Welcome to the module 6, it is hydrostatic transmission systems. This is the first lecture which is lecture number 23 basic concept of hydrostatic transmission systems. Now, here I have described that what we need the hydrostatic transmission. The need for large power transmission in tight space and their control with exceedingly rapid response for military industrial as well as modern application such as robotics requires motors with very high torque to inertia ratio. Now, this with respect to the first paragraph what actually meant that it is always preferable if the output torque is very high whereas, the total inertia of the machines or so to say the weight of the machine is very less. The fluid power units which possesses such characteristics with several orders of magnitude higher than what can be obtained from other conventional units such as electric motor, hydrokinetic units etcetera are still holding the top rank in the field of application in spite of their relatively high cost. If you look into this I have described earlier in the introduction here I would like to say if you consider a ceiling fan you will find that about this motor that is rotating the ceiling fan diameter is 150 millimeter and width is around 50 millimeter. But if you look into the power the power is only about 60 or 80 watt that size of hydraulic motor can give about 10 kilowatt very high torque slow speed. So, this is definitely beneficial while we are using for general purpose where we normally need high torque at low speed. However, if we look into the source then for electric motor power is being generated at a distance may be several 1000 kilometer away and that is being conducted by over a electric where height in some lines and then there is a transformer that is not at the same complex may be outside and you are getting the modified or you say moderate current to use and then you are rotating the fan. Whereas, in case of fluid power although we can have a centralized power generation, but normally it is equipped with the machine. So, if we consider that part probably then the weight is not less, but always it is the end use if you think in terms of end use the motor can be made very small and that can be directly mounted where we are utilizing this torque also the other most beneficial part is that the fluid which is converting the power that can be carried through a flexible pipelines. So, therefore, this is another advantage that means from the generation of the fluid power to the applications point we have flexibility and we can put the motor and the generation source in any directions. Whereas, if we think of say we are trying to we are considering a drive for the industrial truck or may be say any earth moving equipment. If you go for full mechanical system in that case what we have to do we have to put an engine then a gearbox and then the transmission line and they are physically connected with this rigid bodies. So, they have a particular directions there is not much flexibility in placing them within this the whole machine. In case of electrical of course, you can put the generator and the motor in any directions, but with the motor then again you have to connect the transmission line may be through a gear box. So, that part is you cannot put any direction. So, they should have rigid mechanical connections and the size is also very big in comparison to that if you go for hydrostatic transmission then you can put the engineering directions may be pumps and etcetera connected to that fuel a oil tank you can put somewhere else and your motor you can directly fit into the wheel half of the wheel or may be roller in case of the earth moving equipment. Now, the rapid and continuous growth in computer rated control systems such as computer microprocessor interactive control system has kept the researchers active in developing and improving electronic and electro hydraulic synchronous control units. Now, here this is this I would like to mention the fluid power nowadays it is a improve it has been improved a lot because of introducing the control the which is microprocessor or electronics control within that. That means, earlier to this lecture while we are discussing the control of the swath plate in that case earlier it was may be hydraulic control only. Now, along with this hydraulic control you will find that electronic control gives further or better controllability to the systems. So, with that when we think of the such control system using computer and microprocessor then sometimes it requires that we need to improve the fluid power units also to match with this control system or to make it compatible with the control systems. So, this means that while we are improving the control system as well as we have to improve this hydraulic systems also. Anyway, for that you will find that there is continuous development of this fluid power equipment also hydrostatic transmissions also or in other words I would say that hydrostatic transmissions you will find this using the same equipment using the variety in control we can have we can improve the performance. On the other hand it is it has stressed the attention of the fluid power engineers to improve the hydrostatic already I have discussed with a basic knowledge of fluid power and its control as well as that of hardware of conventional hydrostatic units one can enter into the basic design analysis and application of hydrostatic transmission systems. Here I would like to mention we normally use HST actually HST means only hydrostatic transmission. Now we should use the word when we are thinking of the system. So, therefore, we should say HST systems that means the total circuit. Now if we say HST unit then it means the pumps motor actuator etcetera HST unit and HST systems. So, when we mean HST systems then using the pumps and motors bulk etcetera that is a total system. This is already described again I repeat the hydrostatic is used to fluid power transmissions due to the reason that hydro kinetic and hydrodynamic effects that is the fluid inertia effects can be by and large neglected in the design and analysis of such positive displacement units or transmission systems. So, that means HST units or HST systems. A hydrostatic transmission is special case is a special case of energy transmission system ETS where the mechanical energy of the input drives shaft is converted into pressure energy in the nearly incompressible working fluid and then reconverted into mechanical energy at the output shaft. Look at this definition we may be think of that incompressible fluid means we are only thinking of the hydraulic oil or similar fluid which are considered as incompressible. But no here it is meant that whatever may be the fluid even if incompressible fluid to raise the pressure we compress it then we utilize is for converting the energy. This means that this includes also the gas or pneumatics. Essentially an HST consists of hydrostatic transmission consists of a drive wherein the hydraulic energy input element is a pump and the output element is a hydraulic motor. Usually HST pumps and motors are designed and matched to optimize energy transmissions. Actually if you think of the individually pumps and motors then those are designed may be you can in the market you will find different size of pumps and different size of motors. But you will find a particular set of pumps if you use with particular set of motors then you will have the efficient or optimized energy transmissions. Now hydrostatic transmission when will come into a little you will find in most of the cases which are specially designed for hydrostatic transmission. This means that say if you think of the earth moving government if you think of the construction machine in many cases you will find that there is a pump there is a motor there is a valve everything are used together to for a continuous some a typical operations. In that case in many cases both the pumps and motors are designed as a matched part. In some cases you will find their integral the pump motor and a valve manifold where you will find that inside there is a pressure level everything and they are put together. So, this means that usually we have to look into the pump motor design when we are thinking of optimize optimization or optimum energy transmission. Primary job of an energy transmission system is to accept energy input from a source that is a prime mover with its own output characteristics. Look at this we are using a pump we are using a motor for the hydrostatic transmission system. But when we are thinking of driving this pump that is having its own characteristics. So, our output will have the it needs its own characteristics. So, first of all from the prime mover to the output we have to match that characteristics. Now, transmit and modulate the energy within the ETS and deliver an energy output to the load which has its own set of characteristics. To fulfill its job the energy transmission system must have a set of characteristics which permit an optimum match between the prime mover and the load characteristics. An ideal energy transmission system would produce the desired output at any speed irrespective of its input characteristics, but this is never achieved. A gear drive transmission can provide ideal load torques only at a few points where the number of points is equal to the number of speed ratio in gear box over its speed range. For example, you must you must be using the car think of the