Electronic article surveillance

Electronic article surveillance systems work by sending electromagnetic signals using coils and analyzing the response of the environment. Tags have specific behaviours that can be discriminated from most objects. A good introductory article on EAS is available on Wikipedia.

/resources/eas/wg-demodulated.png.thumb.png

Spectrogram of signal from a 58 kHz system (WG Electronics), sampled using a soundcard after downmixing with a 64 kHz signal. The horizontal lines are unrejected images of the carrier frequency. The vertical bands are the actual excitation pulses sent by the antennae.

Magneto-acoustic tags

These tags basically behave like a high-Q, magnetically-coupled resonant circuit centered at a well-defined frequency, usually 58 kHz (but there exist 66 kHz systems as well).

In practice, the tags are of two kinds:

Magnetostrictive

These are generally disposable tags made of a strip of Metglas, a kind of amorphous steel that has a high magnetostriction coefficient, next to a strip of magnetizable steel. The metgals strip is dimensioned to exhibit mechanical resonance at 58 kHz. The EAS periodically sends quite intense bursts of about 20 ms at 58 kHz. These bursts excite the metglas strip which mechanically oscillates, modulating the magnetic field created by the adjacent magnetized steel. The decaying signal is detected by the EAS and triggers an alarm.

Ferrite coil

This is simply a ferrite-wound LC circuit tuned to 58 kHz. These are generally non-disposable clothing-store type tags. Magnetically, they behave like the magnetostrictive tags, but with a higher Q, giving greater detection range.

Simulating a magneto-acoustic tag

A magnetically coupled circuit with a sufficiently high Q tuned at the right frequency will trigger the EAS antennas. However building a high-Q RLC resonant circuit (with a Q of about 100) at 58 kHz requires a very good inductor with the right core.

Here is an active circuit which does not require any winding or finding the right core. I have tested it and it easily triggers EAS antennas. It just requires good 1 nF capacitors (I've tested with polystyrene capacitors. MKP wasn't good enough).

/resources/eas/sensormatrip-1.jpeg.thumb.png

Sensormatrip 1 breadboard prototype, concealed in an ABS case.

It is an active high-Q biquad filter resonant at 58kHz using MC33078 op-amps, connected to input/output coils and with 7805/7905 regulators. The resonant frequency is controlled by a 20-turn pot and must be tuned to the precise frequency. The protection diodes are not for fun. Voltages induced in a small coil next to an EAS antenna can run to 30 or 50 V off-resonance.

Jamming an acousto-magnetic EAS system

Since magneto-acoustic EAS systems work by listening to the faint, decaying signal of a tag, it should be easy to jam the system by sending even a moderately strong continuous wave at the center frequency. As 58 kHz is quite an easy frequency to work with, there is no doubt that many curious people and a number of thieves have built precisely such devices. I have later been told that such devices have actually been used for nefarious purposes.

Obligatory legal disclaimer

These circuits were built exclusively for pedagogical purposes. Besides, there are much easier ways to render magnetostrictive or magneto-harmonic tags inoperative and shoplifters already know them. Also, the wiring of the jammer is not visible, and I'm not giving the code for the microcontroller. These circuits are only here to show my interest in electronics and the possibility of manipulating some EAS systems. Also, any competent amateur can figure out a jammer circuit for himself. Sensormatic, Knogo, Esselte Meto, etc. are trademarks of whomever they are trademarks of, and so on. I am not responsible. I am innocent. Please don't sue me.

Magjam 2000

/resources/eas/magjam2000-1.jpeg.thumb.png

Magjam 2000 in a soap box with a degaussing coil, general view.

/resources/eas/magjam2000-4.jpeg.thumb.png

Magjam 2000 internals.

This quick Atmel AT90S1200-controlled circuit emits a continuous 58 kHz signal drowning the return signal of magnetostrictive tags. It is quite easy to build and is very effective. The tupperware box contains a CRT degaussing coil.

Please do not ask me for a schematic. Use of such devices is illegal. However, if you are in the EAS business, we can work out a contract.

Magjam 3000 versions A and B

It's not that the Atmel was overkill. The Magjam 2000 was an experimental device that had multiple jamming modes. When I figured out that the simplest mode worked best, I simply used a good old 555 to generate the carrier. As this was for some legal consulting work for someone in the EAS industry I had some PCBs made.

Pictures

/resources/eas/magjam3000-1.jpeg.thumb.png Magjam 3000A externals. This one was so powerful, it actually fried some non-disposable tags. No, the antenna didn't fit in the box. /resources/eas/magjam3000-2.jpeg.thumb.png Magjam 3000B "internals". A little bit less powerful than the A version. Notice how I always manage to get a perspective view that doesn't reveal much about the circuit. Trust me, any semi-competent electronician can design and build such a device.

Building a simple tag detector

Building a simple detector is relatively easy. The difficulties of a real acousto-magnetic EAS systems are mostly:

To make a table-top tag detector, you therefore just need to:

Acoustofind 3000

An 58kHz square wave is generated by the ATmega8 microcontroller. A multiple feedback op-amp bandpass filter turns this into a sine wave. This signal is gated with an analog multiplexer and fed into an emitter-follower which drivers the TX coil (the big coil on the picture) via an impedance-matching capacitor. The resulting signal is sensed using a small coil, amplified, band-pass-filtered, rectified, low-pass filtered and then compared to a reference level.

Pictures

/resources/eas/acoustofind-1.jpeg.thumb.png The breadboard prototype. /resources/eas/acoustofind-2.jpeg.thumb.png The breadboard prototype with the RX/TX coils. /resources/eas/acoustofind-circuit-v1.png.thumb.png The schematic. /resources/eas/acoustofind3000-b-external.jpeg.thumb.png The soldered, encased version - external view. /resources/eas/acoustofind3000-b-internal.jpeg.thumb.png The internals. The output amplifier is on the small circuit at the bottom of the case. It even makes annoying beeps when it detects a tag.

Continued on the page about jammer detection

2009-02-08