Introduction: EMP Shopping Cart Locker

By
About: The measure of a man is the size of his inductor.

Ever noticed a painted yellow line in the parking lot around many supermarkets and retail stores? The magic yellow line emits a signal that causes carts to stop dead in their tracks, preventing carts from leaving the parking lot.

Now you can build your own portable yellow line-- with up to a 20 foot range. Need I say more? Hint: it works inside the store.

Disclaimer: This is not an easy project. It will require knowledge of circuits, soldering, social engineering, and a tiny bit of PIC microcontroller stuff. High power is involved, and if you mess up, you might get burned, caught on fire, or arrested-- most likely all three. Always use an appropriate amperage fuse to prevent a short from becoming a much bigger problem. This project is also fairly expensive. The parts will cost about 65 bucks. Batteries with some kick will run 20-30 bucks, and a single PCB is about 60 bucks. They get a lot cheaper if you buy multiples for your friends.

We would be thrilled to sell kits, and it would certainly make the components cheaper and easier to get, but frankly, we're a little worried about the possibility of civil action. We likewise recommend that no one else sells kits commercially.

In order to remain as anonymous as possible, we have utilized Tor. Tor is a network anonymizer which sends packets through a convoluted network to its destination in order to avoid tracing. We aren't lawyers, and who knows what lawyers are capable of these days, especially with things like the DMCA and recent controversy over data retention requirements likely to be instituted in the EU.

With the warnings out of the way... In the wise words of Norm Abram, "Be sure to read, understand, and follow all the safety rules that come with your power tools. Knowing how to use your power tools properly will greatly reduce the risk of personal injury. And remember this: there is no more important safety rule than to wear these-- safety glasses. Let's get started on today's project."

Step 1: Background

The two major shopping cart theft prevention systems are called CAPS and the GS2. From our escapades, we have found the GS2 system is far more effective at actually stopping carts on smooth ground. It also has a longer range (!) and a more sophisticated locking and unlocking signal. Best of all, it can be reset remotely, meaning double the fun as you play "red light/green light" with unsuspecting customers.

The picture below is of the GS2 wheel, found only at your finer supermarkets.

Step 2: Find a Suitable Store

Look for a store with shopping carts with one funny wheel. It's usually the front left wheel of the cart. There will also be a metal bail on the rear left wheel to prevent the cart from tilting backwards. It doesn't actually work, but that doesn't matter-- it just makes cart locking even more fun. A yellow line painted around the parking lot is usually a good clue as well.

CAPS systems will make a satisfying "thwack" when the boot hits the ground, but on smooth ground, people tend to just keep pushing. There is nothing more you can do after that, because the boot has to be reset manually by an employee with a magic wand. Here are the stores that use the CAPS system.

Look for a GS2 setup for more fun. These systems have a longer range, are more effective at stopping the cart, and can be reset remotely (by you). Build two systems, and you can cause all sorts of trouble.

Step 3: Determining the Locking Signal (informational, You Can Skip This Step)

There will be a wire buried around the parking lot of the store. A controller somewhere in the store sends a changing current down the wire. A changing magnetic field is created around the wire, which contains the signal. When a cart passes over the wire, a resonant antenna inside the wheel receives the signal. A microcontroller then recognizes the signal and determines that the wheel should lock.

Because the magnetic signal is in the audible frequency range, earphones can be used as a transducer. To record and analyze this signal yourself, follow these steps.

1) Plug earphones into the microphone port of a laptop
2) Fire up a sound recording program (Windows Sound Recorder used here)
3) Find the saw cut with the buried wire in the parking lot of the store
4) Put the earphones on top of the line on the pavement.
5) Wait until there isn't much audible background noise from cars driving by and such.
6) Record ~10 seconds of sound from the earphones.
7) play it back, you should hear a quiet chirping
8) Filter out noise using a sound editing program such as Audacity
-high pass at 7kHz
-low pass at 9 kHz
-amplify a lot
-use remove noise tool (works pretty well)
-Fast Fourier Transform to find frequency
9) Inspect your work, and write code to simulate it (provided in a later step)

The screenshot is of the signal for the GS2 system. The little blue blobs are actually a 7800 Hz sine wave, according to the FFT. The unlocking signal for the GS2 looks similar, but the middle 8 blobs are played backwards. Notice the pattern of long-short-short-short-long-
long-long-short is the same whether played backwards, or inverted. Interesting...

