Original document created February 8, 2000
Version 1.0 written by Nolan Blender
Shopping cart theft has become a problem in many urban areas. These carts, which are provided by the store for shoppers, are often stolen and abandoned far away from the store location. The store must replace the carts that are lost forever, and hire people to recover some stolen carts. The abandoned carts are an eyesore and a problem for neighborhoods where the carts are left too. This problem can be greatly reduced by using the patented CAPS (Cart Anti-theft Protection System).
Carttronics LLC has designed and produced a system which greatly reduces shopping cart theft. One of the front wheels of the cart is replaced by a special wheel assembly which releases a boot which covers the wheel and makes the cart very difficult to move. A special signal must be sent to the wheel assembly in order to release the lock. The operation of this system is the subject of this essay.
The website at Carttronics LLC. was examined first. From the documentation that they provide, it's clear that it's an active (i.e. powered) system and doesn't rely on magnets to be activated. The wheels are powered by a 9 volt battery. There is a buried wire around the perimeter of the site which emits a signal which causes the cart to lock up. The signal is specified as a low frequency system. This is a good starting point for our analysis.
The next step was to try and figure out what the signal was like. A pickup coil was attached to a small audio amplifiler and the perimeter of the site was explored. A high pitched, pulsed signal was detected strongly in areas where the expected cart limit was, and where physical evidence of the buried wire (a small cut in the pavement) was found. It was a reasonable hypothesis that this was the signal that triggered the wheels to lock up. Some further analysis was done with electric field measuring equipment, and it was determined that it was primarily a magnetic signal rather than an electric field signal which was used. This makes sense, since the wire is buried underground.
A first attempt at an emulator for the signal was built, which simply generated a high pitched intermittent signal. This signal failed to trigger the wheel lock on the carts, so they were a bit picky about the signal that they required. Some more research was required.
The digital storage scope and the pickup coil were then loaded into the car, and then taken to the store parking lot. The signal was analysed, and it was determined that an 8 khz signal was being sent, with a 50 percent duty cycle, and a cycle time of 30 ms. A circuit that generated this signal was built, and it was determined that the shopping cart wheel would be triggered to lock when this signal was sent to the wheel.
For complete analysis, a wheel was acquired. A weakness in the design of the wheel is that the cover will sometimes fail to come down if the boot assembly is jammed with ice and road mud, which is a possible occurrence when the cart is pushed into the parking lot area. One of my opportunistic friends acquired a wheel from a shopping cart which was left in the parking lot. Now I had a chance to closely examine the wheel assembly.
The assembly is held together by security torx screws, which require a special screwdriver head to remove. There is a small pin in the center of the screw which prevents the regular torx driver from being inserted. The wheel was disassembled, and examined in detail.
The circuit is powered by a single Duracell 9 volt battery. There is a motor which drives a reduction gear train, which operates the boot lock mechanism. A switch on the board is activated by the locking cam so that the system knows what the position is of the locking cam. The board is single sided SMT and contains some active ciruitry as well as a 12C508 Microchip controller. The chip was removed from the board, and an attempt was made to extract the code from the device, but the security bit had been set and I was unable to read the code from the device. An attempt was made with the Data I/O programmer but no additional information was gained. An alternate approach was then attempted.
To determine the unlocking signal, a pickup coil and a tape recorder were set up. Analysis of the circuit on the wheel PCB suggested that the unlocking signal would be a variation of the locking signal, perhaps with a different frequency or duty cycle. A wheel at the supermarket was locked, and when the wheel was unlocked by a supermarket employee, the unlocking signal was recorded.
The signal was extremely noisy due to the amount of equipment close by, the signal from the perimeter wire, and the distance from the unlocking transmitter. The signal was fed into Cool Edit 2000, and the relevant section of signal analysed. It was determined that the unlocking signal was (is) a continuous 8 khz signal.
When the wheel is powered up, the circuit behaves as though it is in the "locked" state. After the wheel receives the continuous 8 khz signal, the cam is rotated until it is in the "unlocked" state. If the microswitch is not activated, the circuit will try a few more times, then quit. A similar behavior is exhibited when the pulsed 8 khz signal is sent to the wheel, except that it tries to leave the cam in the "locked" state.
The transmitter consisted of two 555 astable timer circuits. One timer is calibrated to produce a signal with a 50% duty cycle and a period of 30 ms. The other timer is calibrated to generate an 8 khz signal. Gating of the second oscillator is selectable. The output from the 8 khz oscillator is fed into an audio amplifier, which drives an antenna which consists of 200 turns of wire on a ferrite core.
Testing of the system suggests that this is a reasonably reliable way of keeping shopping carts under control. The system can be defeated, however it is unlikely that the kind of person that steals shopping carts would be inclined to develop an unlocking transmitter.
Nolan Blender, February 8, 2000