Inkjet Printer Forum / Ink Jet Refill Forum

ghwellsjr wrote:

So this suggests some other tests that could be performed on just a single printer but they take a much longer time. Assuming that one of the new printers has an ink level display, when a cartridge gets down to half empty, replace it with a new one that is full. If the printer detects that it is full, then we know that the cartridge is keeping track of its own ink level.

Not necessarily so.  I wrote before:

"If the printer takes in the serial number, it can then total up the quantity of ink jets commanded for that chip/cartridge, keeping track of the information within the printer.  This could mean that the chip does not have to be able to store this information." The serial number I refer to is one unique to the chip/cartridge.

Should the function be one where the printer takes in the serial number, a "new" cartridge can be just one that the printer has not seen before.  If you are testing with a single printer, a new cartridge can be "new" and "full" to the printer because it has not seen it before, or "full" because the cartridge chip can actually report it full. So we can't tell which condition exists.

This thread also relies on some information in this thread (http://www.nifty-stuff.com/forum/viewtopic.php?id=1225).  There seems to be a renewed interest in this subject, so here are a few more ideas to consider.

FNO Warning (For Nerds Only).  I apologize in advance for the length of htis post.
Even though I don't have a printer that uses Canon's chipped cartridges, it presents an interesting challenge.  There is nothing like being told that something is impossible to make an engineer try to figure out a way around the problem.

This morning, I purchased a CLI-8 cart (cyan) and removed the chip to see what it looked like.  The "chip" is a two layer printed circuit board about 8 mm square by about 0.5 mm thick.  This also gave me a chance to practice some macro photography, and here are the results - the notes on these photos will be discussed below.  Note that the photo of the side with the 4 gold contacts is "flipped", so that it lines up with what is on the component side.  The 5 gold holes are "vias" that connect the etch on the two sides of the printed circuit board - note that the 5 holes line up



The top photo shows the contact side that connects to the print head - clearly there are only 4 contacts.  I am, of course, assuming that all of the carts have the same number of contacts.  Could someone with one of these printers please confirm or deny this?

The bottom photo is far more interesting.  I started by emailing it to someone who is familiar with current surface mount technology to get their opinion on what these components could be.  I'm sure that there are others who are far more knowledgeable than I or he on this subject, so I encourage anyone who has either confirming or contradictory information to chime in.  I think that I have already proven that I am not afraid to make wild conjectures in the hope of learning something, so don't be afraid of telling me that I am full of it - the important thing is that we advance our knowledge.  Here is my list of SWAGs (Scientific Wild A**ed Guesses):
1. The color of the 2 lead component looks like it might be a capacitor.  Note that Canon buys parts in such large quantities that they could obviously have parts specially colored if it suited their needs, but I'm relying on them using commercial components to save time and money.
2. The black device (above the "Resistor" note) is assumed to be a resistor. I should probably check its resistance, but it's only about 40 mils long (1 mm), and it takes a steadier hand and far finer points on the leads of an ohmmeter than I have to make this measurement.  There is an additional reason for assuming that this is a resistor - see below.
3. The "Fusible link" has a very fine gold wire that is visible under high magnification, but which is less obvious in the photo.  This device is the same size as fuses listed at (http://www.littelfuse.com/data/en/Produ … tFuses.pdf), and apparently confirms my previous conjecture about this design using a fusible link.  Can someone who has a cart that registers "empty" pop the chip and look at this fuse under high magnification?  The gold wire should be missing, like a blown fuse.
4. The IC appears to be a "6 Lead SOT-23" package with a size of 63 x 155 x 40 mils (width x length x thickness) (http://www.national.com/packaging/folders/mf06a.html)
5. This is pure conjecture, but the IC could be a serial eeprom (Electrically Erasable Programmable Read Only Memory).  This link shows such a device and its pin out in this package on page 2 (http://ww1.microchip.com/downloads/en/D … 21749F.pdf).
6. Using the preceding SWAGs, the appropriate signals were labeled on the IC and the gold contacts.  Note that there are 6 traces that lead to dead ends at the edges of the PC board.  It is another conjecture that these signals go to "testing pads" that allow the assembled device to be tested, but that these pads are then trimmed off after the assembly passes its Q/C check.  These signals include: VCC, Ground, DO, Clock, CS, and the top end of the fuse.  DI is apparently not tested (nor would it need to be, as the chip won't be programmed in place).  Read below for a description of these signals.
7. Ground (GND - Pin 2) is connected to the two large areas of etch on the component side - it is a common practice to do this because it creates a "ground plane" to reduce electrical noise. One end of the capacitor would be connected to ground (the usual practice).  It could not be verified that pin 2 of the IC was connected to ground because I would have had to destroy the IC to look under it.  However, the circuit with the fuse and the resistor in series makes the most sense if the bottom end of the resistor was also connected to ground.
8. VCC (pin 6) goes directly to a contact, as would be expected.
9. The Data Out (DO) signal goes directly to a contact, as would be expected.
10. The Data In (DI) signal doesn't appear to be connected, but I would have to destroy the IC to verify this.  If it isn't connected, the memory can't be changed in the printer, and this becomes a "Read Only" device.  This conjecture is supported by the presence of the fuse - why would anyone add the complexity and cost of a fuse to record "cart empty" when they could just write some information to the chip and eliminate the fuse?  Why wouldn't Canon just add a 5th contact to reprogram the memory?  This is getting into conjecture based on conjecture, but it would allow them to claim that their device "could" be refilled by replacing the fuse.  It could also be that this isn't really an eeprom at all, but a rom (Read Only Memory) that doesn't need a Data Input pin.
11. The CLK (Clock) pin signals the device when to transfer another bit of information.  This signal has a capacitor to ground and also a resistor to ground when the fuse isn’t blown.  Depending on how this signal is generated by the printer, the frequency of the clock could be changed when the fuse was blown - data would still be sent, but at a slower/faster rate.  This frequency could be sensed to let the printer know when the fuse was blown.  It isn't at all clear how the fuse can be blown by the printer, since the "Clock/Blow Link" input would have to be pulsed with a high voltage to blow the link.  The IC's input are only rated to withstand 1 volt below ground to 1 volt above VCC, but it is also rated to withstand 4,000 volts of an electrostatic discharge.  This needs someone with far more knowledge that I to explain.  If this is a custom IC, it wouldn't be a big problem to protect this input against a high voltage.
12. The CS (Chip Select) doesn't appear to be connected.  The timing charts don't show and read cycles that don't use this signal, but there may be some special read sequence that is triggered when power is first applied to the chip.  Even though there is no connection to the printer, this signal is connected to a test pad - go figure.

