Epson printer catridge chip analyse, hieronder een paar foto’s van de chips:
Cracking the 2100p protocol
What is a Intellidge ink chip.
Epson fit small circuit boards to most of their ink cartridges. These record the amount of ink that is estimated to be in the cartridge. I read that the official epson line is that it is for the customers benefit and not an anti-refill device. Whether you believe this or not they are a bloody nuisance to anyone wanting to refill the cartridges or use bulk ink. It also stops people using old cartridges full of solvent for cleaning the heads. Another problem was early printer models didn’t check if the cartridge had been changed while power was on. This was good if you wanted to trick the printer into copying a “full” chip to and empty one, however the reverse was also true and you could easily copy and “empty” one into your full one.
They are just a small memory device holds 32 bytes of data, they do not measure real ink level and nor does the printer. The printer reads the chips on startup, estimates (sometimes badly) how much ink should have been used and writes this back at shutdown. They hold other data as well.
So epson go to the trouble of fitting chips to cartridges and building all the extra sockets, wiring, electronics and software into the printer so you can use the computer to see the predicted level and it can stop you printing if it think you’ve used enough ink. High-end Canon’s on the other hand make the inks tank clear so you can see and have optical sensor to detect emptiness. This make a lot more sense – unless you are making an anti-refill device that is. Canon almost got my business this time but nobody I could find has run pigment in them – too risky.
To get around the chip problems someone usually end up producing read-only chip which always read full (for use with CIS) and chip reseters for those who want to refill. These are not available for 2100p at the time of writing as far as I can tell.
Before ordering my 2100p I did my homework and it seemed fairly likely a chip reseter would become available at some point and read-only chips as well. I was also cocky enough to think I could crack it myself and I have. It didn’t go quite as expected though.
What do I want to do?
I want the easiest way to fool the printer into believing it has full cartridges present so I can build my CIS.
What did I expect?
A logical interface for Intellidge is i2c (i squared c) or TWI (two wire interface). Then the chip could just be some standard i2c eeprom. The Intellidge have too many pads for this but I was hopeful. After that would could SPI or microwire – again this could use off the shelf parts. If the chips were micro-controllers then plain asynchronous serial would be my choice.
I had a look.
To do this I use a AVR mega323 micro, I declined offers of logic analyzers being a homebrew type of guy. The 323 has 2K of internal ram which is enough for some minimalist data logging. It was about $50AUS in parts ($30US) to make. I wired a cartridge to bring the signals out and took a quick look with a voltmeter.
There was nothing there. I expected some power but no, the chips are only powered briefly when the are accessed. I used leds to get a rough idea what was what and hooked up the micro via resistors to give some degree of protection to the printer if I screwed up. The code in the micro was written is assembler and captured data sent via rs232 to my PC where I wrote a delphi program to display and process the data.
This is the sort of thing I got. No protocol I ever seen. Obviously synchronous with bi-directional data, very short format. I was confused a little by how short it was – because I expect much better precision for the ink level.
The traces seem to be.
Top – some sort of sync line, this always goes low before the start of transmission.
Next – power this goes low (off) between chip reads at printer startup but stays high during the shutdown – when data is written to the chip.
Next – the clock, data is read of the rising edge and changed on the falling.
Bottom – bi-directional data, the first 4 bits are always from printer to the chip, the rest depend on whether it is a read or write. LSB first (left).
Convert to binary and some patterns emerge.
It was not real obvious how the chips were addressed or which bits encoded ink levels. Some more data when some ink had been used made it easier.
Below is one chip being read at startup, there are 7 accesses one for each chip. Only 3 block have data – the other chips must be hooked to different data lines.
Below is the complete shutdown stream. Again we can only see 3 chips from here.
After printing a few bits near the beginning of the bit stream did change. It looks to me like the first 3 bits are the chip address the next is a write bit then the ink level, I get the feeling there aren’t many bits used to encode it (later looks like 6).
So – the top one shows 252 bits of data being read out of the chip.
The first part of the shutdown shows just the ink level being read out, this is to check the same chip is there.
The second part is the ink-level and some other stuff (printer serial number maybe) being written into the chip. Seeing I didn’t use any ink the bit-stream is identical to the read except for bit 3 – presumably the write bit.
Tuesday 24 Sept 2002. I fooled the printer.
The interesting thing about this screen grab is the black cartridge is really only two thirds full. I spoofed the printer by pulling the serial data line low during the time the ink level bits are being clocked out of the ink chip.
