Automatic Litterbox Central

Some readers here may still know my from my LitterFree postings. My faithful LF required more and more maintenance, but still did it's job. When both my feline friends (16 & 17 years old) passed away two years ago I needed some time on my own. But now I'm living together with my girlfriend for 1,5 years we thought it would be nice to have two cats again. Next friday out Havanna and Siamese brothers will join our family.

To welcome them I thought it would be nice to order a CatGenie. I remember the LF problems, the noise it made and it didn't want to give our new kittens an old box. Finding an America company that would ship to Europe was proved nearly impossible, shipping charges were outrageous and still I needed a 1500Watt transformer. But a solution for the smart cartridges was available: The feared chip turned out be a (for us engineers) simple I2C memory device. Resetters are widely spread and I even found the sequence of I2C commands to make the chip do whatever we want, sing and dance excluded. I would probably end up buying original cartridges anyway, but the freedom of having an alternative is always good to have.

The news that CatGenie UK has opened it's doors was the extra push that made me order the Tuxedo package immediately. Together with the promptly answered and friendly emails. Shipping charges were a lot cheaper and since the European version was designed to operate at 230 Volt it would save me from buying a big, heavy and expensive transformer. Unfortunately I wasn't able to cash in CatGenie's promise to offer a similar introduction offer for LF users, but I they made me a very nice gesture of throwing in a couple of extra's so I had a pretty good deal.

Today my package arrived. I was pleased to see mine was the latest version, including all the upgrades and the latest motor unit which allows the box to flush after each visit. Everything looks great, well taken care off and I'm very pleased with the unit. I was also surprise to see that the smart chip appeared to be gone. I thought they finally gave up, after so many resetters are in the market.

But when inspecting the smart cartridge a little closer and rubbing my finger over the label, I noticed a little bulge in a very familiar shape. Cutting away the top layer of the label revealed that the former I2C chip has gone indeed, but it [b]has been replaced by an RFID chip[b]! This is rather disappointing because RFID chips are somewhat more difficult to mimic.

Besides that; Many people have serious privacy concerns about putting chips in our purchases which are easy to scan from a distance, without even making contact to them. But it also raises a compatibility question: Obviously the new RFID chips are not compatible with the older I2C chips. So there must be two different types of cartridges. Yet the new cartridge doesn't indicate to be specifically designed for the new motor unit. It even bears the same old label with a photo of the old CG on it.

Am I the first CG user to notice this?

The new chip is the SRIX4k by STMicroelectronics, as indicated by it's print. it's using the ISO 14443-2 Type B protocol and below is a URL to it's data sheet for the engineers among us :
http://www.st.com/stonline/products/literature/ds/8887/srix4k.pdf
A reader/writer shouldn't be very hard to find, though the chip may not be resettable at all if one of the two featured non-resettable down counters is used.

MindBender wrote:A reader/writer shouldn't be very hard to find, though the chip may not be resettable at all if one of the two featured non-resettable down counters is used.

If the chip features a non resettable counter, you can bet your life PetNovations is using it.

There is a disable state... counter = 0, now disable it...... PetNovations quote "got cha"

Pelvis Popcan wrote:If the chip features a non resettable counter, you can bet your life PetNovations is using it.

You'd be surprised how many companies rely on the "security by obscurity" principle: The simple fact that the majority of people do not have the means to manipulate the data on the magnetic stripe of a credit card has been the only barrier of security for a long time.

Using the non-resettable counters makes sense in this case, but from an engineering point of view it has a couple of draw backs too. I wouldn't be surprised if the number-of-cycles-left is just stored in the reprogrammable area of the chip.

2cats2dogs wrote:There is a disable state... counter = 0, now disable it...... PetNovations quote "got cha"

The simplest solution is probably to get a new chip and program the PT identity in it. But this solution would require a new chip for every refill.

Another solution is to emulate the chip of a full cartridge using a microcontroller such as an AVR. Some of those already incorporate the circuitry required for RFID communications. I even seem to recall that software libraries to emulate a RFID tag are already available.

If the RFID reader isn't too highly integrated into the CG controller, it could be replaced by a microcontroller mimicking the RFID reader reporting to detect a full chip. (or mimicking the counting down, but resetting the count if the cartridge is re-inserted)

Finally an alternative controller or alternative firmware could be a solution here. Unfortunately that's a quite a lot of work of a one-off solution.

