Reverse engineering a Imagotag retail 2.6 RED NFC - 1

In this blog post series I will describe my attempts in reverse engineering an electronic price tag to make a little ebook or a pager out of it..

Suggested Music:
Cory Henry - Billy Jean (cover)        Electro Deluxe - Home (album)

This project is intriguing me because of the many things I am learning and the endless possibilities that E-ink displays give.

Some abbreviations i will use:

EPD: Electronic Paper Display
PCB: Printed Circuit Board
MCU: Micro Controller Unit

Part 1

Introduction

Some time ago i went to a nearby store to find they have changed all the shelf labels with electronic ones.

On a closer inspection they are 2.6 inch, E-ink bicolor labels. 

Thanks to a friend of mine i managed to have a couple of them lying on my desk, and started taking them apart.

It seems that the 2.6" format is not a standard for the EPD industry, but I managed to find other datasheets referring to similar products, as Mikelectricstuff says, you have to know your enemy!

After prying open the plastic case, which is rugged and very well built, we are welcomed with two nicely packaged coin cells and a beautifully made PCB sandwiched back to back to the EPD, a Flat-Flex cable joining the two.

Having detached the two we can handle the PCB without breaking the cable.

At first I thought to read the communication protocol between the EPD and the LCD:
I was happily thinking about this simple way to overcome problems things, as soon as I could I swapped the PCB, aaand.. Nothing changed. To save battery the MCU does not refresh the EPD after a power cycle and the circuit is as cold as a stone.
This was a damn blocked path..  In addition to this I haven't got a digital scope, or better still a mixed signal one to measure the power circuitry in addition to the data lines.

So, back to basics, let's tear the display down!

Giving a closer look at the PCB, it's a really well built 4 layer SMD board, with a processor and memory, the RF section and the driving components for the EPD.

Front PCB, PHOTO

For me, the less interesting part is RF, which consists in an inverted-F antenna and some vodoo stuff. Maybe I am wrong, but I think there is a balun (and the datasheet seems to confirm that) between the MCU and the Antenna..

The MCU is a Texas Instrument CC2510 SoC

I was following traces all aroud the board, playing poky-poky with the test pads on the back when I noticed this, and my heart sunk a little..

Back PCB, SCAN. In detail the culprit vias and layer number

Who would put a 4-fuckin-layers PCB inside such a thing? Why would you do that to me?
Alright, alright.. 

Let's deconstruct the PCB step by step:


First of all I measured the main component values and noted them down, then with hot air I removed them all, in order to have a better surface to scan (I want to avoid photos to have things better aligned)

After taking front and back images, I sanded away the solder mask and dipped my circuit in acid to effortlessly remove the outer copper layers, (Note to self: always diluite acids before etching PCBs..)

..And after another awful lot of sanding, i was able to see the majesty of the inner layers, but only if the circuit was wet because of the sandpaper roughness...

Long story short I had to scan them placing some droplets of water on the glass scan bed, and the result was as pefect as my mother was upset for wetting her scanner shouting "Science!!"


Notice the water at the edges:

Vdd layer, with a slot separating EPD from MCU and two(!) hidden traces

Gnd layer, notice all the eyelets around the non-GND vias.

After a little bit of image juggling in photoshop I had all the images alligned and components drawn on a separate layer, this is a sample of the result, with only top and bottom layers visible, but still impressive:

On the next episode: the decoded circuit!

See ya!

Epongenoir