Module 6: Manuals & Deployment Documentation

6.1 Scope

This document contains three parts: Part A Assembly & Deployment Guide, Part B Field Service Manual, and Part C Operator Configuration Manual, for the Money Roll micro-ATM.

Part A: Assembly & Deployment Guide

A.1 Exploded View and Parts Callout

              (1)
               |
        +------v------+
        |  Top cover   |
        +------+------+
               |
        +------v------+     (2) Bezel + Apex 7000 validator assembly
        |  Front panel |<----
        +------+------+     (3) Card dispenser bezel slot (CRT-591)
               |
        +------v------+
        |  Main chassis|---- (4) STM32F407 controller board
        |  frame       |---- (5) Raspberry Pi CM4 carrier
        +------+------+---- (6) LSM6DSO IMU mount point
               |
        +------v------+
        |  Cassette bay|---- (7) Steel cassette, Abloy Protec2 lock
        +------+------+---- (8) EE-SX671 beam-break emitter/receiver
               |
        +------v------+
        |  Base / anchor|--- (9) Anchor plate, 4x M10 holes
        |  plate         |--- (10) Grounding stud
        +---------------+

A.2 Floor and Wall Anchoring

A.2.1 Floor Mount (Primary Method)

WARNING: Do not anchor into concrete rated below 20 MPa or into slab thinner than 100 mm. Verify slab rating with facility documentation or a core sample test before drilling.

A.2.2 Wall-Mount Alternative

A.3 Thermal Dissipation

A.4 Grounding

WARNING: All exposed metal enclosure sections must bond to the single PE stud before mains power is connected. Do not create secondary ground paths through building steel; this can defeat the dye-pack fire circuit's isolation assumptions (Module 1, Section 1.3, Module 4).

A.5 Mains Power

A.6 Commissioning Checklist

1. Confirm anchoring torque (45 N.m) on all 4 anchors with calibrated torque wrench.
2. Confirm PE bonding resistance <= 0.1 Ohm.
3. Power on, verify STM32F407 and CM4 boot, confirm boot log has no fault codes.
4. Verify Apex 7000 validator STATUS response over ID-003 (Module 1, Section 1.3).
5. Verify CRT-591 dispenser STATUS response and hopper count (Module 2, Section 2.5).
6. Load empty test cassette, confirm micro-switch presence detect and RFID identity read.
7. Run tamper self-test: open front door in DISARMED state, confirm log entry, no fire.
8. Arm system, confirm state machine transitions to ARMED on service menu.
9. Confirm network connectivity: Ethernet primary link up, LTE fallback registers to carrier.
10. Confirm Horizon connectivity per /etc/moneyroll/stellar.toml (Part C, Section C.5).
11. Run one end-to-end test transaction: insert test note, confirm ledger credit, dispense test card.
12. Sign and file commissioning report with unit serial number, cassette RFID ID, and technician ID.

Part B: Field Service Manual

B.1 Cassette Swap Protocol

WARNING: Cassette swap requires dual control (two authorized technicians) and must only be performed with the system in DISARMED state.

1. Both technicians authenticate at the service menu (PIN plus fleet 2FA token) to enter Service Mode.
2. Confirm arming state indicator reads DISARMED (physical LED off). If ARMED, execute disarm procedure (Section B.1.1) before proceeding.
3. Technician A opens the rear service door using the physical key.
4. Technician B visually confirms the mechanical safety pin is inserted into the dye canister carriage (Module 1, Section 1.7.4).
5. Release the cassette sliding rail latch, withdraw the loaded cassette along its rail.
6. Confirm micro-switch reports cassette-removed and log entry is generated (expected, non-alarming while DISARMED).
7. Insert replacement empty cassette, confirm rail latch engages and micro-switch reports cassette-seated.
8. Confirm RFID reader reads and logs the new cassette identity.
9. Remove the mechanical safety pin from the canister carriage only after the new cassette is confirmed seated.
10. Close and lock the rear service door.
11. Re-arm the system via the service menu; both technicians acknowledge the tamper log summary presented on screen before exiting Service Mode.
12. Transport the removed cassette in a sealed, logged transit case to the cash processing facility.

B.1.1 Dye-Pack SAFE-ARM / DISARM Checklist

WARNING: Never bypass the mechanical safety pin. Capacitor-backed reserve power can fire the canister even with mains disconnected (Module 1, Section 1.7.4).

DISARM (before service):

1. Enter Service Mode with valid 2FA.
2. Confirm on-screen state reads ARMED before initiating disarm (sanity check).
3. Issue disarm command; confirm physical arm-indicator LED turns off.
4. Insert mechanical safety pin into canister carriage.
5. Confirm log entry: DISARM event, technician ID, timestamp.

ARM (after service, before closing unit to customer traffic):

1. Remove mechanical safety pin.
2. Confirm rear and front doors closed and latched (micro-switch state clear).
3. Confirm cassette seated (micro-switch and RFID both report present).
4. Issue arm command from service menu; confirm arm-indicator LED illuminates.
5. Confirm log entry: ARM event, technician ID, timestamp.
6. Acknowledge tamper log summary before exiting Service Mode.

B.2 Card Hopper Refill

1. Enter Service Mode.
2. Open front service panel to access CRT-591 hopper.
3. Load up to 200 CR80 card blanks, orientation per hopper label arrow.
4. Close panel, issue STATUS command from service menu, confirm hopper count matches load.

B.3 Bill Validator Lens Cleaning

B.4 Roller and Belt Inspection

B.5 Dye Canister Inspection and Replacement

B.6 Preventive Maintenance Schedule

B.7 Troubleshooting Table

B.8 Spare Parts List

Part C: Operator Configuration Manual

C.1 Debian 12 Hardening

C.1.1 Example nftables Ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    iif "lo" accept
    ct state established,related accept
    iif "wg0" tcp dport 22 accept
    ip protocol icmp accept
    counter drop
  }
  chain forward {
    type filter hook forward priority 0; policy drop;
  }
  chain output {
    type filter hook output priority 0; policy accept;
  }
}

C.2 Network Configuration

C.3 Hot-Wallet Key Management

C.4 Horizon Endpoint Configuration

/etc/moneyroll/stellar.toml:

[horizon]
primary_url = "https://horizon.stellar.org"
fallback_url = "https://horizon-backup.moneyroll-fleet.internal"
network_passphrase = "Public Global Stellar Network ; September 2015"
connect_timeout_ms = 3000
request_timeout_ms = 8000

[fee_bump]
enabled = true
max_base_fee_stroops = 10000
policy = "escalate_on_timeout"

C.5 Fee Configuration

/etc/moneyroll/fees.toml:

[fees]
service_fee_usd = 1.00
card_fee_usd = 10.00
bridge_spread = 0.005

C.6 On-Screen Service Menu Reference

C.7 Remote Fleet Telemetry

MQTT over TLS is used for fleet telemetry and command channels.