The Tower Light on My Machine Stays Green Even When Nobody Is Playing
A venue operator in Mexico City called me one evening in late November with a situation that had been puzzling him for several days. He had been doing a routine security walkthrough of his 52-machine arcade at around 3:30 AM, after the venue had closed and the front doors were locked. As he walked down the main aisle between the racing simulators and the prize redemption area, he noticed that one of his fish table cabinets had its tower light glowing solid green. The machine was showing an active gameplay state — green typically means the machine is in active play or ready for play with credits loaded. But the building was empty. There were no players, no staff at that machine, and the cabinet door was locked. He walked over and checked the screen. The game was displaying the attract mode, but the credit meter showed 1,200 pesos in credits. The machine had been played that evening, but the last customer left at 1:00 AM. By 3:30 AM, those credits should have either been played through or the machine should have entered its idle timeout state and turned the tower light to blue or amber. Green meant something else was happening. He took a photograph of the tower light and sent it to me. What I saw in that photograph was a tamper indicator that most operators miss completely.
What Tower Light Behavior Tells You About Machine State
Tower lights are not decorative. They are status indicators that communicate the machine’s internal state to floor staff without requiring anyone to stand in front of the screen. In a properly functioning machine, the tower light color corresponds to a specific machine condition. Green typically indicates active play or credits available. Red indicates a fault, error, or tilt condition. Blue or amber typically indicates idle or attract mode. White or purple may indicate a service mode or a special event. The exact mapping varies by manufacturer, but the principle is consistent: the tower light is a real-time visual representation of what the machine’s internal state machine thinks is happening.
When the tower light shows a color that does not match the actual physical situation — green when no one is playing, red when the machine is functioning normally, flashing colors when no one is touching the controls — the machine’s internal state no longer matches physical reality. This mismatch is not a glitch. It is a symptom of tampering. The machine has been instructed to report a specific state to the tower light controller, and that instruction came from somewhere other than the normal game flow. In the Mexico City case, the green light at 3:30 AM meant that someone had remotely accessed the machine and set it to a state that kept credits active without triggering the idle timeout. The cheater could return the next morning, log in, and retrieve those credits as a payout or transfer them to another machine.
Operators in other parts of Latin America have reported similar anomalies. A venue in Bogota had three machines whose tower lights would turn green simultaneously at 4:15 AM every morning, remain green for approximately 20 minutes, then return to blue. The pattern repeated for eleven consecutive days before the operator noticed. In Guatemala City, an operator reported a machine whose tower light would flash red and green alternately — a sequence not defined in the machine’s manual — for about 30 seconds every time a specific employee swiped their access card at the machine. These behaviors are not random. They are the visible output of hidden instructions being sent to the machine’s I/O controller.
The key insight for operators is that tower light anomalies are often the only visible symptom of background tampering. The screen looks normal. The coin acceptor works normally. The credit meter shows normal values. But the tower light, which most operators ignore once the machine is installed, is broadcasting a state mismatch every time the tampering software sends a command to the machine. If you are not watching the tower light at the moment the command is received, you will miss it. That is why the Mexico City operator noticed it at 3:30 AM during a security walkthrough — the venue was quiet enough that the green light stood out against the darkness.
How Cheaters Manipulate Indicator Systems — The Technical Layer
Modern arcade machines use a centralized I/O controller — often a microcontroller on the main board or a separate I/O interface board — that manages peripheral devices including the tower light, coin acceptor, bill validator, and button deck. The tower light is connected to this controller through a simple interface: typically three or four GPIO pins that control red, green, blue, and sometimes white LED channels. When the game software wants to change the tower light color, it sends a command to the I/O controller, which sets the appropriate GPIO pins high or low to produce the desired color.
The manipulation works by injecting commands directly into the I/O controller’s command stream. There are two common methods. The first is physical: the cheater opens the machine cabinet, locates the I/O controller board, and connects a small microcontroller — often an Arduino or similar device — to the communication bus between the main board and the I/O controller. This device listens for normal traffic and periodically injects its own commands to change the tower light state. The injection can be timed to occur during specific windows — for example, 15 minutes after the venue closes — so that the tampered state is active when the cheater returns to extract value from the machine.
