A short code that identifies one manufacturer's product, for good
Q-UPID stands for Qualified Unique Part Identifier. Each manufacturer's product gets one code. The code carries no meaning of its own, so it does not change when a description is corrected, a distributor lists the product or an ERP system changes. A new part number or a different manufacturer name means a new Q-UPID. It checks itself, so a mistyped code is caught before it reaches a database.
The code is printed as text and as a 2D code. Scanning it opens this page, which asks the open API for the record and shows what the registry holds. The check on its own only confirms the code is correctly formed.
- Scan the code. The 2D code holds a web address.
- The datasheet opens. It shows the item, its identifier and its status.
- The check runs. The page recomputes the check character. A match shows the code is well formed. It does not show who made the product or that the record is correct.
Anatomy of Q-AC4F82M-3
The alphabet is . It leaves out 0, 5, B, I, O, Q, X, Y and Z, which are easily confused with other characters when read aloud or printed small.
Seven characters from 27 symbols give distinct identities.
Recompute the check character
Each character has a value (its position in the alphabet, from 0) and a weight. Values are combined as numbers in GF(27), the field with 27 elements: write a value as three base-3 digits, add two values digit by digit with no carry, and multiply by a weight with the rule in the reference code below. The seven identity weights are 17, 13, 23, 15, 5, 9 and 3, and the check character has weight 1. The check character is chosen so the weighted total is zero. Field arithmetic is used instead of ordinary arithmetic mod 27 so that no swap or repeated-pair error can cancel out.
Ask for the record yourself
GET /items/{id} is live and returns the same record this page shows. The validate and history requests are worked out in your browser here, from the same record. Separate API routes for them are planned.
Live address: https://q-upid.com/api/v1/items/{id}. A dedicated api.q-upid.com address is planned.
A history that shows tampering
Each event stores a fingerprint (SHA-256) of its own content plus the fingerprint of the event before it. Change any past event and every later fingerprint stops matching. The fingerprints below are computed in your browser now.
This chains the events but does not yet sign them. Signing with a registry key is the planned next step.
The validator in a few lines
JavaScript
Python
What the check catches
It catches every single-character error, every swap of two characters wherever they sit (including a swap with the check character) and every repeated-pair error such as AA typed as BB. These are the most common typing and reading mistakes.
One check character cannot catch everything. About 1 in 26 errors that change two unrelated characters passes the check (3.85%), and about 1 in 27 errors that change three characters passes (3.70%). These rates come from testing every such error pattern.
A matching check character shows that a code is well formed. A code the registry has issued shows REGISTERED here, with the manufacturer and part number it was issued for. Level 1 means the part number was checked against a published source: the manufacturer\u2019s own page for most codes, or, for codes issued from a distributor catalogue, that catalogue\u2019s listing, which the record names. The manufacturer has not yet confirmed it. Q-UPID is still a draft, and there is no signed certificate yet.