GS2.ogg is what the signal sounds like, if you had magnets in your ears.

Get Audacity here

The CAPS signal is much simpler, bascially an 8 kHz sine wave multiplied by a 33.3 Hz square wave. Another way of thinking about it is 120 sine wave cycles followed by 120 cycles of silence. The unlocking signal is a pure sine wave with no modulation, but unlocking a CAPS equipped cart requires the boot to be reset by hand. Don't try this at home, unless you like getting caught.

We also have good reason to believe that all GS2 wheels may be controlled with CAPS signals. It worked reliably on at least one store, anyway.

Attachments

Step 4: Recreating the Locking Signal (theory)

When a current flows in a wire, a magnetic field is created around it. When a lot of current flows through a wire, a large magnetic field is created around it. To a zeroth order approximation, flowing current through a loop of wire with any signal will produce a magnetic field that will induce approximately that same signal in other loops of wire - say, a shopping cart wheel.

By using a microcontroller to recreate the locking (or unlocking) signal and feeding that through a Serious Power Amplifier will allow you to broadcast that signal through the aisles of your local foodmotron or local merchandise pick-upery.

The rest of the steps will show you how to build your own Serious Power Amplifier.

Step 5: Obtain Components and Tools

Parts you will need:

1) Printed circuit board (see below)
2) Digikey order (see below)
3) 2x 8.4 or 9.6 volt NiCd or NiMH batteries and charger. Cheapies from a toy store or Target or Walmart work great. NiCd tends to have the highest power output.

Tools you will need
1) soldering iron and solder
2) crimpers
3) screwdriver
4) pliers or small wrenches/sockets
5) PIC programmer-- we used the ICD2 from Microchip (also available on Digikey)

The PCB is best professionally printed. If you really like to do things by yourself, you can try the iron-on approach. Making PCBs at home

Included here are Eagle files. Eagle is a free PCB CAD program. Many instructables use this software. You can also just send the board manufacturer the Gerber and Excellon files, also included below. Some board manufacturers also ask for the fabrication drawing.

.sch and .brd are Eagle files.
.sol and .cmp are Gerber copper layer files
.drd is Excellon drill data
.fab is the Gerber fabrication drawing

Digikey order:

1x PIC16F716-I/P-ND (PIC)
1x X909-ND (20 MHz ceramic resonator)
1x 563-1085-ND (rotary switch)
4x IRF1407PBF-ND ("beefy" MOSFET, could probably get away with a cheaper part)
4x ES3AB-FDICT-ND (protection diodes)
2x IR2104PBF-ND (MOSFET drivers)
4x BER199-ND (insulating pads)
4x RP338-ND (TO-220 screw insulators, 25 minimum)
4x HS106-ND (small heat sinks)
1x 565-1066-ND (giant capacitor)
1x WM8121-ND (6 pos. header)
1x LM7805CT-ND (5V voltage regulator)
6x BC1157CT-ND (1 uF ceramic capacitor, 10 minimum)
2x MURS120-FDICT-ND (diodes right above IR2104)
6x 311-10KARCT-ND (10k 0805 resistors, 10 minimum)
4x 22QBK-ND (22 ohm 1/4 watt resistors, 5 minimum)
1x F2512-ND (fuse, 5 minimum, get extras)
1x F1467-ND (fuseholder)
1x ED3318-ND (18 pos. PIC socket)
2x ED3308-ND (8 pos. IR2104 socket)
1x SW293-ND (lever action switch)
3x WM2308-ND (connector plug, buy more)
3x WM2309-ND (connector socket, buy more)
6x WM2310-ND (connector receptacle, buy more)
6x WM2311-ND (connector pin, buy more)

Buy extra connector parts; they are flaky, but thankfully cheap. Solder them for best results. The batteries will probably have one end of the connector installed, but having the proper mating parts on hand is cheap insurance. You may want to try a different connector.

