Electronic price tag

Electronic price tag

Today we will focus on a small electronic gizmo that just begs to be opened in half to reveal its insides. Here is the clientIt is a “pricer”, an electronic tag as it is everywhere now. To get one: sort this out yourselves, I’m not going to spell it our for you! Do not pinch one in a store either, but if you think about it, it’s pretty easy …

Part I: how it works. Everything that follows is based on material gleaned here and there on the manufacturer’s website ( try googling “pricer” ), but basically these are electronic price tags controlled by IR remote. From what I understood from the demo from the neurasthenic commercial on Pricer’s web page, a Web interface coupled to a cluster of IR emitters can update tags at a distance, instantly and from a single control post. It is really an interesting system!

In terms of appearance, we have an LCD front panel, an IR sensor on the right. Behind you can see 3  2023 3V … it can still be used!

Now the insides. Here it is, you have your pricer? Then the job today will be to open the case to see how we can hackit. I heavily Dremel-ed it because I do not think it is possible to open the case gently. Take it easy, it’s not meant to be opened so it might be a bit difficult!

Once opened, here’s what remains:

Nothing shocks you at this moment?

no?

Yet the screen is always lit even when the batteries have been removed! Interesting, no? It can be explained simply by the fact that this screen is actually an e-paper, its pixels are small balls, white on one side, black on the other. They are rotated electrically. Thus, the pixels stays in position even when the circuitry runs out of juice. Excellent choice, with 3 button batteries one can get incredibly long lasting system, as this screen only uses energy when you change the display!

Time to move on, and take a  look at the circuit:

Haha, that is interesting! Three chips, including one embedded in resin. Nothing to do with this one, so let us focus on the two others. If you use your magnifying glass, you’ll see that the first one is an ATMEL ATMEGA16L, and the second an ATMEL952 25128AN.

Two google searches and two datasheet (here and here) later, here is what we can learn about them:
- the first one is a microcontroller, from the same family as the one on Arduinos
- the second one (the 25128) is a 128k SPI controlled EEPROM.

how cool! Would we take a look at what’s inside the EEPROM? Here is a part of the datasheet:

Our chip is an 8-leads SOIC (8 pins, Small Outline IC). Here’s some more informations about each pin:
- /CS: Chip Select. If zeroed, then the chip is enabled. This can be useful when daisy-chaining many memory chips. For more informations, refer to Wikipedia, SPI page.
- SO: Serial Out, where we are going to collect datas
- /WP: Write Protect, to write-protect the chip
- GND: ground
- SI: Serial Input, where we input datas
- SCK: SPI Clock. Here again -> Wikipedia.
- /HOLD: to suspend communications.
- VCC: +5V.

Now grab your best friend, your Arduino.

After some investigations, I dug out this page where how to communicate with an SPI chip is explained and, how lucky, even the code to send to the arduino is provided. For more informations, take a look at page 11 in the datasheet, where READ/WRITE datagrams are. roughly, you switch /CS, send READ/WRITE instruction, the address and read/write datas. The chip continues to send/read datas until you don’t switch /CS again. You don’t even need to increment the address pointer!

Oh well, all this is fine, but we will need access to the chip, no?

That’s where we grab our second best friend, the soldering iron. I highly recommend using a third hand, otherwise you might want to pull your hair off. Use as single-strand wire is much easier to set in place.

Let’s connect it to the arduino:

All you need now is to pray!

I slightly modified the code given onto the Arduino website in order to:
- avoid overwriting datas you need to read, holy crap!
- format output datas

Here is the code:

#define DATAOUT 11//MOSI
#define DATAIN  12//MISO
#define SPICLOCK  13//sck
#define SLAVESELECT 10//ss

//opcodes
#define WREN  6
#define WRDI  4
#define RDSR  5
#define WRSR  1
#define READ  3
#define WRITE 2

byte eeprom_output_data;
byte eeprom_input_data=0;
byte clr;
int address=0;

char spi_transfer(volatile char data) {
 SPDR = data;                    // Start the transmission
 while (!(SPSR & (1< return SPDR;   // return the received byte
}

void setup() {
 Serial.begin(9600);

 pinMode(DATAOUT, OUTPUT);
 pinMode(DATAIN, INPUT);
 pinMode(SPICLOCK,OUTPUT);
 pinMode(SLAVESELECT,OUTPUT);
 digitalWrite(SLAVESELECT,HIGH); //disable device
}

byte read_eeprom(int EEPROM_address) {
 //READ EEPROM
 int data;
 digitalWrite(SLAVESELECT,LOW);
 spi_transfer(READ); //transmit read opcode
 spi_transfer((char)(EEPROM_address>>8));   //send MSByte address first
 spi_transfer((char)(EEPROM_address));      //send LSByte address
 data = spi_transfer(0xFF); //get data byte
 digitalWrite(SLAVESELECT,HIGH); //release chip, signal end transfer
 return data;
}

void loop() {
 eeprom_output_data = read_eeprom(address);
 //Serial.print("At 0x");
 //Serial.print(address, HEX);
 //Serial.print(" = ");
 Serial.print("0x");
 Serial.print(eeprom_output_data,HEX);
 address++;
 //when finished dump, enter infinite loop
 if (address == 0x4000) {
 Serial.println("};");
 while(1);
 }
 Serial.print(", ");
 if (!(address%20)) Serial.println("");
 //delay(50); //pause for readability
}

If everything works well:
Little tip: the 0×4000 value corresponds to the size of our EEPROM, 128kbytes.