car transmission. In that case you will often you often say this is a four speed gear box. So, one when there is the high ratio high stress ratio that is for the starting. So, at starting there will be high inertia. So, because the components are accelerating and it is overcoming the static friction. So, in that case you need high torque. So, what is done from the engine to the wheel we provide the maximum transmission ratio of the gears. Now, gradually when it start moving gradually the torque is reducing. So, the situation is improving that the torque has reduced. So, whole you can use the now energy of the engine to transmit a high speed at low torque because the torque requirement has reduced. So, what we do feeling that if it is a manual car we change the gear shift the gear and that transmission ratio is reduced. In that way gradually we reach at a final stage where almost you can say that engine speed is equal to the differential input speed then within differential there may have a slight or one stage reduction. Usually you will find that differential there is a one stage reduction and then differential is there. Now, for the so by gear box what we are doing we are using this engine power at four different speed and each different speed will it is having its own characteristic and we are putting the actual torque requirement within this four different regions. In case of hydrostatic transmission what can be done this can be continuously variable from starting to end. However, there is in that case you may ask that why we do not use the hydrostatic transmission for car the answer is very simple in case of the car the this torque range is very high. That means, when a car is moving at a constant high speed except some inertia even if you consider that except some resistance may be a little resistance and the air resistance there is no real resistance is there. So, we do not need any power we can move, but in case of if you would like to have such a range from the fluid power equipment that is not possible. So, with a fluid power hydrostatic transmission system to have such a range we have to again we have to use a gear box which is not benefited. So, hydrostatic transmission is mostly suitable that if this range of the speed is not very high say let us consider the road or the other earth moving equipment where for the basic purpose for which such machines are designed you will find the speed range is very small. If you if you moving with a roller from one place to other place you will find that it is not benefited it is very slowly moving, but when it is doing its job it is required. By manipulating HST system a closely approximated torque curve may be achieved, but that definitely not in the range of what is required for a car. The primary difference between an HST and a hydraulic system equipped with hydraulic pumps and motor is that an HST is a whole unit in which pump and motor are specially matched to work together. This I have mentioned while I was discussing normally we call the HST system is a the system of the fluid power where the pump and motor are put together and they are matched to achieve a specific purpose. Also HST controls are designed to provide the specific functions to enable the transmission to perform specific task. Hydrostatic transmission offer many important operating features which are remains talled and undamaged under full load at low power loss. This means that we can we can achieve a stall conditions sometimes which is required, but the oil is only circulating within the system. So, power loss will be less this means that suppose say we would actually some some actuator is moving or something is moving and it is transmitting a torque and it is it is doing a job, but what we want that maintaining the pressure it is just holding there it is not moving. In that case definitely we have to raise this pressure and the fluid has to pass through this. So, what can be done in case of variable piston swash plate type pump what we can do we can make this swash plate to it 0 position almost 0 position this means while it is only supplying may be the leakage oil, but with the full pressure.  So, flow into pressure gives the power. So, power is less. So, that is possible with hydrostatic transmission system in case of other we it is it may not be possible say engine and gearbox system this may not be possible. Hold a preset speed accurately against a driving or braking loads. Operate efficiently over a wide range of torque and speed ratio. Operate in reverse at control speed within design limits unaffected by output loads. Transmit a high power per unit volume displacement with low inertia does not creep at a 0 speed, but fine inching may be possible with a little complexity in hydraulic circuit. Now, here I would like to say say let us consider you have you are working with a forklift truck or similar industrial truck. Now, this transmission the moving transmission is may be with a gear box I mean change speed gear box engine etcetera like a car, but here the torque range may be different. However, this lifting etcetera is done by hydraulics. Now, in case of warehouse operation normally what is required you have to lift the load then you have to come back and also for the positioning the load you have to move very slowly with engine gear box the conventional drive it is very difficult. Whereas, in case of hydrostatic transmissions this inching speed is possible only a small displacement it will just move the this truck very slowly. So, that is another important aspect of using hydrostatic transmission system. Get faster response than any other type of transmission the response through fluid high pressure fluid is very quick, quicker than any other system. Provide dynamic braking say if you just close the oil path you will find the whole thing will be stalled in case of high pressure rise of course, it will go through the relief valve, but normal case you will find once you just move the valve close the flow path immediately it will have a braking effect. Provide long life with a little careful maintenance mainly the contamination control here I would like to mention although it is written here, but in most of the cases the failure of fluid power system due to the contaminations. So, although you may not need very much maintenance, but you need to routine maintenance we should do that otherwise this will fail, but with little maintenance definitely fluid power is better and lastly the provide flexible transmission lines that I have explained. Now, if we consider the hydrostatic transmission system again I will repeat hydrostatic transmission system means we will consider the pump motor together including the valve. That means, we shall not consider the pime over which is being used as a input we shall not consider the ultimately what work is it is doing taking the output from the motor, but if we consider the motor output shaft or motor output actuator to the input shaft of the pump the whole unit we will consider as a hydrostatic transmission system. Now, using that system as you say HST's then this can be open circuit discontinuity flow that means it is interrupted flow can be interrupted. First of all another things I would like to mention in normally hydrostatic machines what we call these are all direct current machines that means all the flow output from the pump those are mixed and then this is forwarded to the motor side in motor again this flow is divided into all the pistons. So, flow mixed and then again it is being utilized for the motor. So, we have to call it DC direct current flow. Now, in this direct current if it is called open circuit that means the flow is going to the motor and then it is going back to the tank it is not coming directly to the input side of the pump. So, we should call this is the interrupted fluid. Now, it can be closed circuit also in case of closed circuit what it is the output of the motor flow is the input of the pump directly connected pump output is the input of the motor motor output is the input of the pump. So, simply from this pump and motor hydrostatic unit they again look alike due to the configurations you simply connect input to output to input it should work theoretically. So, this is called piping turn in the piping turn we have open circuit and closed circuit in case of closed circuit it is continuous flow uninterrupted, but actually it is not possible because there will be leakage we will see this how this circuit can be made. Now, again from the control turn each open circuit and closed circuit has open loop that means there is no feedback and there is closed loop which is having feedback similarly for the closed circuit also. So, basically hydrostatic transmission look considering the piping turn and the control turn we can have four basic transmission. Now, the turn open circuit and closed circuit describe how the hydraulic line in the conducting circuit are connected which I have explained in an open circuit the flow path of the fluid is not continuous being interrupted by the reservoir it is going back to reservoir and from the reservoir again it is being pumped in by the pump in closed circuit flow path remains uninterrupted HST may be classified further into two different categories from the employed control point of view which I have explained that is the open loop and closed loop it is sometimes it is termed as closed or closed open loop controls are usually manual or electric hydraulic