I modded this demo code from the Blinkenlight blog to read just one LED as input and turn a second LED on and off based on a simple threshold.

//
// www.blinkenlight.net
//
// Copyright 2011 Udo Klein
// modded 2013 by david mitchell - turn an LED on and off based on the light sensor value
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program. If not, see http://www.gnu.org/licenses/

// Usage
//
// This sketch uses the Blinkenlight Shield as a light
// sensor. In order to make this work jumper the shield
// such the common cathode of the LEDs it connected
// to +5V.
//
// It will output hexadecimal digits that correspond
// to the amount of light captured by the LEDs.
// 0 = very bright light
// higher numbers = less light
//
//
// Theory of operation
//
// For each LED the following happens:

// 1) The PIN is pulled low thus reversing the LED.
// Thus the LED will act like a capacitor and gets
// charged.
// 2) We store the current milli second count in
// start_millis for later use.
// 3) The PIN is put to high Z input and starts to
// "float" with the voltage of the "LED cap".
// 4) If the LED captures light the "LED cap" will
// discharge fast, otherwise it discharges slow.
// 5) As the cap discharges the input PIN will
// float high.
// 6) Once the pin is detected to be high we will
// compute elapsed_millis by subtracting
// start_millis from the current milli second
// count

// The loops are coded in such a way that this
// happens "in parallel". They are also coded
// in such a way that each pin gets some time
// to settle.

// used to store the start milli second count per pin
uint16_t start_millis[1];
// used to store the last computed milli second count when pin floated to high
uint16_t elapsed_millis[1];

uint8_t transform(uint16_t data) {
// output transformation, used to map uint16_t to 1 hex digit
// basically a logarithm to the base of 2
uint8_t i=0;
while (data) {
data >>= 1;
++i;
}
return i;
}

boolean pin_is_ok(uint8_t pin) {
// used to determine which pins are good for light detection
// pins 0,1 are spoiled by the serial port
// pin 13 is spoiled by the Arduino's LED
return (pin == 5);
}
#define MINPIN 5
#define MAXPIN 5
#define ANODE_POWER 6

#define LED_OUT 7

void setup() {
Serial.begin(115200);
Serial.println("go");

pinMode(LED_OUT, OUTPUT);
digitalWrite(LED_OUT, HIGH);

pinMode(ANODE_POWER, OUTPUT);
// turn on the LED charge power
digitalWrite(ANODE_POWER, HIGH);

for (uint8_t pin = MINPIN; pin <= MAXPIN; ++pin) if (pin_is_ok(pin)) {
pinMode(pin, OUTPUT);
digitalWrite(pin, LOW);
start_millis[pin] = millis();
elapsed_millis[pin] = 0;
}
for (uint8_t pin = MINPIN; pin <= MAXPIN; ++pin) if (pin_is_ok(pin)) {
pinMode(pin, INPUT);
}
}

void loop() {
for (uint8_t pin = MINPIN; pin <= MAXPIN; ++pin) if (pin_is_ok(pin)) {
if (digitalRead(pin)) {
pinMode(pin, OUTPUT);
elapsed_millis[pin] = millis()-start_millis[pin];
start_millis[pin] = millis();
pinMode(pin, INPUT);
}
}
for (uint8_t pin = MINPIN; pin <= MAXPIN; ++pin) if (pin_is_ok(pin)) {
int diff = transform(elapsed_millis[pin]);
if (diff > 6) {
digitalWrite(LED_OUT, HIGH);
}
else {
digitalWrite(LED_OUT, LOW);
}
Serial.print(diff, HEX);
}
Serial.println();
}

It took me about a month, but I finished building my dulcimer around May of last year, and it turned out really nice! I've been playing for almost a year now and really having a great time with it.

Here's another photo of it, hanging next to the one my dad made as a wedding gift for my mom in 1964.

Between them is an experimental one I made from HDF (hardboard). I wanted to know if I could make one completely from laser-cut pieces.

The answer is yes, but that HDF is a lousy tonewood. I ended up bandsawing it in half in a fit of frustration and discovered it makes a very nice wall hanger.

Here's another one of the HDF dulcimer.. I love the design of it, my next real dulcimer will look very similar, but I'll use a pegbox more like the one my dad made (like on the teardrop dulcimer above).

Here's a copy of his 1962 (second edition) pamphlet, "The Mountain Dulcimer, how to make and play it (after a fashion)", which he has generously given me permission to post here for public consumption.