The second method is software-based and does not require physical access during operation. If the cheater has previously installed modified firmware on the machine — either by replacing the EEPROM chip or by exploiting a firmware update mechanism — the modified firmware includes routines that periodically send I/O commands to change the tower light state. These routines can be triggered by specific conditions: a specific time of day, a specific pattern of coin insertions, or a specific button combination entered on the control panel. The tower light becomes an output channel for the hidden firmware, broadcasting its active state to anyone paying attention.
In both cases, the relationship between the machine’s displayed state (what is on the screen) and its reported state (what the tower light shows) is deliberately broken by the tampering software or hardware. The screen shows attract mode. The tower light shows green. A normal machine in attract mode should have a blue or amber tower light. The mismatch is the evidence. The cheater does not care about the tower light — it is a side effect of their modification. But for the operator who knows what to look for, that side effect is often the first and most visible sign that something is wrong.
The technical barrier for this type of tampering is moderate. Physical injection requires basic electronics knowledge and 15-30 minutes of access inside the cabinet. Firmware-based injection requires the ability to read and write EEPROM chips or to exploit a firmware update process, which is more advanced but still within reach of anyone with intermediate technical skills and access to online forums where modified firmware is shared. The hardware cost is negligible: an Arduino clone costs less than 200 pesos, and the wiring requires three or four jumper wires.
What to Look For: Identifying Tampered Indicator Behavior
The most important step is establishing a baseline. You need to know what your machines’ tower lights look like in each state so that you can recognize when something is wrong. Spend 30 minutes observing your machines during normal operation. Note the tower light color when the machine is in attract mode (no credits, no player), when credits are loaded but no game is active, when a game is in progress, when a game ends, and when the machine enters an error or tilt state. Write these down. Take photographs of each state. This becomes your reference for detecting anomalies.
Once you have a baseline, monitor for these specific anomalies: tower light showing active-play colors (green) when no one is at the machine; tower light showing error colors (red) when the screen shows normal operation; tower light flashing in a pattern not described in the manual; tower light changing color at specific times of day; and tower light colors that do not match the credit meter state. Any one of these anomalies warrants investigation. Two or more appearing together almost certainly indicates tampering.
Conduct a physical inspection of the I/O controller and wiring. Open the cabinet and examine the area around the main board and I/O controller. Look for additional wires connected to the I/O pins that do not correspond to any factory-installed peripheral. A common telltale is a small wire leading from one of the I/O pins to a connector or breadboard inside the cabinet. Also look for any device — Arduino board, Raspberry Pi Zero, or similar small circuit board — that is not part of the factory configuration. These devices are sometimes tucked behind the main board or inside the coin acceptor housing to make them harder to find during routine inspections.
Check the firmware version displayed in the machine’s service menu. Compare it against the version you originally installed. If the version number is different, or if the service menu shows a build date that does not match your records, the firmware has been modified. Some cheaters are careful to preserve the version number so that it appears unchanged, but they cannot hide changes to the build timestamp if the service menu displays it. Also look for additional menu items in the service menu that are not described in the manual — these sometimes appear when modified firmware is installed.
Review your security footage if you have it. Tower light anomalies are visible on camera even if the screen is not. If you have cameras covering your arcade floor, review footage from the time windows when anomalies were reported. Look for anyone approaching the machine during those windows — particularly anyone who opens the cabinet door. Even if you did not catch the tampering in progress, the footage may show who was near the machine immediately before the anomaly first appeared, which helps identify the responsible person.
Addressing and Preventing Tower Light and I/O Tampering
Physical security of the cabinet is the foundation. The I/O controller and main board should not be accessible without opening the cabinet door, and the cabinet door should be locked with a restricted-keyway lock. As with coin acceptor tampering, standard cam locks are insufficient. Replace them with locks that use a keyway not commonly available. Add a tamper-evident seal across the cabinet seam so that any unauthorized opening is visible. Inspect these seals daily as part of your opening or closing procedure.
For machines with network connectivity, disable or secure the firmware update mechanism. Many modern arcade machines include a network-based firmware update feature that allows remote updates. If this feature is enabled and uses a default password or no authentication, a cheater can push modified firmware to the machine without ever opening the cabinet. Disable remote firmware updates unless you are actively using the feature for legitimate maintenance. If you must keep it enabled, change the default password and restrict the update server to a specific IP address range that you control.