added manual controls either it may be manual or electric hydraulic added manual controls that means you are basically on of switch and it is being operated, but the closed loop controls include purely a hydrostatic control to all modern control systems. Now, here I would like to mention although it is said that it is hydrostatic control, but the hydrostatic unit itself might be again electronically controlled say for example, we can make such a closed loop control using a proportional valve where the proportional valve is being controlled by electronic systems do not confuse that, but usually the whole unit we would say the hydrostatic control is there. Now, if we try to understand through the symbolic representation representation you see that this is a unidirectional pump and this is an unidirectional motor they are simply connected like this and oil is from the reservoir and oil is going back to the reservoir. So, we should consider this definitely open circuit and also it is open loop without feedback no control is there. So, this is open circuit and open loop. Now, next one is that this is open circuit, but there is a transducer you see this any controls feedback control system or even if it is not feedback what we need that there should have a transducer. Say this is a constant speed or may be constant torque whatever it might be. So, we need a transducer and then there should have the control system and through which the pump is being controlled either for the constant pressure or for the constant speed. Now, third one is that the closed circuit you can see this pump input to motor say motor output to pump input and pump output to motor input like this and you see here what suppose this is the direction of the pump flow out. So, it is going this way and it is coming back this way. So, for which may be this is being rotated anticlockwise and this also the output is anticlockwise like that, but it is possible that here either rotating in the opposite direction or keeping the direction same we can change the direction of the flow and thereby we can have we can rotate in the opposite directions also. Usually in hydrostatic transmission where it is a closed circuit in that case the direction of the pump rotation remain same whereas by changing the swash plate in the opposite directions we can change the direction of the input output of the pump thereby we can rotate the motor in both directions. Consider a forklift truck consider any industrial truck consider any earth moving equipment which is given by the hydrostatic motors in that case transmissions are like that. Engine is giving the output in single directions pump is fitted to that, but varying the swash plate from one side to other side we can change the direction of the flow of the pump thereby we can rotate the motor in the in both directions. And then lastly this closed circuit will have may have also the closed loop feedback this is say this usually this type of transmission are used in many machines where the control is manual a driver is controlling, but in many cases you will find this is having the closed loop control also say if we have some say remote control or may be automatic control for some moving equipments. Say now, nowadays you can think of the guided vehicles automatically guided vehicles in that case also usually we will find closed loop there are many many other cases also where it will be closed loop. So, we here again you can say we can look into this. So, these are the four possible transmission system hydrostatic transmission system. Now, we shall consider a particular circuit now what we find here that this is the pump this is the suction filter first of all let us consider the reservoir is there next this is the suction strainer this is usually 100 to 200 micron in general purpose while hydraulic application. So, this is the suction strainer and then we are having the pressure relief valve here we are having the pressure relief valve this pump we have used the pressure relief valve here instead of using here. Now, the pump fixed or variable displacement this pump it might be fixed or variable displacement in this case what it shown that is variable displacement it might be also fixed displacement. Next we have this motor fixed or variable displacement and there is this is sorry this will be conduit this is not conduct this is this will be conduit rigid or flexible with connectors there we need connectors there then we will have return line filter this is the return line filter. Now, return line filter is usually 10 to 25 micron why it is like that if we put actually we need the well of such filtration 10 to 25 micron even if it is for general purpose, but if we put such an element in the suction line then pump will have it will have additional load and sometimes as these are very poor suction capacity in that case sometimes the suction will fail that is why always we put this 10 to 25 micron filters in this in the return line. Contamination is coming through actually in this case there is a little chance, but if we drive an actuator such and cylinder pistons in that case usually dust comes through the piston rodent. So, we need to have a good quality of filtration there. Now, apart from that there will be control unit then I am sorry there it is perhaps it is a mistake the earlier one if you go back to the earlier one the this is not written that we need a direction control valve this is as I told this is a open circuit. So, we must need a direction control valve to operate this. So, reservoir then suction then pressure relief valve pump motor conduit return line control unit this control unit actually includes this direction control valve also. Now, we shall discuss about a closed circuit hydrostatic transmission. In closed circuit hydrostatic transmission unit the component what we need for open circuit those are there apart from that we need feed or charge pump actually closed circuit means as I have explained pump output to motor input and motor output to farm input. So, ideally we do not need in ideal case we do not need anything simply if you rotate the prime over it will rotate the pump and this pump will rotate the motor, but what happens there is a leakage. So, you will find that initially if it is completely filled with fluid the motor is rotating, but after sometimes you will find that motor is not rotating. So, what is there we need a feed pump this feed pump is look at this is very quite interesting this feed pump it is having a relief valve and then it is going through two non-return valves. Suppose this oil is from the pump is flowing in this directions then it is being rotated. So, definitely this is very high pressure as it is high pressure. So, the ball is closed now this pump is having very low pressure it is only filling the oil. So, what it is it is trying to move in this directions now this is the return line here the pressure is very low. So, oil is going through this now whatever leakage whatever the loss due to the leakage that will be completely filled by this pump. Now if it is try to usually this is fixed displacement, but very low volume now if it is trying to pump additional oil to the circuits it cannot take because these are all say non-flexible conduits we should consider. Although it is flexible, but it is not elastic in that case this oil is going through this pressure relief valve and it is going back to the tank or may be again to this pump here it is connection is so at if it is going through this pump. Now next so adding this feed pump it should work, but look at this this pump is having no relief valve because if I provide a relief valve where then immediately oil will pass through this. So, closed circuit concept will not work, but we need to have some pressure relief valve otherwise if the load is very high if it is exceeds the capacity then in that case the whole system will fail it will burst. So, therefore, this pressure relief valves are there now how it is working we it is called dual shock valve. Let us consider the oil is flowing like this so this is the high pressure line now one pressure relief valve is connected like this. Now if the pressure is high that means it is higher than the for which it is set in that case it will move like this and it will go back to the pump. So, pump will rotate and this oil will circulate a circulate when the oil is flowing in this directions then this pressure relief valve will work. We cannot put a single pressure relief valve so that is why it is called dual shock valve usually either you can put two separate pressure relief valve or this whole system is a integral system a single manifold is used for that. Now here again we have another valve we have used for the purpose of filtration so we can by moving this we can take the oil out. When we are closing if we close this one then oil is first filled and then operation start if we open it oil will come out to the tank for the cleaning purpose. Now this you may ignore to imagine a hydrostatic closed circuit hydrostatic transmission system. To improve the performance and to fulfill other desired task many other appropriate components such as accumulator cooling system special purpose valves etcetera are included in the circuits. Now I would like to mention that suppose you need less fluctuation you can put an accumulator this side as well as this side also and we accumulator works only with the high pressure. So, there should have a bypass circuit also