Pricer Electronic shelf label (ESL), part 1

Today we will focus on a small electronic gizmo that just begs to be opened in half to reveal its insides. Here is the clientIt is a “pricer”, an electronic tag as it is everywhere now. To get one: sort this out yourselves, I’m not going to spell it our for you! Do not pinch one in a store either, but if you think about it, it’s pretty easy …

Part I: how it works. Everything that follows is based on material gleaned here and there on the manufacturer’s website ( try googling “pricer” ), but basically these are electronic price tags controlled by IR remote. From what I understood from the demo from the neurasthenic commercial on Pricer’s web page, a Web interface coupled to a cluster of IR emitters can update tags at a distance, instantly and from a single control post. It is really an interesting system!

In terms of appearance, we have an LCD front panel, an IR sensor on the right. Behind you can see 3 2023 3V … it can still be used!

Now the insides. Here it is, you have your pricer? Then the job today will be to open the case to see how we can hackit. I heavily Dremel-ed it because I do not think it is possible to open the case gently. Take it easy, it’s not meant to be opened so it might be a bit difficult!

Once opened, here’s what remains:


Nothing shocks you at this moment?

no?

Yet the screen is always lit even when the batteries have been removed! Interesting, no? It can be explained simply by the fact that this screen is actually an e-paper, its pixels are small balls, white on one side, black on the other. They are rotated electrically. Thus, the pixels stays in position even when the circuitry runs out of juice. Excellent choice, with 3 button batteries one can get incredibly long lasting system, as this screen only uses energy when you change the display!

Time to move on, and take a look at the circuit:

Haha, that is interesting! Three chips, including one embedded in resin. Nothing to do with this one, so let us focus on the two others. If you use your magnifying glass, you’ll see that the first one is an ATMEL ATMEGA16L, and the second an ATMEL952 25128AN.

Two google searches and two datasheet (here and here) later, here is what we can learn about them:
– the first one is a microcontroller, from the same family as the one on Arduinos
– the second one (the 25128) is a 128k SPI controlled EEPROM.

how cool! Would we take a look at what’s inside the EEPROM? Here is a part of the datasheet:

Our chip is an 8-leads SOIC (8 pins, Small Outline IC). Here’s some more informations about each pin:
– /CS: Chip Select. If zeroed, then the chip is enabled. This can be useful when daisy-chaining many memory chips. For more informations, refer to Wikipedia, SPI page.
– SO: Serial Out, where we are going to collect datas
– /WP: Write Protect, to write-protect the chip
– GND: ground
– SI: Serial Input, where we input datas
– SCK: SPI Clock. Here again -> Wikipedia.
– /HOLD: to suspend communications.
– VCC: +5V.

Now grab your best friend, your Arduino.

After some investigations, I dug out this page where how to communicate with an SPI chip is explained and, how lucky, even the code to send to the arduino is provided. For more informations, take a look at page 11 in the datasheet, where READ/WRITE datagrams are. roughly, you switch /CS, send READ/WRITE instruction, the address and read/write datas. The chip continues to send/read datas until you don’t switch /CS again. You don’t even need to increment the address pointer!

Oh well, all this is fine, but we will need access to the chip, no?

That’s where we grab our second best friend, the soldering iron. I highly recommend using a third hand, otherwise you might want to pull your hair off. Use as single-strand wire is much easier to set in place.

Let’s connect it to the arduino:

All you need now is to pray!

I slightly modified the code given onto the Arduino website in order to:
– avoid overwriting datas you need to read, holy crap!
– format output datas

Here is the code:

If everything works well:
Little tip: the 0x4000 value corresponds to the size of our EEPROM, 128kbytes.

Here it is, the end of the first part. In th next one we will, if everything works fine (understand: “if I succeed”) how the data extracted from the chip is structured, how we can modify it and so on…

  • Hmm… Hacking to use it as a display sounds like one great idea. How about another… The prices are set by infrared you say? I am imagining a casual stroll through the local Wallymart with a reprogrammed TVBGone built into a ball cap. He He… All the prices say $1,000,000?!? How did that happen?

    Please don’t go the other way and use this idea to lower the prices. Do not try to buy stuff that way. That would be stealing!

  • deadbird

    Already thought about that, my tv-b-gone would fit considering a bit of programming. Unfortunately, there are a few difficulties about that:
    – i’m not sure about which wavelength the price tag uses
    – I don’t think I’ll be able to reverse engineer the code inside the ATMEL16L!

  • hey, there are 4 test pads labeled TMS, TCK, TDI, TDO so one could try accessing the AVR by JTAG!

    • deadbird

      @thefloe Yep, but I’m completely unexperimented about JTAG, all I know is a bit of theory…Furthermore I don’t have any JTAG debugger!

