California uses a radio-tag system called FasTrak for vehicles, and recently they sent me a new tag.

So naturally I had to open up the old tag, right?

@foone
Who wouldn't?

@foone

Oh I want to see this. I have one too.

@foone they have absolutely forced your hand, you are blameless in this

@foone you are duty bound to tell the Bay Area what you find!!!

This is the closest I was able to get to a non-blurry picture.
It's not super complicated inside: Two main big components, a battery (non-rechargable lithium!) and a switch. The antenna is built into the PCB itself.

It's officially called a T21 Internal Tag Fixed Battery Switchable

(some models don't have the switch)

part number R2916-219

@foone

I know what most of that is... but what is the EAST SFM 1640A package?

Piezo Transducer?

What is this for? Does it detect the car running? Something at the toll booth?

https://www.multicomponent.se/wp-content/uploads/SFM-1640A.pdf

@foone with the way that is labeled I wonder if that is the second design, or the production release of the 22nd version. Having both rev and v2 makes me wonder.

This thing in the corner under the designation BP1 is an SFM-1640A by East Electronics, an SMD External-driveen Piezo Transducer.

This thing beeps when you change the number of occupants or (sometimes) when it gets scanned.

@futurebird @foone I would imagine it beeps when you go through a toll booth? Ours don’t in WA but that’s what I would imagine this component is for.

@amd @foone

I suppose that makes more sense.

And the microcontroller is a TI MSP430F2121 Mixed Signal Microcontroller.

Datasheet says this runs at 1.8v to 3.6v, and ultra-low power consumption: 250 µA at 1mhz, 2.2v, 0.7 µA on standby, and 0.1µA when off (with RAM retention)

@futurebird @foone from the data sheet talking about peak-to-peak input voltage and the frequency response to decibel chart, I'd guess it's a piezo beeper, not an input

It's a 16-bit RISC architecture, 256 bytes of RAM, 4K +256B of flash memory

@foone I wonder if they left the JTAG fuse unpopped so you can pull the code off the MSP?

@foone oh hey, an MSP430

That battery is the Tadiran TL-4934 Lithium Thionyl Chloride.
Nominal capacity of 1 amp-hour.

if they're running this thing at 10µA on average this battery will last about 11 years

@futurebird it beeps when you change the number of occupants, and sometimes when you go through a toll booth

@foone

Could it be hooked up to a front panel and turned into a minicomputer many times more powerful than the stuff that sold for tens of thousands of dollars in the 70s? That'd be hilarious.

@MegaMichelle if it's reprogrammable! they may have fused it off

that's all I can tell without being able to photograph it better (I'm doing this while laying down) or do some continuity testing

@foone what? dont tell me everyone has to have a tracker in their car...

@RueNahcMohr it's optional, but it's used to access carpool lanes and pay for bridge tolls

@foone Love to see MSP430s in the wild - its the first MCU platform I ever learned to develop for, as TI made an unsuccessful Arduino knockoff platform called LaunchPad based around these things in the late 00's.

Reasonable choice for a long-lived fixed-battery device, as well, their standby power management efficiency is unreal.

@foone it doesn't support a 32 MHz crystal

@whitequark oh right I misread it.

so fun fact the spec for how these work is public:
https://web.archive.org/web/20131231125912/http://www.dot.ca.gov/hq/traffops/itsproj/Title_21/Report/Title%2021%20Specification.pdf

and as I guessed, they're RFID.
The reader transmits at them to turn on the tag so it can return an identification signal

it says these things wake up if you send them a 33 microsecond RF pulse at 915 Mhz, all ones in manchester encoding

so presumably with a SDR you could make this thing identify itself by sending the proper message at it.

other interesting notes from the pdf:
it runs at 300 kbps, which seems awfully fucking fast for a system that is only sending, like, 60-124 byte messages?