that can be provided here. You need filtered oil for the operation say for example, in case of servo control valve at the utilization side you need to need that oil to be filtered 5 micron or even less. So, in that case a high pressure filter is used in all line. So, all such components can be added to make the circuit more efficient more workable condition. Performance of a HST is not only dependent on the inherent characteristics of the transmission system including the prime mover characteristics, but also on the nature of loads definitely depending on the nature of load there will be variation in HST performance. Usually the performance of an HST means the overall performance of a closed circuit system. When we mean the performance of hydrostatic transmission system we consider it is a closed circuit system. Now what are the type of loads that we should know? There are 4 main classes of loads which in combination can describe most actuation problems. These are called one is friction there will be friction each and every components motor linear actuator everywhere there are frictions. Now then the elastic load that means whenever you are applying the pressure there will be the elastic deformation all the components there. So, that is also we require the first energy goes to expand the elastic bodies friction is there to move the bodies next comes the gravity loads are there. So, that we have to consider and then comes inertia load. Now any load will have some friction and some inertia, but usually one effect is dominant normally it is like that friction denotes any dissipative load which includes rubbing friction along with resistive loads such as electrical generators, propeller drives, fluid trans transfers system etcetera. Elastic loads have force as a function of position only. Gravity loads are constant or quasi constant loads independent of direction of motion such as winches. In case of winch what it is it is moving a load in the upward directions. So, the drum is being winding and so this is a gravity load you are providing this hydrostatic load to move the that is such a load. Now inertia loads are dominated by acceleration effects. So, this load only active when there is accelerations. Now all say if you consider the elastic load, if you consider the inertia load, if you consider the gravity load all are say store energy. Say for example, if you lift a load by winch then you can recover the energy because if you leave the load to fall you can recover the energy except the friction. Friction you cannot recover. So, we should be careful about reduce the friction as much as possible, but other load also suppose the load we are lifting that is not utilized for the recovery of power and to use somewhere, but in some cases you can use that power also. Now if you think of the closed circuits then there are four types of hydrostatic transmission as illustrated here. It can have both pump and motor fixed and then power constant and torque constant. So, this is output speed also constant. All are fixed purpose. Usually you will find that pump is variable drive and then motor is fixed displacement. In that case power is also varying because depending on the motor I mean pressure side we can vary this flow and we can keep this power variable whereas we can keep this torque constant. This system is widely used which is called constant torque system mostly used. You can have also pump fixed motor variable whereas power will remain constant, but torque is varying. So, this is in a sense this is better, but in normal cases we need to have various range to this does not mean we are only a one single torque we are negotiating. It is like that keeping the torque constant you can vary the power. So, this is energy saving then this system constant power system. Now you can make all variable this making all variable means it includes all three. You can keep all fixed. So, it will behave like this. If you keep fixed and make this variable it will behave like this and third is that you can keep this fixed and this variable. So, this system although it is expensive, but if you make this if you design or if you use a system with all variable then you can have all other three features within the system. Now control system may be manual control, pilot operated control, constant horsepower control and constant pressure control. Anything you can achieve you can design the system like that. To determine the actual size of the components all losses must be properly included. That means while you are considering the design it is not that suppose if you need the motor say 20 Newton meter and maximum speed 100. So, if you ideally select a pump of that size you will find exactly matching size you may find that you are not getting the full performance. You have to consider the pump over size why because there are many losses. So, to compensate that losses pump should be of higher size. How much higher size it should be for that you need to calculate all losses together while you are estimating the performance. The losses are leakage losses through the active zones mainly internal leakage such as barrel, valve plate, inner face, active load transmitting contact zones and leakage losses through the slip region. That means there are external leakage say through the piston this oil is going out of the barrel and it is going inside the cases. So, we have to consider such leakage also carefully and this is inter chamber leakage first one and this is the external leakage. Apart from these leakage loss which is proportional to the pressure drop and affect the volumetric efficiency there are few other losses. It can be mentioned here that the design of HST system is a more complex undertaking than when dealing with individual pumps and motors. Actually I would like to say that what is the advantage of the say hydrostatic transmission system which is usually again closed circuit. The advantage is that this has very quick response and return line is not the always with the lowest pressure atmospheric pressure. You may find this pressure difference they maintain in such a way the performance we achieve through such an hydrostatic transmission in far better way than the open circuit. Now, this we should consider the coulomb fractions which is strictly for clogging motion that is that is in case of the pistons you will find at the starting particularly there is a strict motions that we also consider while we are particularly estimating the starting torque of a hydrostatic unit or may be the total system also we must consider the viscous drag. Inertia which is not an actual loss but acts like one during breakaway and acceleration because inertia torque adds to the load and friction torque. You see this initial stage at starting we must have to consider the inertia also. In open circuit these 3 losses are included while calculating the power of motor. In case of closed circuits we have to we can compromise with such loads. Another important features to be accounted is the stall torque characteristics. Usually if you would like to stall say for example, in many cases we need to stop the machine but holding the torque. So, for that characteristics also we should consider because if you would like to hold the load at a particular position your motor may slip. So, that is to be accounted. This is an very important factor in the selection of motor and fluid for transmission and it would force a designer to specify a hydraulic motor up to twice the size. In many cases you will find due to this reason only you have to increase the size of the motor. Now, here I would like to mention for that special purpose motor are also designed. Normal course we use the high speed low torque motors but we can have also low speed high torque motor. Now, another thing is the corner horsepower. What it is called corner horsepower means maximum torque and maximum speed. At that condition we have to achieve. So, every design that is particularly when the motor is at its high speed and high torque what is the power that has to be considered to select the pump including all other losses. So, it is to be remembered while designing a system that these two values do not occur simultaneously. So, if that occurs in simultaneously we need huge power and we get the multiple steps within such hydrostatic transmission system. So, a completely variable control HST is an appropriate device. Now, we can also go for special hydrostatic transmission unit which that first of all what we should do decrease the weight, size and number of movable components. So, low inertia, better startability and increase the displacement per chambers per revolutions. This is the leakage loss, reduced torque, etcetera. Increase the number of power stroke and hence the displacement per revolutions. So, least torque and flow fluctuation, high torque output. So, we can also reduce the irregularities, but in case of motor and hardware it changed to multiply the torque internally. The LSHT low speed high torque motors may be classified according to their internal feature as follows. Now, we can design the low speed height of motor. We can increase the number of power strokes and the increasing the number of pistons or by increasing the number of power strokes for output revolutions. This is say examples are double row, multiple cylinder piston motor, multi low ball piston motor, orbit motor etcetera. Now, case B is that piston area is increased. The best example is the radial piston motor which we have learned earlier a little bit. And third is that combination of A and B. The example is that multi low radial piston motor, multi low radial ball piston motor etcetera. So, this is the end of this lecture. And I would like to say we have not specified any references here because this is the very general knowledge. It is this note is preferred consulting many books. So, no specific reverence for that. Thank you.


