The Story Behind OpenPayphone (Part 1: New (Old) Phone, Who ‘Dis?)

The payphone, a tall chrome-fronted unitMy wife of 13 years both knows me and loves me. I know this to be true, because for my 39th birthday she surprised me with a 30-year old, 48 lb gift repackaged into an old vacuum cleaner box. You’ve really got to know a person to land that plane.

Now, I’m usually fairly good at guessing, at least ballpark, what my gifts are. This time, however, I was dumbfounded, and very surprised when I opened it to reveal a payphone. It was an iconic looking phone, with a chrome vault door, square metal buttons, and a helpful reminder, embossed near the top, that it accepted U.S. COINS ONLY. She had picked it up for under a hundred dollars at a local antiques shop, Apple Annie’s, just outside of Leavenworth, Washington, which is quite a steal considering most refurbs of any kind will run you, easily, $400 or more with shipping.

The payphone before teardownThis was not an entirely out-of-left-field gift for me. I’ve enjoyed playing with old phones, and over the years we have built up a small local network with a couple of WE-554s (baby blue for the kitchen, tan for the barn), a dark green WE-500 in my office, a red 90’s slimline in the garden shed. So adding a payphone to our little network seemed like a great idea! After all, these things were connected to regular POTS lines like other phones, right? How hard could it be?

The first order of business was figuring out what I had here. I have zero experience with payphones, other than as a user. I, like many people my age, I assume, primarily used them to make crank calls to toll free numbers when I was bored and left at the pool all day. On occasions when things had not gone to plan, I can recall calling for an unscheduled pickup, usually with leftover bus fare folded inside a wet transfer slip in the zipper pocket of my trunks.

On the outside were two visible locks. The functions of both seemed fairly obvious. One held the top housing, including the handset, to the body of the phone, and the other protected access to (what I now know is called) the coin vault, just left of the coin return door.

Unfortunately this phone did not include any keys, which might have been a pretty annoying problem, except that the coin vault had not been completely locked, so it was easily removed by simply inserting a screw driver into the t-key hole on the front and lifting it out the door. Inside I found an intact vault box labeled K66071, which contained a single dime, apparently minted in Denver in 1984. Score. The fortified lock, which would have been difficult to remove from the outside, was easily unbolted from the inside. The interesting bits, however, were still locked away in the top part.

After doing a little research, I learned that what needed to happen next would either be very easy or very hard, and to the untrained eye there wasn’t a great way to know which. As it turns out, these top locks come in a few different styles, some are very secure and difficult to both pick and drill, and some are on par with file-cabinet locks, easily drilled out with a carbide drill bit.

The top housing lockI remembered I had been given a small lock picking toolkit, years before, as an unrelated gift, though I never learned to use it. After a half-hour of frantic raking, my zero lock picking experience had yielded zero picked locks, despite having just learned everything about lock picking from an introductory youtube video on the subject. Impatient, I positioned the phone under a drill press and bore down until the pins were shredded into tiny short-circuit flakes scattered all over the inside. At least I was in.

The drilled-out lockAt this point things got more interesting, and I quickly realized this may not be a simple matter of locating the ring and tip terminals and running some UTP out the back. Behold, … uh … what am I looking at?

It was obviously late ‘80s early ‘90s tech, based on the chip markings. We’ve got a product name, “Earnest Telecom, Inc, Model D3” in silkscreen, which is a good start, but I’ll look that up later. We’ve got a couple Atmel EEPROMs (32 kB socketed and 128 kB soldered), some NEC RAM (65 kB worth), and, hello, a 6502-based microcontroller from a company I’d never heard of, CMDu. There were also several 7400-series logic chips, an RT clock chip, a voice synth chip, and a 1200 kbps modem chip – maybe that’s how it gets programmed?

The original Ernest D3 main boardNear the bottom of the board, a jack marked “telco” connected to a terminal strip with the expected red, green, and yellow wires. Still feeling pretty confident somewhat hopeful it would “just work,” I hooked up “ring” and “tip” to my favorite ATA for vintage phones, the Grandstream HT-802 (successor to the venerable HT-502). Side note, both of these reliable ATAs accept pulse dials, which is completely irrelevant to this project, but a fact worth noting if you want to avoid extra converters the next time you’re installing a rotary. Anyway –

Rife with anticipation, I lifted the receiver and… heard nothing. Still with the silent receiver to my ear (half hoping for some sort of weird delayed dial tone), I tipped my head back, stared at the ceiling, and grimaced for a second to process both the emotional let down of non-instant gratification, and to resolve to not immediately give up – “ok, we’ve got a project.” I feigned lament, but smirked with the excitement you have when you realize a new adventure has found you.

Thankfully, I wasn’t the first person who was messing with an old payphone and also uses the Internet, and I determined a few facts over the following days:

(1) Despite the common enclosure, maybe made by GTE, this phone, the Ernest D3, is among the more uncommon types, from an uncommon manufacturer, of what is known as Customer-Owned Coin-Operated Telephones, or COCOTs. These COCOTs were phones that could be deployed by private business after the law was changed in the ‘80s to require telcos to allow such third-party devices to connect to the public telephone network.

(2) It can be programmed by either connecting an LCD to the 14-pin header and using the keypad, or by dialing in with a modem and connecting with some custom software that is very hard to find and runs on (up to) Windows XP.

(3) There is a 10-year 3.6V single-use battery that needs to work for the phone to work and mine is dead.

(4) It is very likely that some of the many electrolytic caps are toast, since this model was produced ~30 years ago.