MindBender wrote:The new chip is the SRIX4k by STMicroelectronics, as indicated by it's print. it's using the ISO 14443-2 Type B protocol and below is a URL to it's data sheet for the engineers among us :
http://www.st.com/stonline/products/literature/ds/8887/srix4k.pdf
A reader/writer shouldn't be very hard to find, though the chip may not be resettable at all if one of the two featured non-resettable down counters is used.

Now that's uncrackable with out breaking the law! Because they can in bed there own micro code to read and wright and set the device that would be against the law to reset the microchip without steeling there software or know there checksum codes to hack the device! So if they changed there chip, and controller, just offer a low cost unit 120 count exchange and the reset devices are no good anymore. So why go after the reset makers if they advanced there device with real security. But yet I still see two sellers of reset devices on the internet. I also agree put reset devices in Petco or petsmart and give us a lower cost to refill the cartridges. Make CG greener a little cheaper to refill and reset is all we ask. Some thought that is what they were getting, according to you web site. no were does CG state you will be tossing out there plastic cartridges that fill the landfills. according to the recyclers if you cant rinse it don't recycle it because they don't know what ingredient were in it.

locomanjim wrote:Now that's uncrackable with out breaking the law! Because they can in bed there own micro code to read and wright and set the device that would be against the law to reset the microchip without steeling there software or know there checksum codes to hack the device!

That's an interesting point! Though I seriously doubt if there is any opcode in the chip. And if there is, I doubt if it is protected by law because no copyright was claimed. Even the presence of anything protect by law inside the chip isn't indicated anywhere. After all there's only a bunch of numbers inside the chip and numbers cannot be copyrighted (if they can, I hereby claim 1).

locomanjim wrote:But yet I still see two sellers of reset devices on the internet. I also agree put reset devices in Petco or petsmart and give us a lower cost to refill the cartridges.

Perhaps it's a good idea to warn potential CG buyers that all resetters currently on the market are useless for CGs currently sold.

locomanjim wrote: Make CG greener a little cheaper to refill and reset is all we ask. Some thought that is what they were getting, according to you web site. no were does CG state you will be tossing out there plastic cartridges that fill the landfills. according to the recyclers if you cant rinse it don't recycle it because they don't know what ingredient were in it.

I agree: Filling the box should be cheap enough to make 'illegal' refilling just not worth the effort! A new-type SaniSolution cartridge costs £23.75 here (that's a whopping $40 in Yankee money) and I estimate there's about half a liter of fluid in it. I don't know how much research and development effort they have put in this fluid, but I doubt if $150(!) per gallon justifies any kind of research.
Just for comparison:
Moët & Chandon, 2003 (not a particularly good year though) cost about the same
Castrol GTX 10w40 costs about 1/5th, and a LOT of research went into that.
Now I don't think Champagne of motor oil (even high performance types) will clean the box as well as SaniSolution , but I think it's a good to know what other precious fluids can be bought for that price.
A 32 fl oz (almost a liter) of Simple Green, ofter referred to as a good alternative, costs about $8 including the nifty spray-bottle. That's $32 per gallon (It's probably cheaper when actually buying a gallon). I don't think any of us would even consider hassling with needles and resetting cartridges if SaniSolution would cost two times that price, which would still be a generous price. Even if the CG could be topped up with a filler cap I would consider any alternative if it was half the price of the original agent. But a factor 5 is close to outrageous.

From the other hand, an old-type SaniSolution cartridge cost only $15 your side of the ocean. It's hard to compare prices because the new cartridges haven't appeared in US shops yet and the old cartridges will not appear in European shops at all. But if that US price in maintained for the new-type cartridges it's not that bad. The new-type cartridges are good for 120 cycles (240 if cat-activated mode is used) and at 1,5 cycle per day for one cat, a cartridge will last for 80 days. However, if the price is doubled because the old cartridge lasted only 60 cycles, the fluid gets even more expensive because the contents did not double...