This pamphlet is the basis for the 1965 Folk Legacy book & album of the same title, but there are many differences between the two.

The Mountain Dulcimer, 2nd ed.

I had a nice long chat with Caroline Paton (of Folk Legacy Records) and she has generously given permission for me to publicly share a PDF of the Folk Legacy book, "The Mountain Dulcimer - How to Make it and Play it (after a fashion).". This is a significantly revised and lengthened version of the pamphlet, with a wonderful companion recording.

The Mountain Dulcimer - Part 1

The Mountain Dulcimer - Part 2

The CD is still available from Folk Legacy's website at:
http://www.folk-legacy.com/store/scripts/prodView.asp?idproduct=58

The books, CDs, and original LPs are also pretty easy to find on eBay and Amazon.

The pamphlet focuses on the 3-string dulcimer and has quite a few more specific measurements than the book. The book mostly covers the 4-string dulcimer, but discusses a number of variations.

Enjoy and share with the blessings of Howie, Ann, Caroline and myself. I just love the way he encourages experimentation and presents the topics in such a clear and light-hearted fashion, it should appeal to most anyone with a creative streak, even if you never plan to actually make, or play, your own dulcimer.

I recommend both!

And yes, I finally decided to try building one for myself. Here's what mine looks like so far

This first view is of my workbench with scope, logic analyzer, reader & tag, and a few of my homemade tags.

Here's a closeup of the reader itself. The USB cable and antenna are the only connections required. The LED flashes every time the code recognizes the "triple-0" tag header sequence.

I have my 4 scope probes hooked up to the following signals from bottom to top.

First is a closeup view of just a couple of bits from the signal, showing the bits modulated with the 125khz carrier.

4) This is the antenna input signal after passing through the detector diode, low-pass filter, and decoupling capacitor.

3) The noisy line near the top of the antenna signal is the threshold voltage, which is adjusted manually to a couple hundred mV via a simple potentiometer / voltage divider. These two signals are fed into the AVR's built-in analog comparator to produce interrupts whenever the antenna signal rises above the threshold.

1) This the raw manchester-encoded signal from the tag as output by the detector code. It's composed of sequences of 5 possible signals, "short low", "double low", "triple low (this is the start-flag)", "short high", and "double high". You can see the how the trace echoes the signal in the antenna, delayed by 1/2 the length of a "short", which is how long the timer takes to detect the end of a high or low.

2) The topmost trace is what I use for triggering the scope, it's always low except when the tag header (000) is detected.

The next view is zoomed out a bit, showing the trigger pulse on channel 2, and the first 8 or 9 bits of the signal on channel 1.

Here's the two logic signals as seen via the Saleae Logic, and underneath are the (slightly obscured) decoded tag values output to the serial port.

Here's the schematic:

And, last but not least, the code itself (This is Arduino code for Teensy 2.0)

I designed all but the antenna in Eagle and exported to EPS, then imported into Make-the-Cut. The spiral antenna I created using Inkscape spiral tool, then cut-and-paste into Make-the-cut, and just rotate and move so the traces connect.

I draw a rectangular bounding box around the circuit and put into a separate layer, which I print first onto a piece of paper taped on the cutting mat. This shows me exactly where to place the blank circuit board.

Next I tape the circuit board to the paper using masking tape at the very edges only. I snipped off one of the grey friction rollers so it doesn't roll back and forth over the design and ruin it while the ink is still wet.

I remove the Expression keyboard to make room for the pen, and wrap a long thin strip of duct tape around the pen close to the tip to make it big enough for the tool holder to grip. I "cut" (draw) from Make-the-Cut at Extreme speed, low pressure, and etch in the usual way.

The experiment was very successful in that I was able to get pretty reliable traces in two sizes, roughly 0.5 and 0.8 mm, plenty for a sporting shot at surface mount stuff.

Unfortunately, while a magnet-wire coil produces upwards of 10v peak-to-peak, I can't seem to get better than 850mV or so across the pcb coil leads, regardless of my choice of tuning capacitor, so for now running the Tiny85 is still out of the question.

The two antennas have about 25 and 45 turns respectively, but so far I've been totally unable to get them tuned to produce enough voltage to run the AVR.

I've been probing the tag coil across the capacitor leads while the tag is being stimulated at 125khz with my homemade reader.