Long story long, after replacing the battery and all the electrolytic caps on the board, the situation had only slightly improved. Upon lifting the receiver I got a dial done, but when placing it back down I continued to get the dial tone, even on hook, and no amount of hook-switching would actually put the POTS line back on-hook. Dialing numbers had no effect, no tones, and no break in the dial tone. When receiving a call, after lifting the receiver, the call picked up, but both parties would hear the voice synthesizer playback a partial message on a tight loop forever about the phone not being billable for collect calls.

I decided this was too glitchy to dig into further and that if there was an issue with the EEPROMs, or the RAM, it probably wasn’t worth further debugging. Not to mention the programming which was likely going to be a challenge in its own right. As a side quest, I’d found a firmware file from a slightly older Ernest model and popped it up in IDA Ghidra. My intent was to try to work out the modem protocol for programming the thing without the proprietary software. While the 6502 bytecode decompiled acceptably, it wasn’t immediately obvious how everything worked, and it would have taken me a long time to figure out with so few strings ;) .

While I mulled my options for how to proceed on the partly-working main board I turned my attention to the rest of the unit. I was a little dejected at this point. My efforts so far had yielded changes, but not usable results, and I thought I ought to determine if anything in this unit was operational before devoting more time to it. The next step would likely be a big one, because at this point I was thinking my best bet might be to recreate the main board with modern electronics rather than try to repair the existing board further.

A wire jammed in the coin return slotTurning my attention to the coin mechanisms, I noticed a weird wire slightly poking out of the coin return slot, and investigating further, I could see quite a few coins jammed up inside the mechanism. I originally thought the wire had sprung free and needed to be reattached somewhere, but it turns out, it was probably pushed down in the slot by someone trying to free the jammed joins, and it got stuck.

I imagine someone, somewhere, setting out with high hopes, wire in hand, and every intention of fixing this coin collector. And then, just moments later, squeezing their eyes closed with their thumb and index finger on the bridge of their nose, the wire having slipped beyond reach and the coin mechanism further obstructed.

From the inside though, the obstructions could be easily freed, and, after some prodding, the coins bound on each other dropped away into … somewhere. The mechanism was free, but the coins didn’t come out in either the coin return slot or the coin vault.

Instead, they had dropped into the escrow chamber. This chamber holds coins until a relay activates a trap door, releasing them either into the return slot (like when you hang up without dialing, but after inserting coins), or the coin vault (like when you hang up after successfully connecting a call).

I tried putting a few additional coins in the slot, but they jammed right away. I found the mechanism was missing a small weight, which caused a rotating part to be unable to return to its correct initial position. I attempted to replicate the missing weight with a spare nut and some superglue. After that, the mechanism seemed to be working well. Progress! However, all the coins were still sequestered to the escrow chamber.

At the bottom of the escrow chamber, a coin relay guarded the trap door. The relay, mounted to the bottom of the escrow chamber, had two wires, one red, one white. Under an Ernest “quality assurance” sticker, another sticker proclaimed it to need 12V, but didn’t say anything else about it. At the risk of destroying it, I applied 12V randomly across the wires. It fired! Many, many coins dropped into the vault. I immediately removed the vault and counted my winnings. In all, I had earned .65 more than I had put in, .75 including the first dime from the vault. After celebrating this windfall with my wife, I quickly determined that 12V in the opposite direction successfully activated the return path for the escrow. I had a working escrow box.

The coin switch assemblyAbove the escrow box, transparent plastic housed a device with four wires was connected to the main board and labeled “coin switch.” Physically examining it as coins passed through, I could see coins routed to one of three switches. A different one for each type of coin. On the scope, I could see, depending on the coin, one wire would be connected to a common for 20-50 ms as a coin passed through it and dropped into the escrow. This must be how the deposit amounts are determined.

I already knew the bell was working, because it would ring in its partially functional state, so I didn’t really need to investigate there. Which left the matter of the front panel. The front panel, which had the 12-key keypad, the handset (speaker and microphone), and the hook switch, was connected to the main board by a 15-pin D-shell on one side and a 16 position (with one missing) 2-row 0.1” standard pin header on the other. Curiously, the wiring looked like it probably wasn’t designed to be connected to this board because on the one end the wires were inserted individually and crossed over each other rather than just being crimped directly onto the cable.

I also noticed the handset, which connected to a breakout board mounted to the back of the keypad, had its green and black wires reversed from the silkscreen labels on a breakout board mounted to the back of the keypad. This made me wonder if perhaps this thing had been to a third-party repair shop at some point in its life. I swapped the wires back to their correct positions, which kept the speaker connection and microphone connection on adjacent pins.

In any event, there were no surprises in discovering the pinout. The keypad was a standard matrix, three columns and four rows. Two wires each for the speaker and microphone, and two more for the hook switch. I’m not sure about the final two pins (maybe they were for a volume button present on some other phones), but everything seemed to be working. There were no dead switches and the speaker sounded good connected to a 440 Hz signal generator. I didn’t have a great way to test the microphone, but I could see some perturbations on the scope when I blew into it, so I figured it was probably fine.

SO CAME THE MOMENT OF TRUTH. I had a beautiful phone. All the components checked out. I knew it was possible, and probably worth saving. There was just that minor issue of the main board – that controlled everything and enabled all functions – being irreparable (by me at least). I briefly researched components I could drop in, but I decided I really wanted to replicate an authentic payphone experience, and all I could find was some VoIP conversion kits for regular phones, and the advice to try to take the insides from a more popular or supported model. If my goal was to get this phone set up as a working payphone, which demanded payment for calls, I was on my own from here on out.

So I set about selecting components and designing a new main board – the decades-long awaited upgrade to the Ernest D3 series – a modern POE-powered device, to be complete with an open source, extendable, payphone software package for native VoIP telephony, with remote programming, and monitoring. OpenPayphone: A multimillion dollar enterprise just a quarter century late to market. VCs take a number.

Continued in Part 2...