A few other pieces are also needed:

#4-40 screws and nuts for heat sinks (Home Depot or Digikey)
electrical tape (Home depot)
50 ft 18 ga wire (Digikey only has 100' rolls, try auto parts store)
5 ft flexible 2 conductor wire for switch, ~22-24 ga

Note that some of Digikey's minimum quantites are more than required above. Since these parts are little and cheap, you probably want spares anyway. SMT resistors are especially easy to lose.

Attachments

Step 6: Populate the Board

This board does not require any advanced soldering skill - just a steady hand, some reasonably fine solder, and a pointy iron. Here are the steps and their justifications - note that we found all of these to be absolutely necessary:

1) Reinforce high current traces with solder and wire

These are the fat traces along the top of the board, and also connecting to the capacitor. Even a thick wire trace won't be able to carry enough current to power the cart-locker. We have blown up our first few boards due to this issue. We find it best to reinforce the traces by soldering wire along the trace.

2) Solder sockets

Since this is a high-power board, you want to be able to replace chips should they blow up. This will allow you to simply pop in a new one and continue wreaking havoc.

3) Solder other components-- resistors, capacitors, resonator, switch, 5V regulator

4) Attach wires

As detailed in the pictures below, the middle two are the battery leads, with the + terminal on the left. Reversing these will blow up the board. The outer two are for the inductor. Order doesn't matter for these.

For now, just attach about 2-3 feet of wire to each large solder pad. The four large pads need ~18 gauge wire. The two small solder pads at the bottom can be much smaller wire, and the leads should be able to reach from your pocket to your hand, about 4-5 ft.

5) Solder MOSFETs and protection diodes last (note directions of diodes)

The protection diodes will prevent all sorts of nasty voltages produced from frying most of the components on the board. Bend the MOSFETS to be in plane with the board before soldering. You want the completed board to be low profile.

6) If you are programming the PIC in circuit, solder the header and socket the PIC. Otherwise, program before inserting.

7) Attach heat sinks to MOSFETs with heat pads and screw insulators.

Don't forget those insulators! Depending on how you wield this beast, you may come into intimate contact with a heatsink, and when that happens you'd better hope it's not electrically energized too!!! The parts list calls for the purchase of 4 heat sinks, but since we had aluminum scrap sitting around, we used that on our version instead.

8) Encapsulate the board to prevent smoke leakage. We were lazy and used electrical tape. We have also been so lazy as to wrap it in a heavy plastic bag. If you want to do things better, put it in an electronic enclosure or tupperware.

Step 7: Wind the Inductor

There are two tradeoffs to consider when winding your inductor:

1) Magnetic field strength is proportional to current times the number of turns (A*N). Putting the same current through more turns of wire will create a stronger magnetic field. However:

2) Inductance is proportional to the square of the number of turns (L ~= N2). Neglecting a good many things like resistance, peak current will be inversely porportional to the inductance of the coil (I ~= 1/L). The MOSFETs are a constant voltage source, so increasing the turns on the wire will decrease the field strength, since it decreases the current that can flow through the wire.

This means that both your range and your probability of leaking smoke increase with decreasing turns. The trick is finding a balance between a fun range and not accidentally catching your pants on fire.

We suggest 7 turns of approximately 18 gauge wire. If you use fewer turns or smaller wire, YOU ARE PLAYING WITH FIRE. Not to say it can't be done-- we've used a less robust device with as few as 4 wraps of wire... then flames shot out of one of the MOSFETs.

For the most hardcore/foolhardy, keep in mind that the power output will be maximized when the impedance of the inductor matches the impedance of the batteries, and losses go up with current2. There is a practical lower limit to how many turns you can use.

Wind the inductor to be large enough to fit around your torso or down your pants leg. The goal is to have a large diameter loop, but make it practical enough to wear without being seen. Our loops are about 18" in diameter. Also leave enough wire to attach a connector. You probably won't want the inductor permanently attached to the board.

The easiest way to wind a nice inductor is to wrap the wires between two nails hammered into a board. After the wire is wrapped, use some tap or wire ties to hold it all together.