Hello, and welcome to Rock the Cash Box. This talk is about hands-on ATM protocol analysis, and we'll be covering ATMs and, of course, the protocols that power them, at least one specific protocol. This talk has been made specifically for DEFCON 30 and Retail Hacking Village. I hope that for those of you who have not been at Hack or Summer Camp in some time, this will be a good refresher on ATMs. And if you're new to security and you want to know how ATMs work or you want to look at protocol analysis, this talk should and is tailored for you. I really wanted to focus on the basics and how protocols work. So with that, enough about the introduction, you really aren't here to just hear about the talk, you want to actually see it. So let's get started. So about me, I am Wasabi, sometimes Spicy, at least on Twitter, and I am a perpetual volunteer. That's how this whole event started, and that's how I get a lot of interesting ideas and work for some of the research I do. The events that I helped put on are the Collegiate Pen Testing Competition. The Global Collegiate Pen Testing Competition, my apologies, it's a very awesome competition, which is how we got to this in this particular year. They were tasked with pen testing a bank. And I also participate in the Collegiate Cyber Defense Competition, which is the severed defense aspect of that. These events are very interesting, and if you're a student, you should definitely look into getting involved. I am a researcher of embedded devices. I have researched voting machines, ATMs, of course, and many routers and other devices of an embedded nature. The great thing about embedded devices, there's always something new, and you may think, oh, this device is secure and it's fully updated. Nope, never is. So it's a very interesting topic, and I can go on and on about all the embedded devices that are out there today. This includes the Internet of Things, but we're really focusing on ATMs, and these ATMs specifically are quite old, but they're still in use. So it should be an interesting rediscovery for everyone. Now, I will be sitting in the audience probably that way, and if you happen to see me, please ask questions. I know that this is a little weird. I was not either expecting to be doing a in-person talk via recording, but here we are, and I'm grateful for this opportunity because, for one, everyone's going to be wearing masks, and two, this gives me an opportunity to make sure that all the content and demo and videos are all working as expected because if anyone's ever done a talk before, you know things go sideways. Anyway, finally, I am a cloud engineer by day, so none of the stuff we're talking about really is my day job, but if you are interested in these topics, I'm happy to answer questions or find people who might know or do know the answers to these questions. Now, my partner with this was formerly known as JRWR. He's now going as Balsa, at least on Twitter. He is the creator and designer of Hatchan. He is working with the Defcon scavenger hunt for some really cool stuff this year, and so you should go check him out. And also, he does some really interesting work on some CTFs and things like that. Overall, he is a really good guy to work with, and if you have any questions about so many topics, please go reach out to him. He's awesome. Unfortunately, I don't think he's going to be here today because, of course, he's running the scavenger hunt, but wanted to give credit where credit's due, and that was the team that helped make this happen. So anyway, you're here not to hear about us, of course. You're here about rocking the cash box. And fun fact, if you ever see an ATM do what's in the picture, it's fake. It's, in fact, so fake that it's been modified. It's tampered with. It's not real. In fact, the ATMs that we're dealing with, that is one of them. They have a guard to prevent money from flying out because, as one should with designing an ATM, you probably don't want the money flying out into the air. And of course, what is a cash box? Well, inside of an ATM, you have to get money.  They could take some, do all sorts of stuff. So they are handed cash boxes with specific keys, and the machine can pull money out of that cash box. So our goal is to get the money out of the cash box, and how are we going to do that? Well, we're not modifying the ATMs. We are not modifying the firmware. We are not doing anything with the ATMs, in fact. The ATMs are stock. We have not customized them, except for maybe a few repairs because the ones that we got were in pretty bad condition. We think this talk at very least is interesting and unique because not many people have looked at the protocol, oh, my headset's falling off, looked at the protocol that powers a lot of these ATMs. These ATMs are still in use, and so we are specifically talking about that protocol. That powers them. And we are bringing ATM protocols, at least one of them, to the masses at DEF CON 30 retail village. So I'm excited that everyone here is interested in that. And again, feel free to ask me any questions. So here's a photo. This was actually a couple of weeks ago. That is, in fact, the same ATM that we will be talking about today. And it, in fact, was out of order. I almost was tempted to offer them a fix, but I thought better of it. So the background of this event and why we got so many ATMs and why we had to do this was ironically enough, the event was the Collegiate Penteson Competition, and it was a prehistoric bank. And of course, we got prehistoric ATMs. These are circa 2000 to 2004, and then there was an EMV update in around 2010. I guess that's still a lot more modern than some may expect, but they're fairly old by ATM standards. And so the simulated bank had a lot of custom applications. We had custom tools and everything built to simulate custom software and what a real-world pentest would be like. And the students are required to write a report on their findings. In previous years, some of the event, well, at least the past three or four years, teams have found ODES on the software that we use. It's not that the software is custom in those particular cases. It's actually off the shelf and we did not know there were vulnerabilities, but because of the pentests that the students are performing, they find vulnerabilities. It's actually very exciting. We look forward to those findings every year. And so far, the teams have not disappointed us. It's a really cool competition. And if you're like, oh my gosh, I don't think I can find zero days, ODES, sorry. However you want to say it. Don't worry, the competition is meant, it goes through a regional qualifying and several rounds. We want it to be fun. So not every team finds vulnerabilities like that, but the key thing is it's a very interesting competition. We try to make it as realistic as possible. But you're probably wondering, how did you get ATMs? Well, it turns out you can buy anything on eBay and sometimes in great numbers. Turns out you can get an entire truckload of ATMs for maybe less than $500. And maybe you have to get that from one state to another and travel over 1,000 miles, just things. And the good news is the mission impossible for ATMs was a success, the truck almost flipped once and it was a journey. But purchasing ATMs, it's a very strange world. People are no questions asked and they expect you to just deliver an ATM or get an ATM and buy it and take it away. So it's interesting. And all of these were from various locations. In fact, a lot of the ATMs as we were analyzing the configurations were from Waffle Houses. So some of them actually were sticky. One at least had some dead critters in it. They were pretty disgusting. But as it turns out again, you can pretty much buy anything, this is the current listing. The bottom one is a single one for $300. We did much better than that, but you can see all the different variants of the ATM machines and parts. So here are all the ATM machines running in unison. I don't think that the audio will come through and in fact the video footage is pretty broken. But that was all the ATMs and doing their boot up. So unfortunately the videos probably won't work today. So anyway, the problem with the ATMs was they were in bad shape, they were falling apart and we needed to find a way to communicate them. So first we found the working ones and then we had to figure out what to do. So it turned out there were a few things, not just one thing. And so we tried to find the user manual. Of course the user manual is meant for users and not people trying to make the ATMs work. Most of the time you go through a trusted vendor to buy your ATM and get a actual service for the payment processing. And our goal was to make them work. That was the most simple goal of them. We weren't trying to reverse engineer a protocol at the time, we just wanted to see what can we do? Can we make them dispense money? Can we do anything? Of course it says out of order unless you do the correct sequence for the protocol. And so we were running into some