it also has an "agency code" in there. So the tag can be smart enough to not identify itself if similar tags are being used for some other purpose

each transponder has a 32bit code to identify it. which seems low, given that the US already has something like a third of a billion cars.
(This is a california-specific tag but they do mention specifically making this standardized so it can be used nationwide)

some more message structure info:
https://web.archive.org/web/20131231093328/http://www.dot.ca.gov/hq/traffops/itsproj/Title_21/Report/Title%2021%20Approved%20Record%20Types.pdf

oh god, the 32bits is structured, it's not just an ID to some internal Cal DOT database:
https://web.archive.org/web/20131231084853/http://www.dot.ca.gov/hq/traffops/itsproj/Title_21/Report/T21CATransponderIDVer17.pdf

@foone "All ones manchester" negates the PSK nature of the encoding. Do they mean no keying of the 915MHz carrier, or square-wave modulated at some unstated bitrate?

the first 4 bits are your tag type, based on how many people are in the car. The next 18 bits are the facility number. the state of california has 75001 facilities, each of which can have up to 1024 tags

WHAT DO YOU MEAN THEY ASSIGNED A MILLION TRANSPONDER IDS TO A BRIDGE IN CANADA?

@n1vux it's not PSK, it's ASK

@foone @n1vux
Manchester Coding is a PSK (= inversion) of the double-clock-speed squarewave ASK of the carrier. It's always weirdness when you get down to baseband signals ...

so the Golden Ears Bridge in Metro Vancouver, British Columbia had electronic tolls from 2009 to 2017, including transponders you could install on your car to auto-pay

this sounds like they cooperated with the california department of transportation and just used the FasTrak system for their toll system

@foone how do you always manage to find the strangest facts about electronics that I will never see again, let alone interact with

this is what being in the technological information age does to a mf.

@foone I’m thinking of the 433MHz pulse transmission systems .. the bit rate is pretty high but the signal is extremely short. My weather station on the roof runs for many many years on 4x lithium primary AA cells. At some point you spend more power transmitting the carrier than the bits. There must be an optimal bit rate for minimum power.

@pyro you just need to dig. everything is a rabbit hole if you dig deep enough, there's always weirdness going on if you keep looking

ahh, here we go:
"Effective January 1, 2019, Caltrans adopted a new protocol known as 6C. The existing Title 21 protocol will continue to be used for seven years after that date, and then be discontinued. The seven-year overlap with the two protocols is intended to give the toll facility operators the necessary time to eliminate their existing inventory of the Title 21 transponders."

so I wonder if this means my transponder is actually 6C, not Title 21?

or if this one is title 21, and the new one is 6C?

the new protocol is designed to conform to ISO/IEC 18000-63 which'll let it interoperate with other states/nations implementations of automatic vehicle identification

links for info on the current implementation:
https://dot.ca.gov/programs/traffic-operations/electronic-toll

making them intercompatible is a good idea, imo.
the current situation is that the US has 15 separate standards, and two of those are for Michigan

a funding bill in 2012 required that they all be intercompatible by 2016, but that didn't happen. obviously.

@foone Interesting that North Texas Tollway Authority is a member of the 6C coalition but uses a completely passive (reader-powered) sticker instead of a battery-powered box. I like that the Fastrak boxes beep on read (and can be moved between vehicles) but the NTTA stickers are cheap enough they send them to you for free.

@timjclevenger Fastrak has sticker versions too, they just don't have the "flex" functionality

@foone I'd assume it's so that there's redundancy for missed/garbled packets and so multiple vehicles/readers can be read in quick succession.

the louisiana version is called "GeauxPass", which I assume is pronounced "GoPass" and not "GooPass". eww

Anyway these are just the RFID versions. Plenty of places are using versions based on license plate readers, either automatic or manual

oh wait, this one is definitely Title 21! it says as much on the PCB

so yeah, my new one must be 6C.

I did get two 6C tags, so I could disassemble one... but I think I've misplaced the spare

@foone
I'm trying and trying to figure out what exactly my Washington state "Good to Go" RFID sticker is, and I'm just coming up empty. Which probably means it's some proprietary standard from the toll collection vendor.