Install tamper detection switches on the cabinet doors if your machines do not already have them. These switches send a signal to the I/O controller when the door is opened, and the event is logged with a timestamp. If your machines do not have this capability, aftermarket door switches can be added for approximately 150-200 pesos per machine. The log entries created by these switches provide a record of every cabinet opening, which helps identify unauthorized access even if the cheater attempts to hide their modifications.
Audit I/O commands as part of your regular maintenance routine. Some newer machines include a diagnostic mode that logs I/O commands — including tower light changes — with timestamps. Review these logs monthly. Look for I/O commands that occur outside of normal operating hours or that do not correspond to any user action. A tower light command issued at 4:15 AM when no one is in the venue is a clear indicator of tampering. The diagnostic log is often the only place where these commands are recorded, because they do not appear in the standard transaction or error logs.
If you confirm that a machine has been tampered with, the response should be comprehensive. Replace the I/O controller if physical injection was used — the cost of a new controller is approximately 800-1,200 pesos, which is minor compared to the ongoing loss from undetected tampering. Reflash the firmware to factory defaults from a known-good image. Change all passwords associated with the machine, including service menu passwords and network credentials. Document the serial numbers and details of any unauthorized hardware found inside the cabinet. If you have identified a suspect, share this documentation with law enforcement or your security team.
Q: Can a tower light anomaly be caused by a faulty LED module rather than tampering?
A: Yes, LED modules can fail. But a failed LED module typically results in a light that does not turn on, flickers intermittently, or shows the wrong color due to a failed channel — for example, green and blue both on when only blue should be on. Tampering produces state mismatches: the light works correctly most of the time but shows an impossible state at specific times or under specific conditions. A faulty LED is random. Tampering is patterned. If the anomaly occurs at the same time each day or only when a specific person is present, it is tampering, not a hardware failure.
Q: Do all arcade machines use the same tower light color scheme?
A: No. The color scheme varies by manufacturer and sometimes by game title. What is consistent is that the tower light is a deliberate status indicator, and the mapping between machine state and light color is documented in the technical manual. If you do not have the manual, contact the manufacturer or search online for the service manual for your specific model. Once you know the intended mapping, any deviation from it is either a fault or tampering. You cannot detect anomalies if you do not know what the correct behavior looks like.
Q: How long does it take for someone to install an I/O injection device?
A: With physical access to the inside of the cabinet, an experienced person can install a simple Arduino-based injection device in 15 to 30 minutes. The device is connected to the I/O communication bus using jumper wires. The wiring is non-destructive — no soldering is required if the I/O pins are accessible through a header connector, which they are on most machines. This means the installation can be completed quickly and removed just as quickly if the cheater anticipates an inspection. Regular physical inspections are necessary because the hardware may not remain in place between inspections.
Q: Can I detect this type of tampering without opening the cabinet?
A: Tower light behavior is visible without opening the cabinet, so observing anomalies is possible from the floor. But confirming the cause — physical injection versus firmware modification — requires opening the cabinet and inspecting the I/O controller and firmware. If you observe a tower light anomaly, document it with photographs or video, note the time and machine number, and then schedule a physical inspection as soon as possible. The longer you wait, the more opportunity the cheater has to remove evidence or cause additional damage.
Q: Is there a way to make the tower light tamper-evident?
A: Some operators have added a small label or seal over the tower light housing that must be broken to access the LEDs or wiring. This is a low-cost deterrent that makes it more difficult for a cheater to modify the tower light hardware without leaving visible evidence. A more sophisticated approach is to connect the tower light controller to a separate monitoring system that alerts you when the light changes state outside of expected hours. This requires additional hardware but provides real-time detection rather than relying on periodic visual inspections.
What to Do Next
If you have noticed tower light behavior that does not match what the machine manual says it should do, start by photographing the anomaly. Note the time, the machine number, and what the screen was displaying at the same moment. This documentation is the starting point for determining whether you are looking at a fault or tampering.
Send those photographs to me along with the machine model and, if you have it, the page from the manual that describes the tower light behavior. I can often identify whether the observed behavior matches a known tampering pattern or whether it is likely a hardware fault. Either way, having the documentation on record helps if the problem escalates and you need to take formal action.
Make tower light checks part of your daily walkthrough. It takes five minutes to walk the floor and verify that every machine’s tower light matches its physical state. Those five minutes have caught more tampering attempts than any other single practice I have recommended to operators. The tower light is trying to tell you something. You only need to look at it.