First of all, sorry for the delay. Life's been kinda busy and I didn't make any really interesting progress on the project; still, I think I gathered enough material for an update (at least, now you know I'm still alive!).

Anyway, the first major news is that I FINALLY GOT A PHONE! A 4F model from the good old eBay, obviously. Photos will follow when I finish cleaning it and I get the time to drag the damn thing outside to get some nice shots of it. That said, the main reason I got it cheap-ish (we're talking about 100€ instead of the usual 300€+) he thing is in pretty sad shape cosmetically (lots of paint missing, and where it's still attached it's faded) BUT it's complete and it has a card reader with it.

The first problem I had is that it didn't come with a key; no biggie, I thought, the little coin door on the side has a standard puny brass lock, I'll get inside through that. Yeah, it didn't work. I was able to open the coin door itself, but the phone is built like a tank and you can't really access much of anything from there. Long story short, I had to buy a key (there go another 30€ down the drain) to get inside; I'll post the key code here as soon as I decode it, so that anybody interested can cut their own key.

Once inside, however, I was finally able to get a lot of the data I was missing on the internals. Here's the main discoveries I made, in no particular order:

a) Remember the small "mystery board" from log n° 2? Well, turns out it's the card reader interface; The reader itself connects to the upper connector (at least in mine) and the black potted module is a voltage regulator (I already depotted one, hopefully I'll post the schematic soon). This however raises a doubt: remember how I said all the variants of the phone could support a card reader? Well, the original 2F boards don't have the connector for the interface board; I can't say for sure without looking inside an original 2F, but I suspect the card-reader-equipped 2F phone I saw on eBay might have been something
made by the seller.

b) The missing board. The board I didn't have, which is the one in the middle of the mechanical section, is indeed the coin discriminator. It was made by MEI (Mars Electronics) for IPM and its sensor is of the inductive type.

c) Connectors. I figured out the pinouts for most of the connectors:

1. The four-pin connector on the line interface board is for the coin safe; two NC switches sense if the coin door is closed and if the coin tray is inserted
2. As said before, the right angle multi pin connector on the line interface board is for the card reader interface
3. The big connector on the main board is used to connect all the solenoids, switches and photo interrupters on the mechanical section, plus the display and the coin discriminator boards
4. Still no definite answer on the 6-pin connector on the line interface board. Probably used for an external coin safe, which my phone lacks.

Again, detailed schematics will follow hopefully soon.

One source of information I initially didn't think to check is the Italian patents database. After all, I knew that some aspects of the phones ARE indeed patented (for example, the magnetic card system), so I realized there might be something helpful in there. Again, here's my discoveries, in random order:

a) Data communication. In my first post, I said that all Rotor phones have the capability to "talk" with the phone company, to report back status information; this was taken from Wikipedia, and I couldn't find any reliable data source (there's some stuff on forum posts, but everybody seems to have a different opinion on the matter). There's no doubt the 4F and the OV models have advanced comms capabilities: the remote card check wouldn't work without it AND we have parts of the OV technical specs that clearly talk about OverVoice HDLC communication; I was always dubious about the 2F model, however, especially after the whole card reader interface discovery and especially since it's confirmed by multiple sources that the phone can work on a normal line without modification. I still don't have a definite answer, but the Italian patent IT1078601B from 1985 shows that Urmet had already designed a phone with data capabilities in mind. The patent describes a phone that is pretty similar to the G+M that transmits and receives data such as coin count and fault info to the phone company by flipping the line polarity to send digital data. No idea if this was actually implemented in the G+M (which was released before this patent) or the 2F, but this proves that it's possible that the 2F had some degree of bidirectional data link. There's also a patent from '89 (IT1203533B) for an "overvoice" FSK modem for public phone use, also by Urmet; again, no definite answer, but still interesting.

 b) On the magnetic cards. Patent IT1159459B (1987) gives us a bit more information on the magnetic phone cards. First of all, they appear to actually have three tracks, with the two outer ones being identical and having the data on them and the middle one being a "clock" signal. This would explain the weird "pseudo-ternary" data encoding observed by the Phreakers from the Magneto project (see previous logs for more details). The whole idea was that a card like this could be read with a normal two-track head, with the two resulting signals being the combination of data+clock, but copying the cards would be a lot more difficult; modifying the "remaining credit" value would still be possible with a two track head since the credit data was stored as a series of peaks at the and of the magnetic band, each having the same monetary value, which were simply erased as the credit was used up.

I'm fairly sure this is the same magnetic card system that was used for the Rotor phones since all the details add up (I checked and the Rotor card reader has two-track heads and is internally pretty similar to the blue reader which was used on a small number of G+M phones). It looks like, though, that copying the cards wasn't as hard as the people at Urmet were expecting because there's multiple reports of Phreakers copying them with standard magnetic tape recorders for audio use.

c) The coin rotor itself. No interesting information for our purposes, but patent IT1181630B describes the internal coin rotor (which gives the phone its name) in great detail.

I hope you found this update interesting. I would've liked to have some more interesting data for you (schematics, pictures and details on the mechanisms, or at least some internal photos) but I'm still working on all of those things. Again, hopefully I'll be able to post them in the near future.