The second antenna is pushing the resolution limits in the spiral because the "jaggies" from the machine reduce clearance between lines. I had to do a little cleanup work with a razor blade, separating adjacent lines that had shorted in a very few places.

Cricut Repair Info

One way to get yourself a cheap Cricut machine is to buy a busted one off eBay. Try searching for both "broken cricut" and "defective cricut". Often you can win one for as low as $0.99 plus shipping for a Personal or Create model, or somewhat more for an Expression.

Where to get one

The main dealer of these machines, "websbestdeals," must have some exclusive arrangement with PC, because they seem to have a pretty inexhaustible supply of broken machines to sell.

Have patience and don't get carried away with your bid, it seems there will always be more listed within a few days.

Read the seller's description carefully to see what is included. Usually (but not always), they only include the power supply, but sometimes it comes with everything, cutting mat, blade holder, power adapter, cartridge, overlay and even the manual and warranty card. Once in a while they'll sell two for one, but missing one or both power adapters.

Sometimes the seller's description will tell you exactly the issue, as in the case with a dragging blade. I'm not quite sure yet what it means when "the blade makes a lot of noise", but the broken limit-switch wires definitely cause a horrible noise on startup. Many times they simply say "it has no power," which so far often (but not always) indicates a power supply or broken trace problem.

Mine didn't come with a cartridge!

If you don't have a real cartridge, you can make yourself a "Fake George" to at least get a machine with the stock firmware to start up fully. More details here. Basically, you just need to (carefully!) make something that will short together pins 4, 6, and 10 (or 11, 15, and 17) on the cartridge port, to fool the machine into using its own built-in "George and Basic Shapes" cartridge.

Here are some close-up photos of what a real "George" looks like inside.

Removing the Side Covers

Don't rush to take the sides off the machine. Many times this won't be necessary, and it's hard to get the trim pieces off without doing at least cosmetic damage.

The way I do it is to use a thin bladed putty knife to get in between the trim and side cover (from the outside edge inwards), while pulling outwards with your other hand, to depress the little fingers that clip the trim piece on, one at a time. I've broken off quite a few of them with poor technique, but don't usually bother putting them back on anyways.

Once the trim piece is off you can get access to the 5 or 6 phillips-head screws holding the actual side cover on.

Accessing the Motherboard

Usually all the action happens in the bottom of the machine where the motherboard is located.

To access it, all you need is a long #1 phillips-head screwdriver. Roll the machine onto its back on a towel or something else soft, and remove the 8-or-so most obvious screws around the outside of the bottom cover. Then, tip the cover down and towards yourself like opening a panel. If you carefully tug a little on the wires leading up into the side covers you can get just enough slack to be able to rest it flat on the table while the machine is still on its back.

Problems and Solutions

Here are some of the things I have discovered so far while fixing a bunch of these machines:

Schematic

I don't have a schematic drawn up for these, but one of my Creates is an older model with only a 2-layer board. This makes the circuit far easier to figure out than the 3-layer boards that came later. The Expression board is nearly identical, so this should be of assistance for figuring out those issues as well.

Here are close-up photos of the full front and back side of the 2-layer Create board.

Broken Dials

It seems the dials are pretty easy to break if the machine falls onto its front side. The size dial is expendable if you use Make-the-Cut or other cutting software on your PC, but if you cut with cartridges or the pressure dial is broken you may not have much choice but to try and find a replacement dial.

Bad Power Supply

An Expression I got with a bad power supply would constantly turn on and off, like a turn signal on a car. On, off, on, off. Replacing the power brick with a known-good one from another machine solved the problem.

Broken Inner-layer PCB traces

So far, two Create machines have been suffering from broken traces in the middle layer of the circuit board. Fixing these can be challenging since you can't see the inner layer to know where it was supposed to connect to.

Fortunately, I have a working older revision of both Personal and Create motherboards that are only 2-layers, and there were virtually no changes to the parts connections or positions when PC switched to the 3-layer boards. This means you can visually trace the connections on the older board, and verify those connections on the newer (broken 3-layer) one.

I will be adding specifics here to help with this process for anyone who doesn't have the benefit of a 2-layer board for reference.

1) One machine's power button would light up when you turned it on, but nothing else would happen. This was isolated to two broken inner-layer traces leading from the 5V regulator to two nearby parts.

Edit 4/28/2013:

At long last, I took a photo of the repairs for the "broken inner-layer traces" issue.

