately, the one I got was a desktop model, I really wanted a coin model that I can put in my lounge... but that's ok, at least I'll have something to investigate with!

I'll post my findings as soon as I get it and start playing with it.

Cheers

0

Share this post


Link to post
Share on other sites

I wonder if you could use a cross over cable to bypass the modem and see if anything interesting shows up, like a phone #, commands etc.

Hmm.. interesting point but I suspect you'll need to know exactly where to connect to on the circuit board... not sure.

0

Share this post


Link to post
Share on other sites

Hey thanks although I've already seen that particular file (it's actually in my favourites)

I've been doing a lot searching and have probably milked Google dry LOL but am totally open to people posting any links, you never know!

Cheers

0

Share this post


Link to post
Share on other sites

Hey thanks although I've already seen that particular file (it's actually in my favourites)

I've been doing a lot searching and have probably milked Google dry LOL but am totally open to people posting any links, you never know!

Cheers

fuck yeah, THIS was the one i was actually looking for:

http://payphone-directory.org/nortel_millennium.pdf

0

Share this post


Link to post
Share on other sites

Yes I've got that too!

From my first post:

"This is all documented in the Nortel Millennium payphone instruction manual which is floating around the Internet, which I have read thoroughly...."

Tell you what though, if you have a copy of the Millennium Manager manual THAT would be really cool!! LOL

Anyways, still waiting on my phone to arrive in the mail... :wink:

0

Share this post


Link to post
Share on other sites

There is no way to obtain a copy of Millennium Manager, like TP said it is software that runs only on the Tandem NonStop Himalaya series servers (bought by Compaq, then HP.)

https://home.comcast.net/~tmo7734/images/NSHimalayaServerspd.pdf

https://home.comcast.net/~tmo7734/images/HPNonStopOVPD.pdf

https://home.comcast.net/~tmo7734/images/tdmdevsuiteov.pdf

Quortech bought the Millennium line from Nortel when they diversified their portfolio in 2000. Since Nortel was really up tight about their products, there is no documentation on the Millennium phones (other than that manual that was stolen and scanned in.)

http://www.thefreelibrary.com/QUORTECH+ACQUIRES+NORTEL+NETWORKS%27+MILLENIUM+BUSINESS+ASSETS.-a061565798

http://investing.businessweek.com/research/stocks/private/snapshot.asp?privcapId=701260

I believe that I have some pictures of the insides of a few if anyone is interested.

-Andrew

0

Share this post


Link to post
Share on other sites

Hi guys,

Ok my phone has FINALLY arrived... and I've got it all setup to connect to my PC.

So in the midst of trying to figure out how to communicate with it and try get some programming into it, I was wondering if anyone has any ideas or knows what terminal emulation I should be using?

I've got the phone trying to dial my modem and I'm just using HyperTerm at the moment. I've set it for 8N1 and 7E1 (they're the most common) but when it connects (at 1200 baud) the phone displays "Please wait download in progress" and then I get the following prompts:

CONNECT 1200/NONE

QC7W)$J2

QC7W)$J2

xpTvch#Sw/9wMbj

NO CARRIER

then I tried another setting.. and got (the boxes below were actually hearts - they don't seem to copy/paste here)

CONNECT 1200/NONE

$xcu*Q#a[f!X.

NO CARRIER

Anyways, I'm going to keep experimenting with this as time permits but ideally i'd like to get it at least to produce it's recorded dial tone and then even let me dial some numbers out.

Cheers

0

Share this post


Link to post
Share on other sites

Hi there,

So here are some photos of the outside and insides..... along with some some info I've found:

There are two chips (UV/OTP EEPROMS ST m27c4001) about 15x15 which are for the Firmware and I'm assuming Voiceware (since it's labeled V/W).

Data sheet can be found here: http://www.datasheet...ronics/2385.pdf

The phone will not start up with the F/W chip removed... however, it will start up with the V/W chip removed, I'm assuming because it's not needed in its 'not installed' state.

There's also a part made by Elctotel which appears to be a programmable number/toll dialing blocker. These are quite commonly available in many telecom equipment catalogues. Basically, they operate without power and once programmed can restrict any type of calls. This is how this phone does it. It's not a part of the phone itself but connects to it and is between the telephone line and the phone. So when the system programs the phone to restrict calls of certain types during power outages, it programs this module instead, which means that it can be removed.