This is means 6 bits starting at the 5’th bit in the stream.
The first 3 bits appear to be the chip address, I guess the next is a read/write select. I used a AVR mega323 to detect the start of the serial transmission look for the address of chip1+read (black apparently) then pull data low for 6 clock edges.
I’m sure I can reset 3 of the chips by tapping into chip1 signal. Reseting the rest will mean tapping into at least one more.
The current set up is for experimentation only – it is not “the real thing”.
Shorting the data to ground may be a bit drastic but it is only for a very brief time. I hoped the data line would be open collector but this doesn’t seem to be the case.
Tuesday 1’st October. – reading the chip without the printer.
I don’t really need to do this but I wanted to see if I really understood the protocol. I wrote code for the micro to act as a master for the chip. I knew the chip was a low voltage part but I hoped it would be 5 volt tolerant and save me some trouble. After getting no sense out of two chips and confirming the printer couldn’t read them either I assume I’ve killed them. I went shopping and bought 3V3 zeners and 330R resistors to limit the output of the micro port to 3V3. Data started to flow. The micro would not read it because is was below the input threshold so I added a pull up to the data pin (on the micro side of the 330R current limiting resistors so the inkchip didn’t see 5V). I could then read the contents of the chip.
I then spent the afternoon trying to write to it without any success.
Wednesday 2’nd October – reseting the chip without the printer.
After sleeping on it, I wrote a better trigger routine for my data-logging program so I could get a better look at what the printer did differently. The trace revealed all.
What you see here is the printer starting a write sequence at normal speed then after transmitting the address and write bit the clock (2’nd from bottom) slowed down to around 1 Khz. I wrote a “slow write” routine and presto I can write to it. My code simply writes zeros to the first 8 bits in the chip. I repeat the process 7 timse using every chip address. The proof was to take an empty cartridge – zap it and feed it to the printer. The printer said yum and did it’s charging thing – then showed a full cartridge on the status monitor. I won’t bore you with another image of it. A chip reseter could be made with a $2 micro and not much else – the socket is a problem. Most people can’t program micros but for those who can it is trivial now that the protocol is knonw. My hacked about code is too ugly to show here.
Alan Chan has sent me this hoping it would help people ID their chips.
Dit is een foto die ik genomen heb van een recentere chip zo te zien:
Cracking the 1290 protocol
26th Jan 2003.
Since posting my 2100p chip hack and my chip resetting program I have had quite a few inquiries from large format epson owners seeking resetters. The desktop printer owners are pretty well catered for with reasonably priced universal resetters. Some people still complain about the price but really they can pay for themselves after one cartridge set is refilled. The professionals are not so lucky. One of my contacts informed me that the 7600 can use chips out of the 870/1270/1290 etc series desktops. The pin out is obviously different so the printer must have be modified. Anyway I though it might be worth cracking the 1290 and if possible adding this series to my reseter. I don’t have any of these printers so I bought a commercial reseter to see what the signals look like. If I can do the 1290 I may be able to do the 7600 etc.
This is what a commercial chip reseter sends to the chip. The traces are (from top) pads 1,5,6,7 and 4.
My best (but probably wrong) theory is :-
5 is obviously a clock for synchronous serial.
6 is power (this is known from data sent to me about fake chips)
4 is a select line which is high for black chips and low for color one.
That leaves 1 and 7.
A least one of them will be a data line and the other could be a read/write.
If the ink level is stored the same way as the 2100p style chips then 1 is data and 7 is R/W and write = high.
Alternatively the R/W may be encoded in the serial data as it is in the 2100p. But you don’t need the other line then.
I can’t talk to the chip at all. I may have killed it somehow. The ILRS seem to output 4.6V so I would expect the chips to work on the 5V supply I’m using but maybe not.
Time to dust off the CRO I guess.
27th Jan 2003.
I managed to read and write the chip with a micro. I was close. Pad 4 is the R/W and pad 7 appears to a reset/sync line. I erased most of the data in the chips while I was working it out but they appear to have about 32 bytes of data in them like the 2100p. The next step is to make an adapter so I can access them directly from the PC.
2 hours later.
It works. Not much more to say here. The program is over at this page.
