Composition
POS (Point of Sale) terminals integrate card reading, printing, display, and communication modules, encrypting PINs and magnetic stripe/chip data according to UnionPay and card organization standards. Mobile types have built-in 4G modules and need network access certification and PCI PTS testing.
Link
Transactions are routed from the acquiring institution to the issuing bank; sales slips and settlement files are reconciled at the end of the day. Weak network retries and reversal mechanisms prevent duplicate charges.
IoT Expansion
Self-service devices embed POS capabilities and require the same security level and remote monitoring.
Cellular Communication and Transaction Timing
Mobile POS and self-service terminals rely on 4G/5G long connections or on-demand dialing to send transactions. In weak network environments, TLS handshakes and DNS resolution may take several seconds, and the UI should provide prompts and set reasonable timeouts; the backend needs to record RSRP, RTT, and retransmission counts to distinguish between channel issues and terminal issues. The module firmware should support multiple APNs and automatic carrier switching strategies to avoid long-term attachment failures in underground or remote scenarios. For dual-SIM backup models, the conditions for primary/backup switching and transaction idempotency must be defined to prevent duplicate uploads through two channels.
Operations, remote keys, and compliance
A large number of machines and devices are distributed across cities and towns, requiring remote monitoring of battery, printer, card reader, and communication status, as well as support for batch parameter deployment. PCI and UnionPay standards have clear requirements for PIN keyboards, firmware signatures, and tamper-evident destruction; key injection production lines require zoned control and audit video recording. Log uploads should pay attention to data masking and encrypted channels to meet MLPS (Multi-Level Protection Scheme) and personal information protection requirements. Unlike pure internet payments, POS transaction chains are long and involve many parties, so reconciliation and error handling must reserve interfaces for manual work orders.
Engineering Practice Supplement
Regarding 'POS terminals,' it is recommended to distinguish real-time control links from non-real-time telemetry links in the architecture: control and interlock should be closed-loop locally wherever possible, while cellular networks are used for monitoring, configuration, and OTA. On the cloud platform side, observability metrics (connection duration, message latency distribution, error codes, reconnection reasons) should drive optimization rather than merely checking if it's 'reachable.' Documentation deliverables include interface specifications, error code tables, extreme operating conditions, and known limitations; test deliverables include test cases, data, and conclusions to facilitate third-party retesting or auditing.
Where Sensitive Messages Sit Inside the Terminal
The technical core of a point-of-sale terminal is not "a card reader that can get online." The PIN and sensitive card data may appear only inside a controlled security boundary. The PIN pad turns the PIN into a cipher block. The swipe or insert path packs track and chip data in the card-scheme format. What the application processor receives should already be ciphertext or a token. The cellular module sits outside that boundary. It carries the acquiring message out and the response back. It should not have a chance to see a plaintext PIN. A mobile terminal also has to fit the antenna, the battery, and the printer into one housing. Network-access tests and payment-security tests are two sets of conditions. Passing coverage does not pass the keypad and the tamper response.
In use, set a time box for the transaction: the window from authorization request to mandatory reversal, how long the user interface may wait, and how the device marks "result unknown" when the response is lost. Unknown is not a failure that should be tapped again immediately, and it is not a success that should dispense. With dual SIM, or cellular plus a wireless-LAN backup, only one path may be in flight for a given transaction. Before switching, confirm the previous path has given up. The station that injects keys remotely has to be separate from ordinary parameter download, and the audit trail cannot live only in an application log that can be overwritten.
The Reversal Window and Duplicate Submits on Two Paths
On a weak network the usual error is to treat a timeout as a failure and send a new trace. The acquirer may already have debited the account. Only the response failed to return, and the second transaction debits again. If the reversal uses a new trace number, the institution cannot match the original, the reversal itself fails, and the books get worse. Another error is for the backup path to resend the moment the primary times out, so both paths arrive. If a paper-out condition, or a tamper switch that fires when the PIN pad is opened, only lights a local lamp and is not reported, the remote view still says "communication is normal."
If the receipt time comes from a module clock that has not been set, the end-of-day file will not line up with the channel settlement day. Antenna problems before a near-field read enters the secure chip are covered in NFC payment. If a merchant-presented or consumer-presented code shares one result field with the card transaction, a complaint cannot tell a failed card read from a wallet decline. The difference between the two acceptance methods is in QR code payment.
Before a transaction leaves the security boundary it should form a local trace that cannot be altered: terminal id, trace number, amount, path id, and whether the result is unknown or decided. After power returns, read that trace first, then decide whether to query the original trace or allow a new one. An operator pressing confirm again is not evidence that the previous transaction failed. Once the PIN pad's tamper switch operates, transactions should stop and a report should go out. Locking the keypad locally while the communication side still shows online is not enough. A failed print must not roll back a debit that was already approved. Reprint or look up the voucher. Otherwise the operator thinks the sale did not complete and takes payment again. At the instant of a dual-path switch, if both paths are "sent, not answered," query the original trace first. Abandon the first path only after the channel shows it was not posted. If these states exist only in on-screen copy and not in the log, the end-of-day reconciliation cannot explain which machine the shortage came from. Trace number, path, and result-unknown have to be kept together. Missing any one of them blocks a reconstruction.