First photo shows the front of the board. The broken traces connect one of the inductor leads (circled) to the 5v voltage regulator and to the large capacitor below it.

This next photo shows where the jumpers were placed. Your mileage may vary, but this got mine working.

2) Another Create model would power up and boot fully, but the display would be either blank or show only a single line of pixels. Swapping out the display for another known-good one did not have any effect. This turned out to be a broken +5V power supply line to the OLED display connector. (pin 2, counting from the end with the red stripe). I repaired this one by adding a jumper over to the +5V power supply line on the keyboard connector an inch away.

Disconnected Cables

One expression, when you pushed the power button, would light up, but instead of booting would just beep three times and halt. This turned out to be simply a disconnected keyboard cable. The fix was simply to plug the cable back in to the motherboard.

Broken Limit Switch wires

Two different machines had this problem - they would start up okay, but when the carriage would slide all the way to right, it would crash at the end and make a horrible grinding noise. This indicates a problem with the button located in the right-side hidey-hole or the wires leading to it.

Upon removing the right-side cover, I discovered in one case that the pair of wires from the limit switch had been severed by the sharp edge of the metal motor bracket inside. Repairing the wires solved the problem. In another case, one of the wires had simply fallen off the switch, and I was able to just plug it back in.

Broken Solenoid wire

One Create would operate normally, except the cutting blade would not go up and down at all. Removing the carriage cover revealed the problem to be a broken solder joint at the top of the cutter solenoid. Space is pretty tight, but I was able to solder a short length of wire between the broken lead and the stub on the solenoid to fix this problem.

Blade Dragging

This problem seems to be one of the most common, and the easiest to fix as well. The machine seems to operate normally, except that the blade drags in some places, cutting where it shouldn't, and hangs up in some places, not cutting where it should. Normally, the blade holder should move smoothly up and down. You should be able to push it down with no friction detected, and when released, it should move smoothly and freely back upwards.

In some cases, the lower of the two leaf springs in the cutter solenoid mechanism can get bent, causing a slight misalignment, which creates friction that causes the observed "dragging" behavior.

The fix for this is about the simplest of all: remove 3 screws covering the cutter carriage, and simply pinch with your fingers the upper and lower leaf springs together at the right hinge point. (Where the red circles are in the photo below). This should straighten the bent lower leaf spring and free up the movement.

Replacement Parts

The power brick is an 18v 2.5A switching power supply with a pretty standard cord end, so you could probably find something compatible, but you can get the real thing from PC itself for $9.99.

If you're looking for used parts, Here's one place you could try, or Here's another

I'm not 100% certain, but the US Cutter Refine carriage looks identical from the photo.

Unsolved Machines

I have several machines that I have not yet repaired.

One is a Personal model that will often fail to boot, and show only dark squares on the LCD screen. It was described this way to me before I got it, worked fine upon receipt, but then stopped working again soon after.

Another is an Expression that, when powered on, the power light comes on, but nothing else, and the 5V regulator starts to get very hot. Although replacing the regulator may be the solution, I want to be sure the problem wasn't caused by something else.

(two other Personals have not been checked out yet).

It was failing several of the power-on self tests with some mysterious errors like "FAIL ++ Acquisition" and "FAIL ++ Attn/Acq interface". After my successes repairing Cricuts and resurrecting my first $20 analog scope with a bunch of Deoxit spray I figured I'd get my money's worth of entertainment out of it.

Googling the subject quickly revealed this as the inevitable consequence of "Capacitor Plague." It seems the original SMD electrolytic capacitors all end up leaking corrosive gases and goo onto the circuit boards, which, if not cleaned up in time, eventually results in assorted broken vias and board traces. The visible result of all this is these failed self-tests.

The Tektronix Community Oscilloscope Technical Support Forum, fortunately, has accumulated quite a few threads over time with information and various troubleshooting & repair tips for this issue.

So after a couple of months of building up my courage, buying a ESD-safe temp-controlled iron, antistatic work mat, and desoldering "hot tweezers", I was ready!

I started out by practicing desoldering and resoldering a bunch of similar SMD caps on a handful of old busted PC graphics cards from the pile on the hack shelf.

Removing all the old caps turned out to be pretty easy. As it turns out, and it's hard to believe this until you try it out, the best way to remove the old parts is actually to press down and gently wiggle the part right off. The copper leads work-harden and snap off without stressing the underlying solder pad one bit. After I learned about this method I practiced it a dozen times to prove to myself that it was actually the LEAST damaging way to get them off there. (The corroded old solder doesn't take heat well).