Beating the chip
Please note – This page was written before chip resetters were available for the (then) modern printers. Almost everyone visiting this site will be better off buying a resetter than trying to build one. Many people can simply use the free SSC service utility (see “Software only solutions” below). The rare exceptions are people who simply want to do it for fun, people who want to see or modify the chip data and people living in countries where resetters don’t exist due to a trade embargo. I have considered pulling these page to stop the emails coming. After a few thousand “help me” messages I’m quite sick of them. I have other things to do – if you don’t believe me look around the rest of the site.
21-may-03,I’ve had a couple of reports that lowering the value of the resistor(s) has been necessary to make it work. I presume some printer ports have a lower input impedance than mine – possibly due to resistive termination. The circuit at “ampoule” has been modified to put a transistor in the data path. Note that this will invert the signal so my program will not work with it. Modifying my code to do both shouldn’t be too hard but I don’t have time. I have put my project source online as JPL if anyone want to take it over.
24’th Mar 2003,
I’m still getting too many emails from novices asking for help. If you don’t know basic electronics find someone to help you. I do not have time to diagnose faults by email. There is also a new site (it is not one of mine) that may be of help.
10’th of November 2002,
In part one I used a micro controller to analyze the chip signals and reset the ink chip. Building that sort of circuit is beyond most people. Programming the code into the micro requires a programmer (a device not a human) and some specialist knowledge. If I were building a commercial chip reseter (which I’m not) a micro is definitely the way to go.
But for the less technically able I’ve come up with this circuit. Someone with basic soldering skills should be able to knock it together.
For printer ports with 5 volt levels the circuit looks like this.
Some chips may tolerate 5 volt and not need this, in particular 3’rd party chip.
The circuit is for a printer port dongle. A companion windows program will be available below (does anyone want to port it to linux?). The circuit mainly consist of 3.3 volt clamps to convert the ports 5 volt levels to 3.3 volts. The only tricky bit is the data line. When the chips data line is in an input mode it is driven by port data line 3 via resistor R4. When it switched to output mode the chip override the signal and the output is sensed by the +select line. When the chip is outputting data I pull data-3 high so it becomes a pullup to 3.3V
My printer port has no trouble reading the signal but your mileage may vary.
The software is written in delphi 5 and requires a free DDL to work. Windows being windows I can’t guarantee the program timing. I’m running the serial clock very slowly (1khz) but it seems to work fine. But if windows goes to sleep half way thru a chip write cycle I don’t know what it will do to the chip – hopefully nothing bad but I don’t know that yet.
Bit 6 7 and 8 supply power to the inkchip, this is the upper group of resisters and top zener.
The plug pins which are soldered together are ground.
The odd vertical resistor routes the chip data line to the +select input.
The pins in the strip on the right are
3.3V power (top)
Note that the DB25 pads are not at 0.1 inch spacing and the strips on the veriboard are – so only 4 pads are soldered and offending bit of strips are removed.
For printer ports with 3 volts levels things are even easier.
The interface come down to one resistor. A few extra resistor could be added to protect the port from short circuits.
Note that all solder connections are on the upper row EXPECT black which is on the bottom.
You can see my home brew chip socket here also.
The wires are
orange = sync
white = clock
blue = data
Black = ground
Red = power.
There is lots of stuff in the debug menu to help you test the port etc – be careful with it when a chip is attached.
If you are contemplating this project – start by running this program. Disconnect anything you have on the printer port and run
“Debug/make clock”, this should produce a 10,000 cycle 1K clock and show you a message when it is done. If this work it shows your computer timer is compatible with my program (which uses queryperformancefrequency and QueryPerformanceCounter).
There is a danger that leaving some port lines high and attaching a chip will do bad things. I will add a reset-port command soon.
Or you can try “debug/show freq” to display your counter frequency – if it shows zero you’re out of luck – let me know if this happens.
The chips have a 3 bit address/id. During the Read and Reset chip procedures my code tries all 8 possible addresses and displays the contents as seen in the graphic above. The first byte is the ink level, it is zeroed to make the chip “full” ie zero ink used. Someone with time to spare may wish to decode the rest.
I guess I should add a “write chip” command one day.
That’s is for now, have fun and don’t let the smoke out of the components.
Monday – 11’th November.
Good news and bad news.
The bad is I’ve blown up several ink chips. I think the reason may be bad contacts in the improvised chip socket I’m using or from running them under voltage.
The good news is my printer port uses 3.3 volts signals. I first thought is was faulty but my notebook uses 3.3V as well. This means the above circuit is not needed and a minimalist interface consists of one resistor (R7). I’ve done it and it works.