issues. And our final goal was to make it as realistic as possible. We didn't have any defined goals. We didn't have anything other than make them work. So our one item was where we started. Of course the ATM itself is a Tranax mini-bank 1500. Hayu Song is the brand who took that over as far as I know or one of them bought the other. So you see various names of those interchangeably. And some models actually support up to Windows CE 6.0 with EMV support. Now, Windows CE 6.0 of life took place in February 2022. So I guess it was fairly modern until recently, but it is what it is. And the main problem though was that was released in about 2014 and they don't receive any updates since. And with that upgrade you'd be switching between the current protocol we use and Ethernet if you so desired. However, in our particular case the ATM did not have Ethernet. It supported 56 Bod Modem and that was it. And there was a safe fun fact. If you can get that door open on the bottom where the money dispenser comes out most of these ATMs are actually programmed for code 1234 or 000. There were a couple where we actually had to get the locks, like they were spin locks. And so we had to actually listen and get in that way. But for the most part the ATMs were with a default code even though these were directly from the vendor. They said they didn't know the pins. So we ended up Googling and that was the answer. Google is your friend. So specs, it's a pretty old system. It's powered by a 16 bit microcontroller. Main communication mechanism is the dial up system. The pin pad contains the crypto keys. If you remove the pin pad it resets and then nothing works anymore, you have to reset it. Printer controller also uses the same processor and is an independent board. This allows you to update the main board while keeping the dispenser controller and the printer controller the same. All of it's communicating via serial. People have tried to attack the serial protocol but that was not as interesting for us because that means you have to have physical access to the ATM and as we all know, once you have physical access all bets are off. So with enough determination you could break in. Here's a picture of the classic main board from the ATM. You can see the main logic chip right there. There's a real time clock that actually did not work. I believe because these were the ones with the integrated battery and those go flat after a while. But either way, didn't quite work. So you can see here where the main board is, this is a different variant. You can see all the connections to the main, or the accessories to the main board. And then there's this one little thing. If you take a look with the question mark that wasn't a soldered on accessory board. We're not quite sure what it did. If you flip the dip switches it would not boot. We couldn't find any identifiers. It is a microcontroller of course on there, but what it was actually trying to do and how it was connected, we weren't able to fully trace. You can see the FPGA and the memory on board. Overall fairly simple setup, but this is what powers the ATM. If you want to get the upgrade, the upgrade you can see the LAN and modal options. And it's now in a metal enclosure and then it has a new display board and the EMV compatible reader. Of course we didn't have this and we weren't really trying to. We were just trying to get ATMs to work. So we figured EMV would add to the complications. And of course it did, but it does, but we didn't deal with that. So how does an ATM work? And if you're new to ATMs and maybe I'm, you know, or not as familiar, I may be going over these things in a basic sense, but again, this is for people who are not familiar with anything. So we're gonna go to a little bit background quickly, but ATMs are usually need to communicate to a payment processor. If you go over a network that can be online and whatnot, if you're going over the phone, there's two options. You either have to have a local payment processor that converts the dial up communication to ethernet and then off to the actual payment server with more security and whatnot. Or you have to connect to a dial in payment processor. Way back in the day, this was known as VisaNet and we'll be following that again in a little bit on the talk, but we didn't have either. We didn't know where we could obtain a local payment processor and we had no operating manuals or guides or figuring out how we could connect. The only options we had was to actually pay a service to give us access and as an academic competition, we don't have a lot of funds. So that was off the table. Our first thing to look at, can we emulate the payment processor? And of course we did, but we weren't quite sure how. Of course, near the end of the competition or right before the competition, one of the volunteers was able to obtain an actual payment processor. This one is the external for localized payment. In is the modem and out is ethernet and it connects to the internet. You can configure it using the ethernet port and this allows you to communicate to either one or multiple phone dial in ATMs. So in the competition setting, we had a challenge. We had, I believe, eight or nine ATMs in use. We needed a way for them all to communicate and we only had so many Raspberry Pis and phone modems, USB modems. So how do you do that? Well, we ended up buying some PBXs to allow banks of ATMs to communicate to the PBX which would then connect to two lines in to the Raspberry Pi. This allowed us to have two simultaneous connections and then the additional ATMs would be queuing until they were able to dial to the payment processor. Each, in our case, which was the Raspberry Pi and then each Raspberry Pi was connected to a central processor which connected to our simulated bank. And then, of course, the challenge was before all this was set up, how do we communicate? So in my case, I was one of the developers so I connected to DevSystem which tunneled through the internet to a jump box at, I almost said JRWR, but Valsa's house. And then it could tunnel to the Raspberry Pi which then allowed us to communicate to the ATM. Now, the many layers of connection posed a problem because if you killed the connection to the Raspberry Pi or the Raspberry Pi crashed, you might still be able to get to the jump box but the Pi would be dead and you'd have to reboot it. And then the other fun was the modems would lock up and you'd have to physically reset them. So those were quite a few challenges that we had to deal with and then, of course, a few times the jump box itself would just die so the Pi was up but we couldn't reach it. So it's a bit of a challenge and then, of course, because all the ATMs were on the East Coast and I was on the West Coast, we had to work through the time zone challenges where things were very challenging sometimes when I would be working at 9 p.m. or 8 p.m. and it was almost midnight for Valsa. So that was a challenge but we worked through it and we found out a couple of things. Dialing, dial up is a bit of a lost art. A few years ago, there was a CTF at DEF CON that used dial up modems for people to connect in. I thought that was very cool but it's a bit of a dying in lost art because people don't really use this. We had to get used but new and I say that with quotes, of course, because they were pre-used on PBXs and we had to find USB modems compatible actually with the Raspberry Pi and Linux. And then, of course, we had to find how to dial into the ATMs or have the ATMs dial. And then, of course, how many retries and how to get them to communicate was a problem. And of course, the PBXs we got were off eBay and they were the wrong frequency, 50 versus 60 Hertz to communicate. So we had a lot of things going against us to figure out how to get this all working. And for those of you who are familiar with dial up, it was a learning experience and I'm glad I learned it again. It's been a few years but it's something that we're just not familiar with anymore as a team because most of the time you're dealing with Ethernet or Wi-Fi. So of course, this is the simplified diagram of the payment processor. The payment processor can operate off of the Raspberry Pi or a micro router running OpenWert, which connects to the USB modem and then to a PBX. You probably don't need the PBX to directly communicate but it's a good idea. And then, of course, you can control in the final version, the one that I've released more recently, you can control the way the ATM operates from a web interface if you connect over Wi-Fi. This can force the ATM to accept or reject cards, change transaction fees, and of course, manipulate the payments in transit. So for example, if a user thinks they're getting $20, you can request $100 out of their bank account. And then the user gets back a validation, of course, not quite the correct validation that they expected. So that's the process. The only thing that's interesting for this is it actually checks to make sure that it's a valid card type that it knows. The ATM internally does. So we were trying to find ATM valid cards. The only thing that we were able to obtain that wasn't an old credit card because we didn't wanna hand them out for the competition was gift cards, visa prepaid gift cards. So those actually were accepted and we were able to use them and read the card data. So of course, we worked on weekends and weekdays to get this working. Of course, I would start on the weekends at least at