Taking money in a mall with nobody standing next to it

The challenge

An unattended kiosk that takes payment and produces something physical is three hard problems stacked on each other, and the third one is what makes it unforgiving.

Software that fails usually shows an error and waits for a human. There was no human. Whatever went wrong - out of media, a jam, a bad swipe, someone wandering off mid-flow - the machine had to resolve on its own and be ready for the next customer, because the alternative is a dead kiosk in a mall that nobody notices until the site visit.

The failure that actually matters is narrower than that. Charging a card and then failing to print is the one outcome you cannot recover from unattended. The customer has paid, has nothing, and there is nobody to ask.

And the interface had to be understood in seconds by someone who had never seen it, standing up, in a mall, with no keyboard, no instructions and no reason to persevere.

What we did

The ordering of the transaction did most of the work. The kiosk confirms it can fulfil before it takes money: printer online, media present, mechanism ready. Only then does it accept payment. That turns the unrecoverable failure - paid but empty-handed - into a recoverable one, where the machine simply declines to sell and says so.

Driving the hardware directly was the rest of it. A Zebra label printer and a magnetic card reader, talked to at the device level, so the kiosk knows what the printer knows: media out, cover open, mid-job failure. A kiosk that discovers a problem by having nothing come out of the slot is a kiosk that has already taken the money.

The interface was built for one shot. Big targets, on-screen entry, no accounts, no reading. An abandoned session times out and clears itself down to the attract screen - which matters because the last person entered their name and address, and it must not still be on the display when the next one arrives.

And the machine could never look like a computer. No exposed operating system, no window chrome, no way to reach anything but the flow, from boot to shutdown.

The outcome

It ran in malls and luggage stores with nobody standing next to it: browse, personalise, pay, and a tag comes out.

The lesson generalises past kiosks and is easy to get backwards. Everyone building unattended systems asks what happens when something fails. The more useful question is what order things happen in, because sequencing determines which failures are survivable at all. Checking fulfilment before taking payment is not error handling - it is arranging the transaction so the worst error cannot occur.

The same idea shows up wherever nobody is watching: verify you can finish before you start the part you cannot take back.