MindBender wrote:If the RFID reader isn't too highly integrated into the CG controller, it could be replaced by a microcontroller mimicking the RFID reader reporting to detect a full chip. (or mimicking the counting down, but resetting the count if the cartridge is re-inserted)

And it isn't: The reader is a STMicro CRX14p (http://www.st.com/stonline/products/literature/ds/11922.htm) based stand-alone RF-ID reader/writer, connected to the main controller through I2C. So it could be replaced by a small microcontroller mimicking a CRX14p talking to a full cartridge. I would be even better to put a microcontroller in between the main controller and the actual reader. This way it can play along by simulating the cartridge's down counter, leaving the warning mechanism for an empty cartridge in place. But upon reinsertion of the cartridge, the simulated counter would simply reset.

MindBender wrote:Finally an alternative controller or alternative firmware could be a solution here. Unfortunately that's a quite a lot of work of a one-off solution.

This is still feasible as well: The main controller has a MicroChip PIC16F877A (http://www.microchip.com/wwwproducts/Devices.aspx?dDocName=en010242)on board and the programming pins are on a nicely labeled connector. But developing alternative firmware for this incredible machine is a lot of work. Especially it you want to make it work as well as the original firmware. The developers must have thought that if you go through that much trouble you deserve to have your CG run without chip

MindBender wrote:

locomanjim wrote:Now that's uncrackable with out breaking the law! Because they can in bed there own micro code to read and wright and set the device that would be against the law to reset the microchip without steeling there software or know there checksum codes to hack the device!

That's an interesting point! Though I seriously doubt if there is any opcode in the chip. And if there is, I doubt if it is protected by law because no copyright was claimed. Even the presence of anything protect by law inside the chip isn't indicated anywhere. After all there's only a bunch of numbers inside the chip and numbers cannot be copyrighted (if they can, I hereby claim 1).

locomanjim wrote:But yet I still see two sellers of reset devices on the internet. I also agree put reset devices in Petco or petsmart and give us a lower cost to refill the cartridges.

No copyright is needed to be shown to have it copyrighted. As a software engineer and author, simply publishing something brings be a copyright. That is in the latest copyright laws. All I need to do is place my name or company name on the works,

Now, on this RFI chip, code to read it is on the data sheet. It isn't rocket science.

Wait a second... I'm confused. These cartridges are for the new CatGenie 120, correct? So how come the label on MindBender's picture says "60 washings?"

Is this new CatGenie that is being sold in the UK the new 120 model? Or is it a separate update to the existing model for UK sales only?

Pelvis Popcan wrote:Wait a second... I'm confused. These cartridges are for the new CatGenie 120, correct? So how come the label on MindBender's picture says "60 washings?"

Is this new CatGenie that is being sold in the UK the new 120 model? Or is it a separate update to the existing model for UK sales only?

The first new 120 model cartridges have old model cartridge labels on them. That's what caused my confusion at the beginning of this thread and the cartridge on the picture above is one of those first ones. Now I have unwrapped the box of spare cartridges and those have clearly different labels, explicitely stating they are suitable for the CatGenie 120 model only. I hope this clears up a thing or two.

2cats2dogs wrote:No copyright is needed to be shown to have it copyrighted. As a software engineer and author, simply publishing something brings be a copyright. That is in the latest copyright laws. All I need to do is place my name or company name on the works,

If that's true, it's still not a big deal. I'm a software engineer too and reshuffeling 4k of PIC assembler to make it my own code shouldn't be too hard. But I doubt if there's executable code inside it. I don't think a PIC16 controller is capable of loading executable code from an external source. And if it is, and PN they went through that much trouble, they probably would have used a controller with an integrated RFID reader instead of an external one that's relatively easy to mimick.

2cats2dogs wrote:Now, on this RFI chip, code to read it is on the data sheet. It isn't rocket science.

Exactly my point of posting it; All information is right there. Another PIC acting as an I2C slave, mimicking a reader with a full cartridge shouldn't be too difficult to make.

It's so good to finally see some more software developers on this forum! Back in the LitterFree days I hardly got any response on my threads on alternative firmware with cat-detection.

We are so on our way to Pimp'd out CatGenie's!!!

I LOVE IT!!!

Just took apart one of my used cartridges and I noticed that there's a pattern fer the RFID spot...interesting.