Part numbers: 111-5126 and 6002809528 (Elcotel)

The display is the standard 2x20 VDF part number: qdvf220a-2

The main board is part number: nt5u1028

There are part numbers which I'm not sure of: nt5u1021 01, nt5u01ja 01, and nt5u1018

Finally, there are two batteries on the main board. They are both soldered on and one is located in the area just behind where the handset would be, about 3mm in diameter, and the other is much larger and is located beneath the card reader module. Not sure what would happen if these were removed/shorted out...

post-23987-064994000 1297986124_thumb.jp

post-23987-025127200 1297986130_thumb.jp

post-23987-045643300 1297986137_thumb.jp

post-23987-017495400 1297986144_thumb.jp

post-23987-046816500 1297986154_thumb.jp

post-23987-055202300 1297986164_thumb.jp

post-23987-053711800 1297986177_thumb.jp

post-23987-053689500 1297986183_thumb.jp

post-23987-033885900 1297986191_thumb.jp

Edited by armeniki
0

Share this post


Link to post
Share on other sites

Hi there,

So here are some photos of the outside and insides..... along with some some info I've found:

There are two chips (UV/OTP EEPROMS ST m27c4001) about 15x15 which are for the Firmware and I'm assuming Voiceware (since it's labeled V/W).

Data sheet can be found here: http://www.datasheet...ronics/2385.pdf

The phone will not start up with the F/W chip removed... however, it will start up with the V/W chip removed, I'm assuming because it's not needed in its 'not installed' state.

There's also a part made by Elctotel which appears to be a programmable number/toll dialing blocker. These are quite commonly available in many telecom equipment catalogues. Basically, they operate without power and once programmed can restrict any type of calls. This is how this phone does it. It's not a part of the phone itself but connects to it and is between the telephone line and the phone. So when the system programs the phone to restrict calls of certain types during power outages, it programs this module instead, which means that it can be removed.

Part numbers: 111-5126 and 6002809528 (Elcotel)

The display is the standard 2x20 VDF part number: qdvf220a-2

The main board is part number: nt5u1028

There are part numbers which I'm not sure of: nt5u1021 01, nt5u01ja 01, and nt5u1018

Finally, there are two batteries on the main board. They are both soldered on and one is located in the area just behind where the handset would be, about 3mm in diameter, and the other is much larger and is located beneath the card reader module. Not sure what would happen if these were removed/shorted out...

those pics look very much like a Meridian phone...

0

Share this post


Link to post
Share on other sites
Finally, there are two batteries on the main board. They are both soldered on and one is located in the area just behind where the handset would be, about 3mm in diameter, and the other is much larger and is located beneath the card reader module. Not sure what would happen if these were removed/shorted out...

One of those is to keep the phone running when the power dies. If you're interested, that seperate board with the 27C256 EPROM is the inferred answer supervision module.

In the meantime, has anyone tried to follow the programming instructions in the manual and get the payphone to dial, say your own computer's modem?

Yup. It'll spit out a handshake of some sort. Oddly enough, if you try pasting in something from a conversation with a Millennium receiving a rate quote from the millennium manager software, it seems to just ignore it. I wonder if I have the parity settings wrong.

In any case, the error codes from the millennium manager are human readable, oddly enough. If you'd like to take a stab at it, though, I've attached a recording of a real, in-service Millennium trying to get the price for a number in the 458 NPA (it's the only way I could get this particular one to call out). Let me know if you want another one of these, I pass by a bunch of Millenniums daily that want a real rate quote for every call.

miltran_2.zip

EDIT: By the way, I like your number card :)

Edited by ThoughtPhreaker
0

Share this post


Link to post
Share on other sites

Thanks ThoughtPhreaker for that!

I wonder if I have the parity settings wrong.

You know, I remember someone saying that these modems run at 1200 baud BUT they use 5-bit code?? Not sure how modems work in that much detail so I'm going to have to read up on that... I was presuming that setting my Terminal software to 5 bit would work??? However, now that I have seen the interaction in your audio file, I'm convinced that's part of the problem.... have you noticed that when your phone dials into your computer the handshake is much longer? In this recording, it's not... there's the initial beep and then that's it.. whilst with the computer it's the first beep, then the higher pitched beep, and then some more handshaking... hmmmm

I noticed the numbers being dialled out were only 9 digits?? I may have missed one but I was trying to see what the number was to the MillManager it was dialling to...

Let me know if you want another one of these
You know, I remember that these phones took forever when I tried to dial an overseas call... for example, if I dialled 01161294620300 which is a landline in Australia, it would take a while for it to get the rates for it.. so maybe you can record a call like that to see how much data it's getting? If you can also record the part where it says "Please insert your card" before dialilng that would be nice too! :)

By the way, I like your number card :)
Thanks!! I was wondering if someone would notice that :) I'm still working on the design for the small card below and the one underneath the handset.

Cheers :)

Edited by armeniki
0

Share this post


Link to post
Share on other sites

By the way, I like your number card :)

Thanks!! I was wondering if someone would notice that :) I'm still working on the design for the small card below and the one underneath the handset.

Yeah, tooootally bitchen. Post more pictures when you've got something finalized for those, I look forward to seeing how it turns out :) What software do you use for it?