six a.m. Pacific time, which was about nine a.m. Eastern. We would spend the whole day over discord or voice call and the end process was trying to just get them to communicate. We had two ATMs at once, but only one Raspberry Pi. So what this, and because we were working in parallel, trying to understand how these worked, we rediscovered time sharing because we would have to split the workload and wait till someone was done dialing in to get everything. And of course, we rediscovered at commands, which are very fun. The ATM internally uses at commands, as well as at commands are required to ring and hang up the modems. We needed some way to configure the ATMs, of course. And the challenge was we weren't familiar with these ATMs. They have a guide, but it's a general maintenance guide. And the good news is the US Robotics still sort of exists and they have actually some great documentation as long as you're able to use an old browser, which was not so good. So here's some of the key at commands. Plus plus plus, which is the command mode. And then A is answer. And then there's A slash, which is of course, the repeat. There's dial. So when you do the ATS zero equals two, it would auto answer and you needed the proper new lines, otherwise it wouldn't communicate right. So that was a lot of fun. So of course, once we got this working, the ATM would dial, it would send a message and that's it. How do we know what it's sending? And in this particular case, you can see the data when we were trying to decode it. And we were seeing a pattern. We were seeing data, but we weren't quite sure what it was. So we really didn't know and we tried sending the same string back. Maybe it was a handshake. But really we were only getting a reply from the modem and it's even funnier in a second because we were trying to make this work. We started with PySerial and that wasn't good. We tried Screen because we thought maybe it's just in a different encoding. Then we tried Minicom. And then we actually switched to intercept PTY, which is an old program. You compile it and it outputs a socket that allows you to run two things to the specific serial line. And that allowed us to run our Python code and Minicom to monitor the messages at the same time. Of course, with Balsa, everything is in PHP. He once described it to me that he is the Jack Sparrow of PHP programming. And I can't disagree. You don't know how he ends up with the stuff he does, but it works and it exists. So we tried PHP but it wasn't quite working. It was impressive how far we got with PHP, considering it's not really meant for serial work. But overall, the serial was just unreliable. We kept seeing messages and we kept seeing them stack. So we knew something was going on, but we weren't quite sure we saw the patterns. And so we switched back to Python using the OS sockets for serial. We thought maybe it's encoded. So we started looking for the patterns. And if you're ever doing protocol analysis, it's a really good idea to start breaking down the messages. If you look at some of these screenshots, you'll see new lines. But in this case, I was looking for patterns. We found 94, we found 0D0A, and then we found other strings of messages that were grouped together and then it was repeating. There were some F7s, lucky sevens maybe, I don't know. But you can see I started highlighting things to try to find a pattern and where things started over. You can see because of the sevens, we were able to roughly get a reset of where the communication started over. So it wasn't actually just continuing the same message, it was resetting. You can probably find more patterns than this, but that is not necessarily needed as long as you can make the structure. We did have a major oops moment though, because when you just decode the text to ASCII, you get ring, ring, ring, connect, no carrier. Ring, ring, ring, connect, no carrier. Where was this coming from? Well, I will give you a hint, it is the modems. I guess that's not much of a hint, it's more of just the answer, but the unknown part, this FFF and sevens was something interesting. We couldn't quite figure out what this was, but we figured it was from the ATM. So when you're looking for patterns, you're trying to find, especially with unknown protocols, protocols generally follow a structure. Even if they're encrypted, there's usually probably some kind of like preamble or repeating pattern. I broke off the different hex to show you how it looks. And so we were looking for like line level to see if maybe there was a pattern, like you have to go so many highs before a low, looking for a start of packet by the pattern. This is all logic signaling. So if it's high or it's low, it allows you to really start seeing if maybe there's like a sequence, you can see what the 077, this of course is a character, but you can see there's a distinct pattern. And when you divide these by time slots, that's how computers are able to process these and process the signal and respond. So we were looking for something that a machine might recognize. We didn't quite see anything, but we kept searching through vendor sites. The goodness is the vendors talk about how this supports amazing encryption, including DES compliant or triple DES encryption and visa certified pin encryption. So don't worry, it's safe. But we were trying to find guides and documents and we were really struggling. And then we found a vendor guide and this vendor guide was not the typical vendor guide. It was very detailed and it was listed as a draft. So that was exciting. From the documentation, it spoke about how the modem connects. It talks about the bit configuration, the parity and the way the message must start. So these are all ASCII control characters, STX, ETX, and E&Q. And specifically, it also spoke about how to configure and reset the ATM. And we are using, I believe, standard three, these EPS link and ST3 link are ones that we didn't use. ST standard three is what we used. And so we, from researching and being able to, you know, with the breakthrough of the protocol or the vendor guide, we were able to start figuring out the protocol. So the standard flow request was terminal call, it'll ring, it sends an inquiry. Then we get a request, response, AC, end of transmission, end of transmission, everyone's happy, disconnect. But how does that work? Well, we knew that from the vendor guide that it's supposed to do an E&Q to start. So we were sending E&Q and it just ignored us. But when you start looking online, and it's actually really funny, this was an old Frac article from 1994. And on the other side of this article was an advertisement for DEF CON 2. So 28 years later, the Frac article is relevant again. It was really cool to see that, though. But based on VisaNet, it turns out that the way you trigger it is you send E&Q, E&Q, E&Q, which would trigger the ATM to respond. Good little tidbit. This was not documented anywhere else. And so once we found this, we were able to get a message. So this is the message we were seeing. And we were so excited, we got a message back. It's funny actually, because I'm looking at this message and I can see where the different protocol structure is for the different payment parts and things like that that it's trying to do for the setup. But this was the message we got back. And we didn't see any in QBAC, we didn't see any TX, we didn't see a NAC. So what happened? It doesn't seem to match this at all. And well, we were a little concerned. We started looking at the manual again and it says that it can operate either in a batch mode where it queues up all the transactions and then sends them all at once. So if someone wants to do a withdrawal deposit and things like that, it'll queue them up until they're ready to do a single transmission and send it over. Or it can do single mode, which every transaction is a dial in and request. We tried both, concerned that maybe we had accidentally got it into batch mode, but the batch mode was unlikely because it requires a keep alive connection with the payment process. So it dials in and it keeps sending messages back and forth. We didn't want to handle that. So we went with the simpler single option. So we were trying to figure out what's going on. We started doing parity bits and it's a challenge. We were not familiar with the raw parity bits because we don't really have to deal with it much. So we were able to identify some characters and find valid stuff, but we weren't sure what was going on. We tried shifting over and you can see when you shift a message over, some of the stuff rolls off and it's, you can restructure the message. But that didn't help. So it wasn't just a pure shift. But the question was why would sending a valid E and Q return a response, but not the invalid one that we were getting back? Well, it turns out with classic protocols, classic ASCII, the only six of the bits are used. The seventh bit is the parity bit. The parity bit is allowing it so that you can make sure that a message comes through correctly. And so in our case, we were able to drip the parity bit and get the correct ASCII code. Usually the seventh bit, the eighth bit actually, sorry, is not used nowadays. It's just static, but it can be used. And so that was how we were getting messed up because it was error detection. Even our odd, it would either get turned on or off. So we were seeing some valid characters and some not. So now we were getting an actual message back where we