If your eyes aren't glazed over yet, here are a few more SWAGs about how this system could operate:
1. These chips are programmed (if they are eeproms) or fabricated (if they are roms) with a bit string that encodes the color of the cart and a unique serial number.
2. The printer can easily read each chip when the power is turned on, when a cart is changed, etc.  This allows it to make sure that there is a cartridge of the correct color in each slot before printing.
3. As I explained in a previous post some older HP printers kept track of the ink usage by remembering the serial numbers of the last 2 carts installed in each slot, as well as the ink usage from each cart.  With the availability of almost unlimited memory, each printer has the capability of remembering almost an unlimited number of serial numbers and the last known ink level for each serial number.
4. When a cart goes "empty", the printer blows the fuse to permanently mark the cart as either empty or refilled.  Nags screens, etc. follow.
5. Even if the prism doesn't sense an empty cart (say, by covering the prism with black tape) a count of the ink drops will be used to trigger the "empty" signal and to blow the fuse.
6. When a non-empty cart is sensed with an unknown serial number and an intact fuse, it is assumed to be a new cart.  If the fuse is blown, that serial number would also be flagged as empty by the printer.

It's time to think about yet another set of SWAGs - that Canon has been bluffing about the encoding and patents.  Has anyone actually seen a Canon patent on this technology?  If this system works as conjectured, there is nothing so novel about this system that they should be able to get a patent on it.  Even if they did get a patent, the patent disclosure has to indicate how it works.  I have read about "better encryption than nuclear missiles", but I don't see it.   Even if they encrypt their data stream, all someone has to do is to read the data from several hundred carts to be able to sell several hundred unique chip sets to each user (since the printers don't talk to each other, each printer can see the same number and still think that it is unique).  It is also possible that some form of date code may also be encoded into the data (like HP does), so everyone may get a surprise about outdated carts in a few years.

As far as the fuses are concerned, what would happen if they were replaced by a jumper?  Do the printers check that the fuse is blown after they blow it?  What do they do if it doesn't blow?  It would be interesting to take an "empty" cart with a blown fuse, jumper it, refill the cart and try it in another printer.  It should work, but what happens when it is time to blow the fuse in the second printer?  I would only try this in a printer that I could afford to throw away if it burned something out until it was proven that it didn't cause any problems.  If this worked, these "jumped" carts could be refilled by a large retailer and sold to other users on the basis that it would be unlikely that a user would get the same cart (serial number) back.  Note that these carts would only have to be "jumped" once, so they could be marked as such.  This could be a good business opportunity for someone.

As I have already stated, I don't have a dog in this hunt, so it is up to others to continue this work.  Those who have potential business opportunities in this area have the resources and motivation to continue the investigation.  I'm sure that the right person can open the IC and identify the technology involved.

I now have a perfectly good chip for a Cyan cart (actually, I have a complete Cyan CLI-8 cart), and I would be willing to trade the cart and chip for a few empty CLI-8 carts of different colors just to make sure that all of the chips have the same design and so that I can verify the pin connections under the IC.  The first one to PM me can make the trade.

It's late and I'm tired (I'm sure that it shows in the writing).  Please ignore the typos and spelling errors, as I'm too tired to give it a good proof read.  Let me know what you think.

canonfodder wrote:

ghwellsjr wrote:

So this suggests some other tests that could be performed on just a single printer but they take a much longer time. Assuming that one of the new printers has an ink level display, when a cartridge gets down to half empty, replace it with a new one that is full. If the printer detects that it is full, then we know that the cartridge is keeping track of its own ink level.