0

Share this post


Link to post
Share on other sites

ThoughtPhreaker: I've taken a look at the modem communications and have played it back a few times getting the following:

[Connection êm 1111111qŸÖÀ¬WÝ8@N6ÛrßHM¯ÎÔfܽ²»ûª!o´ö29¡+.1,Ê}È'!±

NO CARRIER

NO CARRIER

CONNECT 1200

[Connectionà]Ö 11111111¤¦tw=;o=/jb6>í̧AGÌ‚1vÊx´Z~ø

NO CARRIER

This was a crude setup however with microphones taped to handsets.. I'm actually going to setup the recording to playback as an extension on my Asterisk box... hopefully my modem can get more out of it with a quieter and "direct" connection....

By all means if you do get any more of these please send through

Cheers

PS Now that I think about it.. maybe the 5-bit thing isn't true... since I'm able to read the first word "[Connection]" I'm pretty sure that the modem configuration is indeed 8N1 at 1200bps. When answering using a modem however, make sure to type in ATB1 to force US Answer Mode.

Edited by armeniki
0

Share this post


Link to post
Share on other sites

By the way, I like your number card :)

Thanks!! I was wondering if someone would notice that :) I'm still working on the design for the small card below and the one underneath the handset.

Yeah, tooootally bitchen. Post more pictures when you've got something finalized for those, I look forward to seeing how it turns out :) What software do you use for it?

Hi Chronomex,

Just plain old MS Word! Will take more pics ones finalised..

Cheers!

0

Share this post


Link to post
Share on other sites

ThoughtPhreaker: I've taken a look at the modem communications and have played it back a few times getting the following:

[Connection êm 1111111qŸÖÀ¬WÝ8@N6ÛrßHM¯ÎÔfܽ²»ûª!o´ö29¡+.1,Ê}È'!±

NO CARRIER

NO CARRIER

CONNECT 1200

[Connectionà]Ö 11111111¤¦tw=;o=/jb6>í̧AGÌ‚1vÊx´Z~ø

NO CARRIER

This was a crude setup however with microphones taped to handsets.. I'm actually going to setup the recording to playback as an extension on my Asterisk box... hopefully my modem can get more out of it with a quieter and "direct" connection....

By all means if you do get any more of these please send through

Cheers

PS Now that I think about it.. maybe the 5-bit thing isn't true... since I'm able to read the first word "[Connection]" I'm pretty sure that the modem configuration is indeed 8N1 at 1200bps. When answering using a modem however, make sure to type in ATB1 to force US Answer Mode.

I used to have a similar problem on my c64 when doing 1200 bps.. I found that if I manually set it to something like 1210 bps it cleared up junk like that.. just a thought.

0

Share this post


Link to post
Share on other sites
I used to have a similar problem on my c64 when doing 1200 bps.. I found that if I manually set it to something like 1210 bps it cleared up junk like that.. just a thought.

Hey there, which terminal software do you use?? To date I haven't seen one that you can manually set to 1210... I've also checked my modem's instructions (it's an External USR) and there's no command to set it to 1210....

Cheers

0

Share this post


Link to post
Share on other sites
I used to have a similar problem on my c64 when doing 1200 bps.. I found that if I manually set it to something like 1210 bps it cleared up junk like that.. just a thought.

Hey there, which terminal software do you use?? To date I haven't seen one that you can manually set to 1210... I've also checked my modem's instructions (it's an External USR) and there's no command to set it to 1210....

Cheers

Not sure how it's done today. the modem itself would think 1200 bps, but set the computers I/O uart to clock at 1210 bps.. On the C64 it was just a little math and poking 2 bytes the uart would then use for it's clock divider.

I just posted that cause I had a similar problem when I wrote a BBS program 25 years ago..

Googling around, try Realterm : http://realterm.sourceforge.net/

it says it can accept any rate you specify, it depends on the hardware you have if it'll be accepted or not.

Failing that, I'd say sniff the rx/tx lines with a logic analyzer and do some math to verify the speed and other settings.

0

Share this post


Link to post
Share on other sites

I pass by a bunch of Millenniums daily that want a real rate quote for every call.

Heh, well, I lied. My schedule has been shifting around a lot, so I think the earliest chance I might get to have at that phone will be early next week.

I noticed the numbers being dialled out were only 9 digits?? I may have missed one but I was trying to see what the number was to the MillManager it was dialling to...

No, it was ten digits. I was just making a really big kluge to isolate both channels, which involved Asterisk and a DID that uses RFC-2833. Out of band DTMF being the most useless thing in the world, it naturally broke it on the recording. The way I recorded it is more or less just poking at an inherent flaw in the way the phone works. The process went something like this;

1) Call Asterisk DID that records call, waits forever for a number with cellular phone

2) Pick up Millennium and get fake dialtone

3) While sitting on fake dialtone, make new call on mobile phone to Millennium

4) Dial number that requires modem usage on the Millennium

5) Millennium goes offhook to dial out, answering incoming call from the mobile phone

6) Quickly bridge call to asterisk and Millennium, and mute cell

7) Millennium gives Asterisk toll-free reporting number

8) Sans hax, call goes through semi-normally.

