CLI-8 Cartridges, How does the chip really monitor ink?

[Grandad35]

I don't know what "PM" means and I have no use for your Cyan cart but I will be happy to send you a Cyan, Magenta, and Pigment Black cartridge at no charge.

PM (Private Message) sent.

 

[canonfodder]

Grandad35, Don't blow that "Fusible Link". That is the LED which makes a bright red light up the front of the cartridge when the head is parked out front. The LED is on steady for a cartridge with ink and in the correct place. It blinks when the cartridge is empty.

Pins 2, 3, and 4 have to be the data pins. See the edited photos for other things which I labeled.

The "resistor" limits the current for the LED. The LED drops about 1.4 or 1.5 Volts. I fed it 1mA and was rewarded with a tiny light out the left (top in use) edge of the die. If the operating current were to be around 10 mA, the voltage fed to the resistor would be 3.1 Volts. So maybe the supply is at 3.3 Volts, and the switch in the chip that turns on the LED drops a bit. I say the switch in the chip, because there is no direct connection from any of the connection pads to the resistor input. The switch pulls pin 5 down to ground to light the LED.

Where your component side has "gT5" in the metal, mine, (a BK) has eL5.
Where your chip has "613" and "R045" printed on it, mine has 611 and R018.

 

[ghwellsjr]

This will be fairly easy to test by anyone who has one of these printers and an empty cartridge of some color and a half full cartridge of the same color. Simply swap your half full cartridge with the empty one, see that the printer detects it as empty, then swap them again, and see if the printer detects it as full instead of half full. The worst that can happen is that the printer is a lot smarter than I'm hoping and it blows the fuse on your half full cartridge.

I don't have one of these printers but I do have several empty cartridges. I think I will visit one of these printers in a store and try this little experiment myself.

I'll let you know what happens.

It didn't work.

 

[Grandad35]

It didn't work.

Does this mean that the half full cart still displayed half full?

The LED is on steady for a cartridge with ink and in the correct place. It blinks when the cartridge is empty.

I didn't realize that the LED was on full when the cart is full. That obviously blows my fuse theory (no pun intended).

How did you manage to measure the resistance and capacitance of those two components? I am impressed.

Ghwellsjr is sending me several empty carts and chips. I will pop off the components so that we can see the etch under the IC.

Your theory makes a lot more sense than mine and answers several questions. A bypass cap between Vcc and Gnd is a typical practice. The resistor in series with an LED is also standard practice.

Is it safe to assume that the "613" and "611" are date codes ('06, 13th week and '06, 11th week) and that the RO45 and RO18 are Canon's proprietary numbers, perhaps for different ink colors?

My own view is that something like this may happen. The chip is possibility a microcontroller such as the PIC series here. http://ww1.microchip.com/downloads/en/DeviceDoc/41239C.pdf
These have an internal clock and can take data in or out on a single pin if necessary.

It appears that both you and Canonfodder are thinking along the same lines. Even if this is a microcontroller with internal memory that can communicate both ways and truly lock out compatible carts and refilling without voiding the warranty, it has been a lot of fun trying to figure out the technology in an open forum.

 

[canonfodder]

Grandad said "I didn't realize that the LED was on full when the cart is full."

Just a clarification of what I reported. The LED is on full or steady when there is ink in the cartridge. It doesn't have to be full of ink. Now that I am running refilled but with the printer reporting that the ink is too low, the LED always blinks when parked out front. These are high intensity LEDs. They REALLY light up the front of the cartridge.

I measured with a slightly better than ordinary multimeter and fine pointed tungsten probes. The IC with power off did not "get in the way" of the measurements.

I think that under the IC you will only find a top-side ground conductor passing under the IC to get to pin 6. I could be wrong, because some tiny surface mount packages have a central pad used to better extract heat from the die.

You are correct about the date codes. You may learn if the other number relate to color with more chips to pop. I don't think the IC is predestined to the particular color unless the foundry is pre-programming some memory of the die back at wafer level. The other markings could be lot numbers.

AN ORIGINAL QUESTION OF MINE HAS NOT BEEN ANSWERED.

I probably should go answer it myself. After all, I own the iP4200. The question is:

If I have refilled, and done the reset to "continue printing", and I let an ink tank go empty, does the printer stop me with an "empty" detected by the sensor that looks at the prism?

The printer does have the sensor setup and the cartridges do have the prism. That we know.

 

[ghwellsjr]

It didn't work.

Does this mean that the half full cart still displayed half full?

Yes, that is what it means.