Not necessarily so.  I wrote before:

"If the printer takes in the serial number, it can then total up the quantity of ink jets commanded for that chip/cartridge, keeping track of the information within the printer.  This could mean that the chip does not have to be able to store this information." The serial number I refer to is one unique to the chip/cartridge.

Should the function be one where the printer takes in the serial number, a "new" cartridge can be just one that the printer has not seen before.  If you are testing with a single printer, a new cartridge can be "new" and "full" to the printer because it has not seen it before, or "full" because the cartridge chip can actually report it full. So we can't tell which condition exists.

I thought this issue was dealt with on this link where someone actually swapped cartridges from different printers:

http://www.nifty-stuff.com/forum/viewto … 8719#p8719

Has it been determined without any doubt that "The ink level appears to be related to the specific, individual, cartridge."? I was trying to offer another way to resolve that issue, not the issue of whether the printer or the cartridge or some combination associates the ink level with a specific cartridge.

It seems to me that Canon would not go to the extra work of keeping track of cartridges swapped before they are empty. They already have a mechanism in place for BCI-6 carts to determine ink level. Assuming a full cart, they count ink drops, report when the cart should be about half full and wait for the light detector to determine that the cartridge is empty. With the new chipped carts, when this happens, they blow the fuse. But as a backup, they continue to count drops until they know the cart should be empty and blow the fuse even if the light detector does not sense an empty cart.

Most users will not remove and reinsert a cartridge or swap a partially used cartridge with another one, either with more or less ink in it, until it is empty. As long as Canon never blows the fuse on a cartridge that still has ink in it, they will not get a legitimate complaint from a customer.

Now suppose the normal is happening. A cartridge runs dry and the printer blows the fuse. The user replaces it with another OEM cartridge that has an intact fuse and enough ink to cover the prism. Will the printer respond like the older printers and simply reset the ink level counter? I'm assuming this counter is in the printer and the cartridges do not have unique identities.

If this is the case, then a way to get around the problem caused by the chipped cartridges is to let your first set run dry and blow their fuses. Put in new OEM cartridges. The next time one of them reaches half empty, replace it with an empty cartridge with a blown fuse. Refill the half empty cartridge and put it back into the printer. Now the printer should report it as a full cartridge.

This will be fairly easy to test by anyone who has one of these printers and an empty cartridge of some color and a half full cartridge of the same color. Simply swap your half full cartridge with the empty one, see that the printer detects it as empty, then swap them again, and see if the printer detects it as full instead of half full. The worst that can happen is that the printer is a lot smarter than I'm hoping and it blows the fuse on your half full cartridge.

I don't have one of these printers but I do have several empty cartridges. I think I will visit one of these printers in a store and try this little experiment myself.

I'll let you know what happens.

Once again grandad is to be congratulated on providing a very comprehensive write-up. I have been forming my own views on this subject for some time but without a specimen to go on, they have been pure conjecture. What you have proposed makes very good sense, but there are a couple of things I cannot understand.

1.    The device must be interactive because it must output data in response to an enquiry, yet no data input is shown connected.
2.    The capacitor on the CLK would slow down the rise and fall times of the clock. This is undesirable because it would allow noise at the transition times to interfere with the clock operation.
3.    The link to the data on fusible links shows the lowest rated at .125A and blowing in 5 seconds at 200% current. Its resistance is given as 4 ohms so it would require 8v at 250mA to blow it. I don’t know if it would be feasible to blow it without popping the chip. However, its low resistance would put a short circuit on the clock line and prevent operation.
4.    Is it possible that the ground plane connects to DI?, with DI and GND being reversed? That would put the link in series with the DI pin. I cannot see what purpose would be served by the resistor. One end appears to be connected to nothing – although it’s difficult to see under the opaque white stuff.
5.    If the connections are as you have shown, then is is possible that each chip is interrogated by switching on its supply at Vcc. It would then output its identity at DO. But how the fuse works or gets blown is a bit of a mystery.

The question remains, though, how does the chip store info about ink usage if it cannot be written to?

My own view is that something like this may happen. The chip is possibility a microcontroller such as the PIC series here. http://ww1.microchip.com/downloads/en/D … 41239C.pdf
These have an internal clock and can take data in or out on a single pin if necessary.

The printer’s main micro would write that usage data to the chip after every print session. It is possible that when new the chip has 255 in one of its registers and this gets decremented every time a certain volume of ink is used. When it gets to zero the end is signalled.

The main micro would address each chip in turn by sending a string of bits. The chip would check that certain bits in the string matched what it had in memory, and if so would reply with its own string and the main micro would check for a match. The string would indicate the colour.

The main micro could send thousands of different strings to encrypt the message – only a few correctly placed bits would matter. When the chip had sent its message it would then go into sleep mode for 2minutes. That would prevent someone going quickly through all the possible addresses when trying to crack then code.  When the usage register had got to zero the chip would send no data.

Just my thoughts.