Module 1: Bill Validation, Transport & Neutralization Architecture

1.1 Purpose and Scope

This document specifies the design of Money Roll Module 1: the banknote acceptance, counterfeit detection, mechanical transport, cassette storage, anti-tamper sensing, and dye-pack neutralization subsystems. It covers component selection, wiring, timing budgets, mechanical tolerances, and verification procedures. It interfaces with Module 3 (enclosure), Module 4 (electrical), and Module 5 (firmware/Stellar) which are documented separately.

1.2 COTS Bill Validator Trade Study

Four commercial-off-the-shelf (COTS) validators were evaluated against counterfeit detection depth, throughput, host interface flexibility, reliability, and unit price at qualification-lot volumes (250 units).

1.2.1 Selection Rationale

The Pyramid Apex 7000 is selected as the primary validator.

1. It supports 4-way (any orientation, any face) note insertion, which reduces customer friction and repeat-insertion jams versus the ICT XBA-13's 2-way requirement.
2. It offers a factory 1,000-note internal stacker option that mates directly to the Money Roll steel cassette without an intermediate transfer stage, eliminating a jam-prone hand-off present in the MEI SC Advance's external-stacker configuration.
3. Native ID-003 serial interface with documented pulse and MDB fallback gives Module 5 firmware a stable, well-documented protocol without a ccTalk bus master.
4. Price/performance is materially better than the JCM iVIZION for equivalent detection channel coverage (optical CIS, IR transmissive/reflective, magnetic ink sensing, UV fluorescence).
5. MTBF and field support history are acceptable for unattended kiosk duty cycles (estimated 15,000 notes/month per unit).

The MEI Cashflow SC Advance is retained as the qualified second source; ICT XBA-13 is disqualified for lacking native magnetic detection; JCM iVIZION is reserved for high-fraud-risk deployment zones where the incremental cost is justified.

1.2.2 Apex 7000 Reference Specifications

1.3 Host Interface Decision

Decision: ID-003 serial protocol, TTL levels, 9600 baud, 8 data bits, even parity, 1 stop bit (8E1), optoisolated at the carrier board boundary.

ccTalk is retained as a firmware-configurable alternative (Module 5 exposes a validator.protocol config key of id003 or cctalk) in case a second-source validator ships only with a ccTalk stack, but ID-003 is the shipped default because it maps cleanly to a UART peripheral on the STM32F407 without a bus-arbitration layer.

1.3.1 Wiring Table — Validator Connector to Carrier Board

WARNING: Do not bond validator signal ground (pin 5) to chassis ground. The optoisolation boundary exists to prevent a dye-pack discharge transient or cassette-bay tamper event from coupling into the validator UART. Verify isolation resistance greater than 10 MOhm between signal GND and chassis GND at incoming inspection.

1.3.2 Escrow / Stack / Return Sequence

HOST (STM32)                          VALIDATOR (Apex 7000)
     |--- Poll status (every 100 ms) ----->|
     |<-------- IDLE -----------------------|
     |                                       |  [Note inserted by customer]
     |<---- ESCROW: note present, denom -----|  (decision <= 1 s from insertion)
     |---- Evaluate denom, session limits -->|
     |---- STACK command ------------------->|
     |                                       |  [Transport to cassette, <= 2 s]
     |<---- STACKED (ack) -------------------|
     |---- Credit ledger, trigger Module 5 ->|
     |                                       |
     |          (alternate path)             |
     |<---- ESCROW: reject / suspect --------|
     |---- RETURN command ------------------>|
     |                                       |  [Note returned to bezel]
     |<---- RETURNED (ack) ------------------|

1.3.3 Timing Budget

1.4 Denomination Table

All US Federal Reserve Notes share the 156 x 66.3 mm note dimension across all series validated by the Apex 7000.

1.5 Mechanical Transport

1.5.1 Bezel Alignment

Bezel alignment is fixtured at assembly using a go/no-go alignment gauge (Module 3 fixture MR-FIX-014) prior to fastening the validator bracket with four M4 x 12 mm screws, thread-locked (Loctite 243).