Step 8: Finish the Wiring

Install the connectors for the batteries and inductor. There is great debate of whether solder or crimps are better. Unless you have a very fancy crimping tool, solder the connections after crimping. Bad crimps tend to fall apart, and it can be really aggravating if you don't have spares.

It would be wise to install the connectors such that a battery cannot be plugged into the board in place of the inductor, though a failure from messing this up is unlikely.

You must install a fuse. Otherwise, a failed component could become very dangerous.

Solder the microswitch to the other end of the skinny wires. Use the "Normally Open" connection on the switch.

The 2nd picture is of the completely assembled unit.

Step 9: Program the Board

You will need Microchip's free MPLAB or other PIC software to program the microcontroller.

We used an ICD2 to program the PIC, but there are many suitable and cheap programmers out there.

The programming header is in the prescribed Microchip order. Starting on the left:

1) Vpp (HV programming, connected to reset)
2) Vdd (+5V)
3) GND (ground)
4) PGD (program data)
5) PGC (program clock)

You will either need the AC adaptor for the ICD2, or you will need to connect the batteries before programming. Alternatively, since you should have socketed the PIC, it can be programmed off board.

The included source code was written in C, but the compiler we used is not free. The compiled hex file is also included here. We make no claims that the code is efficiently written, but it works.

Note that there's a small problem with simply broadcasting at one frequency. The FFT shows that the carrier frequency of the signal is about 7800 Hz. However, component values for inductors and capacitors (used in the receiving circuit) could be off by as much as 20%, depending on the tolerance of the parts. When driven "off resonance", receivers are much much much less sensitive. To combat this, the code steps through a series of 5 frequencies, centered about somewhere near 7800 Hz.

Attachments

Step 10: Testing and Debugging

Connect the batteries and inductor, and push the button. If you are near something heavy and made of steel, like a fridge, filing cabinet, car, etc., you should hear a chirp. If you hear this chirp, you can pretty safely assume it's all working OK.

If the fuse blows, remove the inductor and replace the fuse. If it still blows, you have a short somewhere, such as a backwards diode or blown MOSFET. It can be a real pain to find which one.

If the fuse only blows with the inductor in place, the inductor may be too short. Add more turns.

If the fuse blows with a properly sized inductor, one more possibility is that something is wrong in the timing/control circuit, or a diode is backwards, or a MOSFET is fried. If the inductor is left connected to the battery, the current can ramp up beyond 5A very quickly. At 8 kHz, there is not enough time for the current to ramp too high. If you have access to an oscilloscope and know how to use it, great. If not, you can use a voltmeter to make sure the H-bridge is putting out AC. Remove the inductor and measure voltage at the device output. There should not be a significant DC offset.

Step 11: Install Device (on Human)

Attach to body in a hidden fashion. Use medical tape or shave first... It is best to tape the inductor to a leg or around the torso-- your choice. We have a pair of shorts that hold the circuit and batteries, allowing an outer pair of pants to be used as urban camouflage.

As you flip a defiant engineer's middle finger to the loss of trust in individuals caused by the gradual takeover of our fine country and local businesses by megacorporations, and strap a device of mass hilarity to your own body to show them the folly in treating individuals as cattle, consider yourself and your place in society. For you see, they are not selling the commodity to you, they are selling you to the commodity. Psychiatric drugs are a plot by the government to subdue and pacify the citizen body. The founding fathers of the glorious US and A founded this nation on the concept of individual liberties, and trusted an educated citizen population to be the true stewards of power.

So, install the device, and fight the good fight, for the decency of all Americans. Try not to get caught; it's a pain in the ass to explain to the FBI what you were doing.

Step 12: Attack!

Don't be stupid (easy), be discreet (harder), and try not to laugh (impossible).

Sometimes customers laugh, sometimes they curse, sometimes they are riding on the shopping cart when it locks up...

Sometimes people blame "magnetic" things in the area. They are probably the most correct.

Our personal favorite is to go on every full moon, or only when there's a thunderstorm. You could also make up a story about the supermarket being built over an Indian burial ground and tell them about it.

On the one hand, we feel sorry for the engineer who has to figure out why thunderstorms are setting off a byte-encoded trigger for the locking mechanism. On the other hand, HAHAHAHAHAHA!

Good luck! You'll need it!