Fast forward to last week, I'd ordered in and received all the new capacitors and was ready to dig in.

After removing all 100 or so old caps on 3 circuit boards, the next thing was to use a combination of solder sucker, iron, and desoldering braid to remove all the old solder and remnants of broken leads, leaving the solder pads as clean as possible.

Once this is done, you super clean the entire board with a toothbrush and full strength Simple Green, rinse in the sink under super hot water. Bake in the oven at 125 degrees for an hour or two, followed by an Isopropanol rinse, and another overnight drying period in a warm place.

The resoldering process follows by putting some flux on all the solder pads, and melting a little pillow of solder on each one. Since the caps are polarized, you need to take care to orient the new one properly, but on this scope the process is super easy because nearly every single one is oriented in the same direction, and all but one pad is marked with a +.

Soldering the cap goes like this: use the iron to melt the solder pillow on one pad, and, just using your fingers, hold the cap in place. Touch the iron to the lead and stay long enough to make sure it bonds properly (too quick and you'll get a cold-solder joint). The cap will be attached on one side now, and slightly cocked due to the unmelted pillow under the other lead. To finish soldering, just press down lightly with one finger while heating up the lead. When the solder melts, you'll feel the part move downwards until it's fully seated on the board.

Now, just repeat this process 100 times It sounds like a really big job, but after the first few dozen it goes very quickly. The whole process excluding drying time only took a few hours.

At this point, I was eager to fire up the scope and see if those darn errors went away. Annnnnnd... no change! Arrgh!

Going back to the Tek Forum, I learned that the reason for this was almost certainly due to some combination of corroded vias, broken traces, or fried components.

The way to start finding these is to use the voltmeter and, with the machine running, carefully check the voltage across all the capacitors and make sure they are all about 5 or 15 volts. Similarly, check the voltages across the power & ground leads to all the dozen or so opamp chips on the board to make sure they are also similarly valued.

In my case, I found one opamp chip with a bad ground, and one capacitor with only 1 volt across it instead of 5. Both problems ended up being due to a broken via, and were fixable by carefully determining exactly where the broken lead went to and soldering on a tiny little 30-gauge jumper wire to bridge the gap. (tracing the connections can be a little tricky with a multilayer board like this)...

After a couple rounds of probing and probing and installing the two jumper wires, I fired the scope back up... and YES, the self test passes completely now, and the formerly failing Signal Path Compensation routine also passes.

http://iteadstudio.com/store/index.php?main_page=product_info&cPath=16&products_id=220

here's the code:
http://code.google.com/p/rfidsniffernano/

Even after reading up on Manchester encoding from a number of sources, and reading Beth Scott's reader code & comments, I still just couldn't quite understand how to do the decoding.

My biggest problem with the reader code from part 5 was that I was only detecting the lengths of the LOW periods, but not the HIGH periods, so I was only getting half the bits.

Secondly, after a hint from a RFID reader IC datasheet (http://www.125khz-rfid-reader.com/how-the-driver-works/how-the-driver-functions), I realized I also didn't have to muck about with detecting both rising and falling edges as various other literature indicated.

"Using a clever detection method the driver only needs to detect each rising edge to determine the preceeding bit states, reducing the interrupt burden on the main application. Also only detecting each rising edge removes issues of dealing with non perfect high and low widths within each cycle – being radio they are often not perfectly 50/50, but the overall bit frequency will be relatively accurate."

At this point, I was logging the timer value for each rising edge to the serial port so I can get a look at what exactly was being received. Just as a picture tells a thousand words this text file pointed me towards what to do next.

Here's a piece of the log where I've manually annotated the lows and highs to indicate short or long lows and highs. (0 is a short low, 00 is a long low, 000 is a "triple low," which occurs only in the tag header. 1s indicate the length of the highs similarly).

Basically, the lows are easy, they're always around 900-1000 'ticks' for a short, and around 1500-1600 for a long. A triple long low is around 2500.

The highs are a little trickier. Since the carrier is pulsed, we get a rising edge every time the carriers rises above the threshold value. These show up in the log as multiple entries around 150 ticks in duration. A "short high" gives about 4, a "long high" is about 8, and a "triple long high" (seen right after the leading 000) gives about 14 of them.