1.5.2 Motorized Roll Transport to Cassette

1.5.3 Cassette

1.6 Anti-Tamper Subsystem

1.6.1 Sensor List

1.6.2 IMU Thresholds

1.6.3 Fault Tree (Simplified)

                          [ ALERT CONDITION ]
                                  |
      -----------------------------------------------------------
      |                    |                   |                |
 Front door open      Rear door open      Cassette bay      IMU exceeds
 while ARMED          while ARMED         beam broken       tilt/accel
                                           OR cassette       thresholds for
                                           removed w/o       >= 5 s while
                                           2FA disarm        ARMED
      |                    |                   |                |
      -----------------------------------------------------------
                                  |
                    [ Any single condition TRUE ]
                                  |
                    Fire dye-pack trigger (Module 4)
                    Log event with timestamp, sensor ID
                    Transition state machine to FIRED

1.6.4 Arming State Machine

        +-----------+   technician arms    +---------+
        | DISARMED  | --------------------> | ARMED   |
        +-----------+   (after service)     +---------+
             ^                                   |
             |  2FA disarm                       | any tamper condition
             |  (technician + fleet auth)         v
             |                              +---------+
             +----------------------------- | ALERT   |
                                             +---------+
                                              |       |
                          confirmed genuine   |       | condition persists
                          (false trigger)     |       | past grace period
                                              v       v
                                         +------+  +-------+
                                         | SAFE |  | FIRED |
                                         +------+  +-------+

1.6.5 False-Trigger Mitigations

1. Armored-transit mode: before scheduled cash pickup, the technician places the unit in armored-transit mode via the on-screen service menu (Module 6, Part C) which extends the ALERT grace period to 30 s and requires simultaneous door-open plus beam-break to fire, accommodating expected door and cassette motion during a supervised swap.
2. Technician disarm with 2FA: disarming requires (a) a physical service key in the rear door lock cylinder and (b) a time-limited PIN issued by the fleet management backend and entered on the service menu, confirmed against a server-side one-time token.
3. Debounce of 250 ms on all micro-switch inputs to reject mechanical contact bounce.
4. IMU 5-second persistence requirement filters transient shocks from nearby construction, foot traffic, or vehicle impact against the enclosure.

1.6.6 Event Logging

All state transitions, sensor triggers, and disarm actions are logged locally to an append-only SQLite journal on the encrypted data partition and forwarded over the fleet MQTT channel (see Module 6, Part C) with monotonic sequence numbers to detect log tampering. Each log entry contains: UTC timestamp, sensor ID, state transition, operator ID (if applicable), and cassette RFID identity.

1.7 Dye-Pack Neutralization

1.7.1 Canister Options

Default selection: solenoid-actuated pressurized ink canister. This avoids explosives regulatory burden while still rendering stolen cash commercially unusable.

1.7.2 Ink Specification

1.7.3 Trigger Circuit Summary

The dye canister solenoid is driven from the Module 4 tamper-relay board, which receives an active-high FIRE signal from the STM32F407 GPIO only when the arming state machine (Section 1.6.4) reaches FIRED. The relay board includes a mechanical safety interlock (Section 1.7.4) and a capacitor-backed fire circuit so the trigger remains armed for 2 s after a mains power loss, preventing a thief from defeating the system by cutting power. Full driver schematic and component list are documented in Module 4.

1.7.4 Safety Interlocks

1. WARNING: The dye-pack fire circuit is capable of discharge even with mains power disconnected due to the capacitor-backed reserve. Technicians must confirm DISARMED state on the service menu and observe the physical arm indicator LED (off) before opening the cassette bay.
2. Mechanical safety pin interlock: a manual physical safety pin must be inserted into the canister carriage during any servicing, physically blocking solenoid plunger travel, independent of the electrical DISARMED state.
3. Dual-condition fire logic: the FIRE signal requires both the state machine FIRED transition and a hardware AND-gate confirmation from the cassette-bay beam-break sensor, preventing a single-point electrical fault from firing the canister.
4. Fire event is non-resettable in the field; a fired cassette must be returned for factory service and dye canister replacement.

1.7.5 Regulatory Notes

Use of ink-staining dye-pack currency protection during cash-in-transit and unattended cash handling is legal in most US states, consistent with long-standing bank dye-pack practice; however, operators must verify state-specific statutes (some states regulate placement of chemical deterrent devices in retail-accessible equipment) before deployment. Pyrotechnic dye-pack variants are explicitly out of scope for the baseline Money Roll product due to ATF explosives licensing and DOT hazmat transport classification; the solenoid ink canister is the shipped default for all markets.

1.8 Verification Test Matrix