Monday – 12’th November Beta 1.2
Good news – I didn’t blown up the chips. The flaky socket had caused the chip to go into write mode and it was filled with “ff”s. Not only were they erased but there Ids had all changed to 7 (all address bits high). Looking at the data I’d read out of the chips I noticed that 4 bits in the last byte was always the same as the ID. I had speculated that these bit might determine the id the chip responds to. I haven’t set out to test it but it sure looks that way now. I was able to restore the chips data I’d saved to disk. I had to power cycle the printer before it was happy but it is reading all the chips again.
To restore the chips – I added two more commands to the program. One is “blind reset” which pumps out all the possible ink level reset codes without trying to find a chip first. The other is “write chip” which finds the chip ID and then programs the data from the programs buffer into the chip. The buffer can be loaded from disk or another chip. The data files are simple text files so they can be edited if need be.
Sunday 1’st December. Beta 1.21
Minor update, reads are now much faster, this should reduce the number of chips which are accidentally erased.
Monday 2’nd December. Beta 1.3
3’rd party chips for the C60 (Jet Tek) needed a delay after the last byte was written. This has been added along with a C60 menu.
I think I’ve worked out the protocol for some of the other chips. The ones I used are from a 1290. These chips have the 2 centre pins on the row of 4 shorted out. I believe 870/875 etc also use them.
These use one extra signal (R/W). The pads are –
1-data, 2+3 ground,4 R/W, 5 clk, 6 power, 7 sync.
My interface looks like this.
The same as the 2100 except for the green wire.
The wires are
orange = sync
white = clock
blue = data
Black = ground
Red = power.
GREEN = R/W
I have run the chip at 5 volts without smoke and also on my 3.3 printer port interface.
I don’t have a 1290 printer so this is unproven. I can read/write the chips and I’m fairly sure the first bytes are the ink level so it should work.
I can read them but haven’t tried to reset them yet, the ink level appears to be stored in a different place to the other chip (I’m guessing 2’nd byte).
Monday 27’nd Jan 2003. Beta 1.4
Support for 1290 type chips (870 etc)
I now know the epson names and numbers for the chips ( different from the ones I made up)
7600/9600 pad layout.
Epson numbering is
2 4 6
1 3 5 7
my names for the signals was
sync power data
gnd clock R/W gnd
Epson call them
csm pwrm o/im
com clockm r/wm gndm.
The you can read and write them using the 1290 menu but don’t use reset.
Software only solutions.
I am aware of quite a few programs for resetting the ink levels. Some are free and some are not. The program athttp://www.ssclg.com/epson.shtml should be of interest to many visitors. I have no connection with SSC Service Utility– don’t send report files (testrep.txt) to me.
There are also problems resetting completely empty carts on some printers. This type of software can only work because epson have left “back doors” or service modes in the printer firmware. There is no guarantee future printers (even future manufacturing runs of current models) will be able to work with such software. As well as being able to reset ink levels the above program offer manual control of the cleaning cycles – this is something I really want to have.
I had hoped SSC would make this page obsolete but sadly it does not work with my printer and several people have written to me reporting the same. Some of the features which worked on the version 2.91 are now broken on V3.1 – epson may well have closed the door to this type of solution.
Sunday 1’st December.2003 Beta 1.5
I’ve had many emails over the last year or so saying “Does this program work with printer epson XYZ, I can’t get it to work”. My terse reply often amounts to “How the @#$# would I know, I don’t have printer XYZ – buy resetter and quit bugging me”
Anyhow today I tried to convert chips from a c82 (I think cart no TO323 etc ) to work in the 2100p and I couldn’t write to them. I could read them but writes would always result in $FF being written. After much wasted time I found I had to slow the clock down to write these. It will be interesting to see if the printer can write to them (it can). The new version is online.
Gebruik deze Digital Revolution Tool 4.0 om cartridges voor de eerdere generaties Epson Stylus printers te resetten. Uiteraard bieden wij u het volgende gratis aan:
Het programma “Digital Revolution Tool 4.0”
Hiermee kunt u via uw computer o.a.
- Meer dan 100 verschillende Epson printers worden ondersteund.
- Verbeterde reinigingsopties waardoor u nog meer inkt bespaart.
- Verbeterde status informatie.
- Chips van vele modellen resetten.
- De zwarte en de kleuren printkop apart reinigen (dit scheelt inkt).
- De tellers op de printer zelf resetten.
- En nog veel meer leuke opties.
- Geschikt t/m Windows XP. Niet voor Mac.