180:2585 000
181:152
182:153
183:152
184:153
185:152
186:153
187:152
188:153
189:151
190:154
191:152
192:153
193:152
194:153 111
195:919 0
196:153
197:153
198:153
199:152 1
200:1065 0
201:152
202:153
203:152
204:154 1
...
235:1671 00

One additional tricky part was figuring how to detect the end of a "high" period, since the event trigger only gives rising edges, meaning I don't know the High is done before I reach the end of the Low period immediately after. To solve this, I added an Overflow interrupt handler to my input capture timer, set to a length of 200. This ensures that the overflow interrupt will always fire as soon as "no more rising edges" are detected in a sequence.

A problem I'd been having all along at home had been viewing the received signal on my analog non-storage oscilloscope due to the inability to "pause" the display, or accurately trigger on the beginning of the tag signal.

However, this was solved once I was accurately able to detect the "3T low 3T high" tag header in my code. I enabled a second debug pin and toggle it on and off each time I detect that sequence. This now finally allows me to accurately view the received manchester bits on my scope.

I still didn't quite get the idea of reconstructing the data clock, but after finding this forum comment and having a long chat with Danny at the hackerspace, I finally had my decoding approach:

http://www.sonsivri.to/forum/index.php?topic=20972.0

Basically, two things you need to do are to:
A) accurately determine where the message begins. Looking at the data, I realized there was a repeating 3T low followed by a 3T high. Since Manchester encoding forbids any high or low longer than 2T, this was clearly our header signal. Thus, the first rising edge after our 3T high marks the beginning of the actual data stream.
B) decode the 0s and 1s into the original data bits. In my case, the expanded representation of the "shorts" as 1 digit, and "longs" as two digits effectively reconstructs our clock signal, and lets us decode the stream by simply interpreting every received "01" as a data "0", and every "10" as a data "1".

Finally once you have the actual data bits, you have to convert them back to the card values, which for HID means the first 20 bits contain the "Manufacturer Code" (always constant), then 8 bits of "site code", and finally 16 bits of 'card code' and a trailing parity bit.

This is where the code stands right now. I can read both my badges pretty reliably, but the threshold voltage is still manually adjusted which limits the read distance to a very narrow range.

Next steps, I want to:
- implement a dynamic threshold voltage via PWM,
- display the decoded digits via LCD, or at least flash a LED on successful read.
- start spoofing the digits
- design a PCB and begin to package this thing

0000000000000000

100011 001100111011000000 1000000000100 11000110011101100000001000000000100011000110011101100000001000000000

100011000110011101100000001000000000100011000110011101100000001000000000100011000110011101100000001000000000

10001100 01100111 01100000 00100000 00001000 11000110 01110110 00000010 00000000 10001100 01100111 01100000 00100000 0000

100011000110011101100000001000000000100011000110011101100000001000000000100011000110011101100000001000000000

100011000110011101100000001000000000100011000110011101100000001000000000100011000110011101100000001000000000

100011000110011101100000001000000000100011000110011101100000001000000000100011000110011101100000001000000000

100011000110011101100000001000000000100011000110011101100000001000000000100011000110011101100000001000000000

100011000110011101100000001000000000100011000110011101100000001000000000100011000110011101100000001000000000

100011000110011 0110000000100000000 1000110001 00111011000000 1000000000100011000110011101100000001000000001

00011000110011 0110000000100000000 1000110011 00111011000000 10000000001 0011000110011 0110000000100000000

100011000100111 011000000010000000001000110011 0011101100000001000000000100011000110011101100000001000000000

100011000100111 01100000001000000000100011000110011101100000001000000000100011000110011101100000001000000000

1000110001100111011000000010000000001000110001100111011000000010000000001000110001100111011000000010000000001000110001100111011000000010000000001000110001100111011000000010000000001000110001100111011000000010000000001000110001100111011000000010000000001000110001100111011000000010000000001000100011001110110000000100000000010001100011001110110000000100000000100110001100111011000000100000000010001100011001111100000001000000001000110001101110110000001000000000100010001100111011000000010000000001000110001100111011000000010000000001000110001100111011000000010000000001000110001100111011000000010000000001000110001100111011000000010000000001000110001100111011000000010000000001000110001100111011000000010000000001000110001100111011000000010000000001

This is what my reader is writing to the serial port now.

As before, the analog comparator is connected between the analog threshold voltage and the antenna signal.

