Magneto-acoustic tags

These tags basically behave like a high-Q, magnetically-coupled resonant circuit centered at a well-defined frequency, usually 58 kHz (but there exist 66 kHz systems as well).

In practice, the tags are of two kinds:

Magnetostrictive

These are generally disposable tags made of a strip of Metglas, a kind of amorphous steel that has a high magnetostriction coefficient, next to a strip of magnetizable steel. The metgals strip is dimensioned to exhibit mechanical resonance at 58 kHz. The EAS periodically sends quite intense bursts of about 20 ms at 58 kHz. These bursts excite the metglas strip which mechanically oscillates, modulating the magnetic field created by the adjacent magnetized steel. The decaying signal is detected by the EAS and triggers an alarm.

Ferrite coil

This is simply a ferrite-wound LC circuit tuned to 58 kHz. These are generally non-disposable clothing-store type tags. Magnetically, they behave like the magnetostrictive tags, but with a higher Q, giving greater detection range.

Simulating a magneto-acoustic tag

A magnetically coupled circuit with a sufficiently high Q tuned at the right frequency will trigger the EAS antennas. However building a high-Q RLC resonant circuit (with a Q of about 100) at 58 kHz requires a very good inductor with the right core.

Here is an active circuit which does not require any winding or finding the right core. I have tested it and it easily triggers EAS antennas. It just requires good 1 nF capacitors (I've tested with polystyrene capacitors. MKP wasn't good enough).

It is an active high-Q biquad filter resonant at 58kHz using MC33078 op-amps, connected to input/output coils and with 7805/7905 regulators. The resonant frequency is controlled by a 20-turn pot and must be tuned to the precise frequency. The protection diodes are not for fun. Voltages induced in a small coil next to an EAS antenna can run to 30 or 50 V off-resonance.

Jamming an acousto-magnetic EAS system

Since magneto-acoustic EAS systems work by listening to the faint, decaying signal of a tag, it should be easy to jam the system by sending even a moderately strong continuous wave at the center frequency. As 58 kHz is quite an easy frequency to work with, there is no doubt that many curious people and a number of thieves have built precisely such devices. I have later been told that such devices have actually been used for nefarious purposes.

Obligatory legal disclaimer

These circuits were built exclusively for pedagogical purposes. Besides, there are much easier ways to render magnetostrictive or magneto-harmonic tags inoperative and shoplifters already know them. Also, the wiring of the jammer is not visible, and I'm not giving the code for the microcontroller. These circuits are only here to show my interest in electronics and the possibility of manipulating some EAS systems. Also, any competent amateur can figure out a jammer circuit for himself. Sensormatic, Knogo, Esselte Meto, etc. are trademarks of whomever they are trademarks of, and so on. I am not responsible. I am innocent. Please don't sue me.

Magjam 2000

This quick Atmel AT90S1200-controlled circuit emits a continuous 58 kHz signal drowning the return signal of magnetostrictive tags. It is quite easy to build and is very effective. The tupperware box contains a CRT degaussing coil.

Please do not ask me for a schematic. Use of such devices is illegal. However, if you are in the EAS business, we can work out a contract.

Magjam 3000 versions A and B

It's not that the Atmel was overkill. The Magjam 2000 was an experimental device that had multiple jamming modes. When I figured out that the simplest mode worked best, I simply used a good old 555 to generate the carrier. As this was for some legal consulting work for someone in the EAS industry I had some PCBs made.

Pictures

Magjam 3000A externals. This one was so powerful, it actually fried some non-disposable tags. No, the antenna didn't fit in the box. Magjam 3000B "internals". A little bit less powerful than the A version. Notice how I always manage to get a perspective view that doesn't reveal much about the circuit. Trust me, any semi-competent electronician can design and build such a device.

Building a simple tag detector

Building a simple detector is relatively easy. The difficulties of a real acousto-magnetic EAS systems are mostly:

• Having good, reliable power electronics for a strong signal while staying with regulatory limits,

• Getting the best sensitivity by a good analog front-end and advanced digital signal processing techniques (such as coherent demodulation, pulse randomization,

• Preventing the strong excitation pulses from frying the delicate detection electronics,

• Synchronizing multiple antennas so that they don't jam each other. Many stores have multiple doors, thus multiple antennas.

To make a table-top tag detector, you therefore just need to:

• Regularly send a short 58 kHz burst with a small amplifier.

• Amplify the received signals, filter them with a passband filter, rectify them and compare them to a threshold.

Acoustofind 3000

An 58kHz square wave is generated by the ATmega8 microcontroller. A multiple feedback op-amp bandpass filter turns this into a sine wave. This signal is gated with an analog multiplexer and fed into an emitter-follower which drivers the TX coil (the big coil on the picture) via an impedance-matching capacitor. The resulting signal is sensed using a small coil, amplified, band-pass-filtered, rectified, low-pass filtered and then compared to a reference level.

Pictures

The breadboard prototype. The breadboard prototype with the RX/TX coils. The schematic. The soldered, encased version - external view. The internals. The output amplifier is on the small circuit at the bottom of the case. It even makes annoying beeps when it detects a tag.

Continued on the page about jammer detection