Smart Track vs Smart Tech

Disassembly, Products,

I spent a little bit of time analyzing the RFID technology behind Smart Track and Smart Tech this week. Smart Tech is BRIO’s current generation of RFID-enabled engines, released in late 2017 in Europe before making its way to the U.S. the following year. Smart Track was first released in 2005, and to my knowledge was not available in the U.S.

Note: Smart Tech Sound, released in late 2020, is a different product line that is more sophisticated than the first generation of Smart Tech.

The first question people ask is:

Are Smart Track and Smart Tech products compatible?

No.

A quick disclaimer: I am not an expert in RFID or digital signal processing. I know enough to talk at a high level, but that is about it.

The reason they are not compatible is that the two technologies use different RFID tags. The older Smart Track appears to use UHF (ultra-high frequency) tags and operates at around 909.033 MHz. The newer Smart Tech operates in the HF (high frequency) band at around 13.56 MHz.

Both are ARPT (Active Reader Passive Tag) systems. The tag reader is in the engine and it transmits an interrogator signal which also provides the power for the tag stored in the track (Smart Track) or tunnel (Smart Tech). The reader in the engine then receives the transmission from the tag and processes the signal.

Smart Track

The following waterfall and FFT plot shows the signal sent by the Smart Track engine while in operation.

Smart Track uses a UHF tag at roughly 909.03 MHz

From the late 1990’s through the early-to-mid 2000’s, UHF tags were fairly popular because they were, and still are, low-power and cheap. The problem with UHF, however, is that there is no single, global standard for radio waves in this band and thus regulations differ from country to country. In North America, the UHF band for RFID runs from from 902-928 MHz, but in Europe that band is between 865 and 868 MHz. As these two bands do not overlap, that means UHF tags made for one market can’t—or shouldn’t—be used in another.

What’s odd about Smart Track is that this is exactly what it seems to be doing: my engine is transmitting in the North America band, despite the fact that it was purchased from a seller in Germany which uses the European band for RFID. That poses an interesting question: are all Smart Track products operating in this North America band? If so, then they may be running afoul of broadcast restrictions when used in Europe. And if not, then there would potentially be a compatibility issue between Smart Track products that were produced for different markets.

I don’t have good tools for analyzing the RFID transmissions in the UHF band, but my best guess is that the tags used by BRIO are very simple and merely indicate what chip is present. The actions, and the sounds produced by the Smart Track engine, are stored in the engine, itself.

Smart Tech

Smart Tech uses the HF band at 13.56 MHz, which is a global standard for RFID. Using special hardware designed to analyze HF and LF tags, I was able to capture the following RFID transmissions.

The first image shows the “Station” tunnel, which tells the Smart Tech engine to stop and play a short sound recording reminiscent of a train station. As you can see, there is not a significant amount of data being transmitted, which implies that all the sounds and actions are stored in the engine.

RFID transmission for the Smart Tech “station” tag

Compare this to the next image from the “Reverse Engine” tunnel.

RFID transmission for the Smart Tech “reverse” tag

There is not a big difference between the two profiles (ignore the difference in the pulse amplitudes). This appears to be a very simple encoding scheme where each pulse represents a bit of data, transmitting about 36 bits total. In the “Station” tag, the transmission starts with 110101111, while the “Reverse” tag begins with 110111110. The trailing 01010101 is probably used for clock synchronization and an “end of data” marker.

The tag itself has pins A0 through A11, which implies there’s a total of 12 bits that make up the device ID. Simple tags such as these are very common in toys.

What this means

The implication here, for both Smart Tech and Smart Track, is that the complete set of engine behavior and sounds have been predetermined. Since there is no procedure for loading new data into the engine, the full range of products has to be decided upon before the engine programming is completed.

In theory, one could generate the above signals and transmit them to the Smart Tech reader. This procedure could also be used to probe for the full range of behavior supported by the engine.

A look inside Smart Track

Disassembly

With Smart Tech products out in Europe and soon to be released in the U.S., I thought it might be fun to take a close look at BRIO’s previous generation of this technology: Smart Track.

A disassembled Smart Track piece, showing the RFID tag and the protective plastic cap.

The RFID tag is not cemented down, but grooves in the translucent cover hold it in place. Two screws with tamper-proof triangle heads prevent children from (easily) taking it apart.

The RFID tag itself is a passive style, which means it gathers its power from the electromagnetic waves emitted by the scanner.

The RFID chip on the tag is covered with a ball of epoxy, which is kind of a bummer since that means we can’t really look at it without destroying it. However, there are eight electrical contacts exposed, which implies it’s got an 8-bit programming interface. Learning how to interact with that is an exercise for the reader.

The RFID tag manufacturer helpfully prints the date on the tag. My Smart Track tag was created on April 27th, 2004.

Smart Tech, in contrast to Smart Track, places the tags inside the “tunnels” that span the track. Depending on how those are made, it may be a bit harder to get at the RFID tag inside but I am sure someone, somewhere, will try. If it’s you that does it, drop me a line!

The right tools for the job

Disassembly, Restoration

To discourage disassembly by curious toddlers, modern BRIO toys use screws with a triangular head. This is great for preventing accidents with your child, but not so friendly for you whether you are trying to repair something or are just curious what’s inside. The answer is to get the right tools for the job: triangular head screwdrivers, which you can find on Amazon and eBay. I’ve found that most of the BRIO screws are a TA23, but get an assortment to be safe.

Inside the Freight Battery Engine

Disassembly

Ever wondered what your BRIO #33214 Freight Battery Engine looks like on the inside? (You do have one of those, right? If not, you should get one, as they are pretty great.) Back in September of 2015, David MacKay opened his up to try and repair what he described as “intermittent operation”, which he traced back to a faulty auto-start/stop switch. This is the green button that sticks out below the undercarriage. David’s blog has some nice pictures of the surgery, as well as a thorough description of what he did.

The single-axle assembly

Disassembly

Curious what the axle and wheel assembly looks like on the modern, rimmed wheel design? Here it is.

axel-assembly.jpg

The axle is a 32mm long shaft that is 2mm in diameter. The end caps snap in to the hubs of the plastic wheels, and then push on to the shaft. The four metal tabs on the reverse side grip the shaft ends, which are scored in four spots to improve the hold.

Removing the wheels without bending the shaft, damaging the wheels, or damaging the body is a challenge. You can use gentle prying to remove one cap, but this will bend the shaft at the wheel where you insert your crowbar. Ideally, you’d pull each wheel on the axle away from the body with equal pressure, so as to not put any pressure on the body and to ensure your force was aligned along the axle, until one popped off. But, realistically speaking, the tabs on the endcaps imply that the single-axle design is intended to be an install-only procedure. Disassembly for the purposes of restoration is an “at your own risk” activity.