The input capture interrupt function now toggles the LED and debug pins, and writes a 0 or 1 to the serial port, if the time between the last falling and rising edge from the analog comparator output occurred in one of two ranges of time. i.e, 250-1100 ticks right now for a "short", and 1101-3499 ticks for a "long".

Based on my previous reading I think I have to actually be timing how long since the last rising edge* - the catch is that the "high part" of the signal is actually constantly toggling at 250khz (every rising and falling analog comparator edge), so I have to be able to ignore the very short-duration low periods to properly time the "high part". Maybe if I just check the low period duration and don't reset the timer if it's too short, effectively filtering out the higher frequency component of the signal.

I've had a great time trying to view the signal on my analog scope. I connected one probe to the raw, rectified, a/c coupled antenna signal,  and the other probe to the debug pin on the Teensy.

Using the coarse and fine timebase controls on the scope, triggering on the debug pin, I can zoom out far enough to see the entire signal from the card. Since the signal is constantly repeating, I can get a static and unique "image" of each card's bitstream.

Playing with the potentiometer on the threshold voltage, I discovered that the ideal threshold voltage is directly related to how far away the card is. The further the card, the lower the threshold voltage.

The "depth of field" of the "best" threshold value is surprisingly low as well. Holding the card at a constant distance from the reader, I turn the knob back and forth, watching as the bits in the "bit picture" on the scope eerily flicker in and out of view, locked horizontally, but flickering more and less depending on the error rate.

Sorry, I thought I took a cellphone picture of it but I must have not hit "save" before closing the phone. I hate when I do that.

The best, most rock-solid signal is obtained (not surprisingly) when the card is laying right on the wood of the reader coil. At the best threshold setting, it reads the card only up to about a half inch from the wood.

However, by re-tuning the threshold voltage for various card-to-reader distances, I can manage to successfully lock onto the signal from up to maybe 4 inches away.

Clearly, a dynamic threshold voltage tuner seems like a worthwhile upgrade for maximum read-range flexibility.

Something else interesting that I noticed, the cards are nearly "one-sided." That is, when I flip the card over, I can only barely see the signal, probably not well enough to actually read it. My work badge is a different type of HID card and doesn't seem to have that behavior. I'll have to see if the reader on the hackerspace door does the same thing.

Back to the bits. I was really eager to see what my serial bitstream looked like, if it was repeating, the length, and so on.

Opening the log file in my text editor, I played with trying to line up sections of the text to find a repeating pattern, and its length.

Sure enough, I discovered one on each of my two hackerspace cards! But, oddly enough, the number of bits doesn't seem to match up with the expected number.

I've realized that I don't really know what encoding is being used.

From Scanlime's blog, I read that "... Cesar Fernandez described the HID card format ... The 45-bit code"... ; but in my text file, the two visually identical cards appear to give slightly different-length repeating bitstreams. (36 & 38 bits)

00000000 10001100011010000100100000001
00000000010001100011010000100100000001
00000000 10001100011010000100100000001
00000000010001100011010000100100000001
00000000 1000110001101000 100100000001
00000000 10001100011010000100100000001
0000000001000110001101000 100100000001
00000000 10001100011010000100100000001
0000000001000110001101000 100100000001
0000000001000110001101000 100100000001
00000000010001100011010000100100000001
00000000 1000110001101000 100100000001
00000000010001100011010000100100000001

Lining up the repeating rows, and adding spaces where there were missing bits, I realized that the errors nearly all occur in the same places in the signal, and so I must have a slight misalignment in my time window lengths between 0's and 1's. I'll probably have to increase the timer1 prescaler from /8 to /1 to increase the resolution my cycle counter, and create a bigger difference in values between "short" vs "long".

If the card is using around 4 "low antenna cycles" to mean short, and around 8 to mean long, I had expected that a /8 timer would give me plenty of resolution (1 timer tick per 8 16mhz clock cycles, 16 per 125khz antenna cycle, 64 timer ticks per "4 low antenna cycle" 0, and 128 ticks per 1.

However, in practice, my window sizes are currently set at 4 and 10 times larger than this, based on just experimentation and observation of the output. I think what this means is that the encoding is not quite what I'm picking up, and I'm actually reliably missing 9 or 10 bits of the true signal.

Here's my latest code.


#include <avr/interrupt.h>
#include <avr/io.h>

void loop()
{
}