Here's what I did. I found a printer with a display that showed the ink levels and also had a cartridge that displayed half full and was actually half full. I exchanged that cartridge with one of my empties of the same color. The LED on the empty cartridge blinked and the display showed it empty. I put back in the half full cartridge. The LED came on steady and the display showed it half full. So much for my idea. Like I tell the guys at work, "My best ideas are the ones that haven't been tried out yet."

Then it occurred to me that I could do canonfodder's test. I swapped the half empty cartridge with one from another printer that was full. The displays on both printers accurately reported the conditions of both cartridges. So it looks like the cartridges themselves store the information about their own ink levels.

 

[pebe]

Cannonfodders pin identification seems the more logical one. I can see from that how the LED is powered and the chip clocked. But I am not sure on a couple of points.
1. Why is the resistor connected to the middle soldered pin under the LED?
There cannot be a fuse between the bottom (A) and middle pins, because it would short Vcc to ground.
2. If there is a fuse, where is it? If the chip has no data input, how does it know its empty when it is put in another printer?

If the chip is a micro, one of the DO/CLK pins may be a DI, and CS may be a programming pin.

 

[mikling]

http://people.cs.uchicago.edu/~dinoj/smartcard/security.html#communication
is interesting note the conclusion:
"Most attacks today are classified as class 3 attacks, which means that either the costs associated to break the system are far more than the cost of the system itself, or that the cracker has to spend several or hundred years of computing power to break into a single transaction. Technology is developing faster than cracker methods. Therefore, each new generation of technology usually prevents attacks that the previous generation was vulnerable to."

Also I note that HP has patented a method of updating the ROM of the printer via insertion of a replacement cartridge. Thus any time an attack or hack is made and it is serious enough, they can change the ROM on the printer so that the hack is rendered useless should a new cartridge be introduced later onto the printer. This updating process wiould also propagate itself through the remanufacturing chain rendering the population of printers using the remans unable to use the reman.
These guys have thought this thing out.

 

[Grandad35]

cannonfodders pin identification seems the more logical one. I can see from that how the LED is powered and the chip clocked. But I am not sure on a couple of points.
1. Why is the resistor connected to the middle soldered pin under the LED?
There cannot be a fuse between the bottom (A) and middle pins, because it would short Vcc to ground.
2. If there is a fuse, where is it? If the chip has no data input, how does it know its empty when it is put in another printer?

If the chip is a micro, one of the DO/CLK pins may be a DI, and CS may be a programming pin.

I agree that canonfodder's explanation is the more logical one.
1. As canonfodder explained, the middle pin is an output from the controller so that it can directly control the LED.
2. In this scenario there is no fuse - the controller has some non-volatile memory and it stores the ink level in that memory. When the cart is declared to be empty, that fact is stored in the memory.
3. I don't understand how this works, but these chips can apparently have a single pin for both input and output.

I'm going to still encourage to continue but in the back of my mind I know that possibly thousands of companies within China and some with sophisticated equipment would have tried already to no avail.

I agree - it's looking more and more like they have a very robust system. I was hoping that the reported information about partially empty carts returning to a full status when plugged into another printer were true and that this signaled a weak link in their system. Unfortunately, the detailed tests by ghwellsjr have shown that these weak links don't exist and have driven a stake through the heart of my conjectures. At least those in this forum now have a much better understanding of how this system works. When I get the empty carts, I will still post a photo of the etch with the components removed so that we can see the last observable details of the hardware.

 

[canonfodder]

Pebe,

1. The resistor is not connected to the LED at the middle, though it may look that way. The run from the resistor is just passing under the LED, going out to where there once was a test pad. The two dimensional view doesn't let you see what is really there. I could peek under and around.

2. We now don't believe there is a fuse. The chip does have opportunity for data input and output. A microcontroller, which we now have evidence to indicate this IC is, can be built with as little as 3 pins. This can be done because schemes have been designed which enable you to send commands and data in, and receive data out on the same pin, sequentially, not simultaneously. More pins available makes operating the IC simpler. Having a separate clock pin is really helpful, so one of the six might be for that.

The tests done so bravely by Ghwellsjr have proven that the chip does have memory of its apparent ink level.

Flash memory is commonly included in microcontrollers and that provides the non-volatile memory needed to hold information when the cartridge is unplugged.

I'm talking like I know the microcontroller, but in reality that is not true. I just know some basic details from what I have read.

WE WOULD NOT NEED A DUPLICATE IC AND A DUPLICATE PROGRAMMING TO BE HAPPY !

All we really need is the ability to tell the chip that the cartridge is full again. Please, someone, just do it!

(Please excuse the shouting. I just want to be sure some things are seen.)

Look! Grandad and I were typing at the same time! Sorry for the redundancy my post creates.