Macetech’s ChronoDot is a Real Time Clock module for projects requiring highly accurate time keeping and measurement. The ChronoDot uses the DS3231 chip, which features a TCXO to compensate for variations in temperature which affect normal oscillators, like the ones in most microcontrollers. The DS3231 uses simple I2C commands and registers for storing and retrieving time, but also features a variable output that goes all the way down to 1.000 hz for low power, interrupt style timekeeping applications. With the provided watch battery, the ChronoDot can keep time in idle mode for up to 8 years.

Normally the ChronoDot comes mostly assembled, requiring you to only solder on the watch battery. However, due to a manufacturing mistake, Macetech is selling a version with the header pins on the wrong side they call the ChronoDoh. This module is currently nearly half off the regular price of $14.99, which makes it a great low cost addition to a project. Macetech has sent us a couple of these modules to demonstrate how functional they still are.

Because of this mistake, using these parts as a breadboard tool is made a little bit harder, as the silkscreen pin names are only on the “top” side. However, if a project is designed around this part, or if alternate tools such as a wire ribbon or probes were used, this problem would disappear. It would also be possible to desolder the header pins and remount them, but there is always the possibility of lifting the pads, or otherwise causing damage to the parts whenever desoldering is involved.

We set up one of the ChronoDoh modules as demonstrated, and pinned out the I2C connection using a “right side up” ChronoDoh as reference. The Dot must have an external VCC signal to respond to I2C commands, and will only silently keep time when powered by the watch battery. For the ChronoDo(h/t), sample Arduino code and schematics are provided on Macetech’s website, making initial set up and testing a breeze. We used a Teensy++ running the Teensyduino loader to simplify the process. The sample code simply displayed the time reported over I2C by the Dot, which seemed to be the time since the Dot first received 5V power (when it was most likely initialized). The chip reported that the time was 00:01:55, which meant that it was time to update the registers. Unfortunately, this is where the sample code leaves off, though the provided documentation does provide a list of all of the relevant registers (page 11 of the datasheet).

After setting the I2C registers, the ChronoDoh was correctly keeping time, so we decided to test the accuracy. We set up the other module, put it in our freezer for a week, then tested the two against each other. Wonderfully, they both reported identical times. Though unscientific, this is backed up by the ongoing accuracy test by the makers of the DS3231, which claims an accuracy of “± 2ppm at 0C to +40C (~1 minute per year)”.

These breakout boards are a great way to test out this chip, which has tons of applications, on an easy to use breakout board, which is what Macetech does best.

Hack a Day review disclosure: Macetech gave us a couple free ChronoDohs to review for this post.

On the privacy side, FasTrak claims that all the collected data is anonymized and not kept for long (they won’t tell you how or how long). The court system still subpoenas the data from time to time, so there must be something of use in there. As AOL taught us, user behavior is incredibly hard to anonymize. In addition to the toll booths, the transponders are also polled at all offramps for the statistical traffic data presented at 511.org.

[Nate] initially purchased a transponder to explore these privacy concerns. The transponder is an RFID device with a receive and transmit antenna, a low powered Texas Instruments MSP430 microcontroller, a long life battery, and a large analog demodulation section. Usually the firmware on the microcontroller can not be read via a JTAG cable, because the manfacturer will burn a fuse to prevent it. This was not the case with the three year old tag he purchased. A more recently purchased tag did have the fuse burned. Flylogic repackaged that silicon so it could be read back; the firmware turned out exactly the same.

The transponders and readers perform no authentication. Someone could wander through a parking lot with an RFID reader and pick up the ID of every tag in the lot. They could then write their own transponder with the stolen IDs. Here’s the really bad part: the transponders support unauthenticated over the air upgrading. You can force any transponder to take on a new ID. An attacker could overwrite every tag passing a certain intersection and cause havoc in the toll system. Some have suggested that there are IDs in the system that are unbilled, since they’re assigned to administrators; these would be especially attractive to thieves.

How do we fix this system? Here’s the problem: the system is defined by California law. An update to the way things are done would take legislative action. [Nate] suggested one possible check that could be implemented to determine if the system was being exploited at this time: When a tag read fails now, the system takes a picture of your license plate so a human can determine what account it belongs to. The system could be updated to randomly take photos of cars that were reading correctly just to make sure the ID belongs to the car pictured.

As for the privacy issues, [Nate] is hoping to develop a timer circuit so you can power up the transponder only during the time you’re passing through the toll plaza. In the end though, none of the transactions with these FasTrak transponders can be trusted.

[photo: 24thcentury]