could actually see the ASCII control characters. And of course, that was a challenge because we weren't sure what was going on. We got these messages back, but we were like, huh, there's some blank parts and things like that. We were trying to empty out certain fields to see what we were doing. I have actually transcoded this into things that it is. This is the terminal ID. This is a field separator, field separator, the transaction code. And so we were able to start building up like what was what by editing the ATM configuration to send out specific messages. Of course, things still didn't work. There was a LRC at the end for parity. It was trying to make sure that the messages were good. It's essentially like a CRC or a validation bit. And I got a bad implementation that I'd used to implement. And it was overly complex and didn't work. So we were sending the wrong LRC. What we ended up doing was going and finding another reference guide to make sure we were correct. And there's a couple of ways you can do this. If the field is small, you can make a table. Lookup table to make sure that you have all the values based on a specific calculation or you can do what in this case, and that would be like CRC. In this case, it's even simpler. It's just bit math. And so we were able to get everything out with that. And once we got this, we would, with the invalid one, we'd get a knack. And once we sent the valid one with the message, we got a knack. So that was a nice progress. So how does it work? Now we're talking to the ATM and that's really exciting. Well, the ATM does a host download table request. This request gives the ATM everything it needs, including encryption keys, charge amount, and a few other values. It supports up to triple des with left and right key combos. So you could do multiple hosts. So not everyone knows the whole key. It's a 64-bit key. However, what we found is you can also just send it to all zeros, which is great. And so when the ATM loads this up, everything is just zeros and it's like, okay, cool. And that makes it really easy to decrypt. There is a actual standard, the ANSI standard for pin management security, x.9.8. And it actually is where this comes from that the pin codes will be 64 bits in length, each nibble being stored as an ASCII value, zero through nine, A through F, as a Hex representing the Hex characters left to right. So that was interesting. That was actually a well-documented piece. You can actually see it here. This is the protocol handler that we wrote. And you can see the messages and sending messages back. It was actually a very basic message handling. You can see below the field separate terminal ID, code, encryption, field separator. And so this is all the messages, the data and breaking it off and where we would have like dangling bits and bytes. So we were dealing with the extra characters and trying to find the replies and we would always get either a success or a failure and that allowed us to keep moving forward because it was very simple in response. Did it work? Nope, okay, let's keep trying. So that was helpful. You can see at the end, we got the ASCII character, the control character. So, but it was still sending a failure. So we also needed to send a second message. After the host download, we needed to send the host totals, which gives the ATM the information about the date, the time, the fees and a few other fields. But because we were having to handle these messages afterward, we realized that we have to build a state machine. So state machines, for those of you who are not familiar are very fundamental of computer science and building. It allows you to build essentially code that works through a flow and allows us to take steps to go either go back to the beginning or reset or follow specific conditions. And it allows us to scale with new protocols and messages and see what's going on. So from the start, we receive either nothing or we get a clear parody bit and then complete the handshake, start the timer. If everything does not succeed within 30 seconds, reset back to here and wait for a message. If it's success or failure, failure, you stop and the message send a failure. With success, we have a few things that we have to check for for the messages and then the message type, we can send it off, see what it is and then send it to our payment processor. The original code looks something like this where we are hand constructing the message and looking for the parody to make sure everything worked and I do love the comment at the beginning. Encryption keys should be changed from static at some point, probably a good idea. But from that big block of text to something very simple where it just is process message, if everything works, send it to the handler and get the handler's response. Very much cleaner and it allows us to do things like this where we can see unknown messages, unknown parts, process the messages and you can actually see here in this message the components that actually make up the terminal ID, transaction code, the amount, the pin block and then all the other data that is associated and so then we can send it back. So once you get an ATM working, you need to get everything working because it's out of service. So once we were able to get the ATMs in service, we started working on a protocol to allow the ATMs to communicate to us in a meaningful manner. So this one is the first successful message that we had and you will see in a second that it actually, I don't know if you can hear it dialing, but it makes the actual dial up noises and then thanks for a second and then now it's gonna spit out the money. And so that was our first successful message through. The problem was, again, we were on a budget, this is not real money, this is play money and the ATMs are designed for a specific fabric type and weight. So it was shredding all our fake money and we found out that Jamaican currency is the perfect format for emulating real money because it's very cheap for us at least and it doesn't get shredded. So the end result was we support and we built out support, I should say, for over 20 different transaction types. We actually wrote 10 types and then there's six, and then there's success messages, failure messages error, where we had special response handlers for those. We only read one track on a two track card. Usually there's two tracks, one with the card number and then some name information. Only track one is red, that's not a feature of us. We can't read the second track really. It only is coming through with the ATM. So we only can read what it provides. The hard part was actual padding. It's a zero padded number. So you have three sets of pairs of zeros, so six in total and you have to move it over to either get cents, dollars or a larger amount. When you don't pad it correctly, this was all static when this was done. You can either get negative numbers or cents. So this was a ledger balance of a negative amount because you input all these values. Each one of these is a field back from the payment processor. It's not actually necessarily counted in the ATM. Well, the fees are counted in the ATM, but everything else like ledger balance, dispense, requested, fee, those are all responded back as the ATM. So here's a successful run. This was actually at the competition. So I'm gonna mute it because nobody can hear that. So she successfully did the enter to send the message and then you could see it where it took a second and the screen updated and the money came out. So at the end of this, what we wanna do is switch gears a little bit and ask ourselves why are 16 to 20 year old ATMs still in use? Why is the protocol still the same way? I know we're going to EMV on a lot of these and that's a much better protocol, but as you were seeing at the beginning, it's still Windows CE6, which is end of life. Those ATMs are still going to be in use for many years. And it is an expensive upgrade at that. So it's something to think about that these ATMs are still out there and that people are putting their banking details into these systems. There is some security, but Triple Des is not exactly known at DEF CON for being particularly good, let alone anywhere else. So we really need to think about that. And when designing protocols, yeah, these were designed in the late 90s, early 2000s, but we need to be making security first focus protocols for especially making systems and we don't. There's modern stuff, let's use it, maybe at least HTTP instead of unencrypted dial up. Not much better, but there's HTTPS, there's WebSocket, which should be used and can be used. And, but most of all, make the modules upgradeable and cheap because at the end of the day, if you give someone an easy way to upgrade their components, they will. And they will use the security that is provided to them. Most people are not security experts, so that would be a good point of starting. Anyway, I'm happy to answer questions. I will be wandering around the village, maybe waving at this point. If not, you can find both of us on Twitter, you can ask there, and you can download the ATM processor firmware yourself. It uses open word build image builder to build a custom image. All the code is based in Python, so you can get that working, has the webinar face, and you can go from there if you happen to have the specific ATM or series of ATMs. So with that, if there's any questions, feel free to ask me, and then if not, contact us. Alrighty, thank you.