  • This is awesome – but I have never seen these in the USA, so stealing one is no an option. Please can you give us more information on where to buy/get one?

    Thanks!

    • deadbird

      Unfortunately, I have no advice for you about this, unless you find a local store that uses pricers.

  • anotherUser

    The pricer website sais, it works with two-way IR-communication:
    http://www.pricer.com/templates/Page.aspx?id=79

    “The infrastructure consists of controlling units termed Base Stations and bi-directional transmitters and receivers termed Transceivers. The base stations are connected to the Pricer server via a standard Ethernet network or via a serial link. The base stations communicate with the transceivers via a twisted pair cable network. The transceivers communicate with the Pricer labels using a wireless infrared two-way connection.”

    So, just sending to the tags might be no option.
    But maybe there is no big “security” built in. Reverse-Engineering the code might work. You can generate ASM-code directly from the AVR-dump. JTAG is a good option, too.

    I would also like to know where I can get some of that tags for research. 😉

    • deadbird

      @anotherUser you’ll have to manager that by yourself 😉

  • Two points,

    1) hacking the display in-store would be almost pointlesss – as the checkout terminal still knows the actual price.
    2) there seems to be more happening on the battery board – judging from the number of conductors in the flat interconnect ribbon…

  • JB

    Check D2 on the right. dunno what it is but it kinda looks like infered if it’s not a led. that would make since to me so they could program them with out having to rip them open to get to TP’s. whole foods in texas uses these

  • JB

    also it would be good to know what the chip covered in black is. it could be a rf chip. which would be even cooler. check TP14-16 for spi.

  • MB

    I would first try to analyse the infrared programming process!

    the easyest way would be to take an ir sensor connect it to an opam and connect this to the line in / mic in of your smartphone than simply record a audio file while someone who works in the shopis programming the tag

    viewing the audio file in a spectrum analyser software will givew you the modulaton frequence

    after this i would try to find out if it is possible to write that file via a ir diode to another tag or if every tag has a id

    i would LOVE to hack one of them, but im from austria an we have normal paper labels erverywhere

  • I am in with everybody else saying
    “where the heck do we get these!”

    Its not like I would mind paying!
    I couldn’t even find any info on them on the web, any links to the company that makes/sells them??

  • Same question:- where can I get one? actually all I want is the display.

    Any idea how to write to the display from a seperate processor? is it i2c or some other simple interface?

    • deadbird

      That’s what I’m trying to do, but I don’t have much time right now. But someone else’s trying to figure it out, more to come soon (at least I hope so!)

  • Where is the second Part ? can you send me the link ? Thank you!

    • deadbird

      Not issued yet. I’m working on it 😉

  • mrx23dot

    Any datasheet for the device? Maybe sniffing the price update packet?

    • deadbird

      For the whole device, no. And sniffing the transmission is an option, but I have no access to a shop that uses these pricers at the moment 🙁

  • God

    All the patents I could find on the Pricer manufacturer, this is a great start. Some protocol has been mentioned.
    http://db.tt/U5MCqCMi

    • deadbird

      Good job, thanks a lot!

  • Nivtitif

    Hi here, we’re a french group trying to reverse a Pricer electronic tag. The model is different from yours, we have only one chip embedded in resin. We’re trying to guess the chips with the number of pin. We plan to sniff the communication between the pricer and the IR device with an IR receiver in order to understand the protocol.
    I’ll keep you informed. (I’ll post a photo tomorrow with the card)

  • Sep

    Hi,
    I actually snitched one of these an hour ago, I was lucky to get the big ones, it probably a 3.4″ e-paper display, and I opened it up and has the same Atmega16L but instead of one 8lead, has 2 and it doesn’t say atmel on it, just 5S256. Anyways how’s it going with part 2, have you found if there’s a way we can use the display? like show stuff?

    Thank you

    • deadbird

      Unfortunately, I haven’t had time yet to complete this project. It’s still on my to-do list although 😉

      • Sep

        Oh! yeah it’s the only thing on my mind, I have found the Rx and Tx pin, I thought of connecting it and programing the arduino bootloader and then see if we can write a code to display something, cause I really dont want to change prices!

        thank you

  • Fullmono

    Up!
    This could help you: http://furrtek.free.fr/?p=crea&a=esl

  • Any update, there are some lots on sale on ebay of these displays:
    http://www.ebay.es/itm/6-X-Mini-E-Ink-E-Paper-Display-ATmega644-WATCH-THE-VIDEO-Arduino-Pi-/331656661440?&_trksid=p2056016.m2516.l5255

    On the announcement there’s a link to this page under:
    https://deadbird.fr/?p=157
    (Someone else hacking a shelf edge e label display)