@foone reminds me of the nearby apartment complex that rebranded itself "Timbre" with a picture of a tree, and me, a person with a music degree: "I don't think that means what you think it means (or sounds the way you think it sounds)"

@kinsale42 oww

@foone I saw 6C and had to read back through the thread - Long-range RFID, or sometimes called Automatic Vehicle Identification (AVI) is one of my favorite boring things I get to work with. Older "active" tags like your CalTrans are a lot more interesting (I've even seen some with little screens in them showing how much toll you've just paid!) but nowadays a lot of tolling agencies are moving to effectively glorified stickers. It's a super cool technology - the radio field induces a current in a coil of wire, powering the chip, which then modulates its power usage to transmit its ID, so you can read a tag on a car doing highway speeds from 15 feet overhead!

@foone French pronunciation of it would be gopass, with a soft g (like the g in danger).

oh wow. The new one has no battery, and still supports the flex option where you can set it to 1, 2, or 3+ occupants

@foone passive rides were the earliest type (in Europe at least). They didn't have switches though. Clever

@foone How could you not while remaining Foone Turing?

@foone ISO/IEC 18000-63 is passive backscatter UHF, where the tag is energized by a continuous signal from the "reader" and modulates its reflective cross section to send data. It wouldn't be too hard to wire some inputs so that some transmitted bits depend on external state.

(I haven't checked the current state, but last I saw this was pure static ID only. Not remotely enough passive power to do any kind of cryptography.)

So here's the new version. It's got a little rotational thing instead of a switch. Much smaller, much thinner, less beepy.

Inside it's super simple. There's an antenna on the back, and a spring to make the wheel snap to the three numbers

@foone lmao of COURSE it’s an MSP430

Under the wheel, you can see the antenna is two parts, with a gap in the middle.

And there's two squares under the wheel.

@foone yeah manchester encoding makes sense

And here's the trick: It's not an RFID tag... it's three RFID tags!

Which one is connected to the antenna depends on how it's rotated, while the other two end up flush against those rectangles. Only the one with the antenna gets enough signal to respond, so only that tag can be read.

@foone oooh that is so smart

@foone i wonder about the longevity, especially in moist climates… it feels like those contacts would corrode really fast if just left on the dashboard

@foone it's got pregnancy test vibes

@jordan wait if I'm pregnant does that mean I can use the carpool lane?

@domi it might be that they're counting that these will only last a couple years, but if they cost 1/10th as much as the old tags they can just replace them every couple years

@mei @foone does that matter in humid environments? i guess it’s a bit better nowadays because most people will have A/C in their car, but 10+ years ago I remember moisture condensation being a huge issue, especially during winter months

@mei @foone generally: i would not classify a car as an universally dry place :p

@foone yeah, they love doing that down there. You see a lot of "Geaux Tigers!" in football season, for example

@foone@digipres.club @domi@donotsta.re I wonder if that close proximity between the two contacts might be enough to allow RF to jump the gap even if the outside is a little corroded?

@mary @foone i think this would mess with impedance matching, which would in turn sharply reduce the strength of the signal

then again, maybe this is not a problem! and this looks like a 50 cent device, so it’s not like this matters much anyways

@domi @foone @mei that's what dielectric grease is for squeezes entire tube onto PCB

@tully @foone @mei mmm,,, it’s leaking

@foone THAT is clever. What does the occupant selection actually do? Does it get charged at different rates or is it purely stats collection?

@nav different rates, yeah. and sometimes at rush hour a carpool lane will be 2+ people only

@foone When I read the label on the battery, my first thought was was “let’s throw it in boiling water and see what happens”

@FurryBeta DO NOT

@foone Prepare to be underwhelmed

@foone Only one way to be certain...

@foone That is... I guess ok ? I bet whoever came up with it is proud of themself for coming up with that idea,