In retrospect, I don't think you have to give it a real dialtone. Just anything that sounds like some kind of tone - even humming into your phone will probably work.

This was a crude setup however with microphones taped to handsets.. I'm actually going to setup the recording to playback as an extension on my Asterisk box... hopefully my modem can get more out of it with a quieter and "direct" connection....

You could probably get away with just making an electrical interface between a phone patch and your modem. The idea of isolating the two channels is to make it as clean as possible, so you can afford a little noise later :) . Are you sure it's 8N1, though? I tried a bunch of different parity settings, and [Connection] always came through without a problem. I'm by no means any sort of modem veteran, but I think the fact that we're getting semi-random stuff in between might indicate a problem with the parity/stop bits/whatnot.

0

Share this post


Link to post
Share on other sites

Hi ThoughtPhreaker,

Well that's quite an elaborate albeit necessary process! Very clever though :)

Are you sure it's 8N1, though? I tried a bunch of different parity settings, and [Connection] always came through without a problem.

Oh really? Ok that's interesting... I'll fiddle around with that this week... *however* I'm wondering if the connection recording you have is too short or incomplete or perhaps due to static... that's why towards the end it becomes gibberish? just a thought....

If you're able to get the Millennium Manager's number as it dials out that would be helpful as well.... I'm wondering if I can use it to configure "install" the the phone that I have (pictured above) whilst I record the entire conversation (via Asterisk)... that would be a very lengthy "transaction" between the two and could be a big help in figuring out protocols...

an inherent flaw in the way the phone works

Definitely a flaw but I suspect one that can be fixed easily by the telco as this is working only because the physical phoneline accepts incoming calls even though the phone itself won't ring (hope they don't notice that)..... best to take advantage of this as long as possible :)

PurpleJesus: Thanks for that.. I'll play with these settings and see how I go.

Cheers

Edited by armeniki
0

Share this post


Link to post
Share on other sites

http://thoughtphreak.../millenown.flac

Well, that took way longer than it should've, but I got it. For reference, I dialed 212-736-5000, and was quoted $5.05 for one minute. Who would (could?) actually pay that is beyond me.

If you're able to get the Millennium Manager's number as it dials out that would be helpful as well.... I'm wondering if I can use it to configure "install" the the phone that I have (pictured above) whilst I record the entire conversation (via Asterisk)... that would be a very lengthy "transaction" between the two and could be a big help in figuring out protocols...

The tandem machine probably takes a look at the serial number you send forward, or even uses it to authenticate. You might want to be careful. Or find yourself a serial number >.>

Just fyi, the phone will call a different reporting number depending on what company owns it, so if it really authenticates based on serial number, you might want to grab the reporting number from the set.

Edited by ThoughtPhreaker
0

Share this post


Link to post
Share on other sites

Thanks for that ThoughtPhreaker!

$5.05 for one minute. Who would (could?) actually pay that is beyond me.

LOL! And the telcos wonder why no one uses payphones any longer...

Just fyi, the phone will call a different reporting number depending on what company owns it

This could be true but I'm not sure just yet... Personally I'm thinking that since Quortech owns all of the management equipment and they licence everything out, there's only one main number that can be reached from everywhere.

I think it's both or either the phone number or the serial number which tells Quortech where the phone is/which telco it belongs to.. during the Install process the set wants to know its telephone number and a serial number.... so perhaps when MM receives a call from phone 311 555 2368 and serial 12345678 it'll look it up and say 'oh that's Bob's Telco in Punxsutawney PA' we'll load profile xyz for it'... and so on... I could be completely wrong but that's my thought...

Anyways, just as an aside..... from what I've noticed about the way the Install procedure works, the MM will load the following into each set:

1) Time/Date

2) Company Banner (which can be displayed or not)

3) Which language is displayed by default (English/Spanish/French)

4) A list of numbers which can be dialled at no cost

5) A list of local numbers and the local cost.

6) A list of numbers to be programmed into any speed dial buttons

7) A schedule of when to dial in to report CDRs

8) A list of numbers which can be dialled out during a power failure (this programs that extra Elcotel board)

9) Whether its modem is to answer any incomings calls or not, if the line accepts incoming calls in the first place.

10) A validation string to verify any calling card(s) - this is simply to say that the card is valid/acceptable, the actual approval/processing takes place server side.

11) A list of allowable Craft access numbers.

12) A list of allowable Install/Coin Collection/etc. PINs for techs to use.

I think that's about it...

Ok - now to figure out this serial number business....

Edited by armeniki
0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now