TI Training home
Anti-tamper techniques to thwart attacks on smart meters
Detecting case tamper attacks using inductive switches Detecting case tamper attacks using inductive switches: Case tamper detection implementations
Anti-tamper techniques to thwart attacks on smart meters
2.1 Detecting case tamper attacks using inductive switches: Case tamper detection implementations
The first line of defense against tampering by bypassing current or connections and disconnecting leads, is the meter case. As a result, it is common for utilities to acquire some form of intrusion detection system to detect when someone opens a case.
In this section, we will cover, how do you detect someone trying to open the case of a meter? For this section, we will provide details on previous mechanical implementation, its disadvantages, as well as a new way to detect case openings using inductive switches.
Because the case is the first line of defense against tampering, it is common for utilities to acquire some form of intrusion detection system to detect when someone opens a case. Not only is this case tamper protection functionality seen in e-meters, but it's also applicable for gas meters.
The case tamper detection solutions are typically mechanical solutions, where a post on a case presses down on a push-button that is connected to a GPIO pin. When someone opens the case, the post will be removed from pushing down on the push-button, causing the status of the GPIO pin to change states, which alerts the microcontroller of the case tampering attack.
One issue with this mechanical implementation is that the bun's could get stuck, thereby preventing the case tampering protection functionality. In addition, there are ways to tamper with the push button to prevent it from registering that the case has been opened. Also, the push-button implementation can be only used to detect case openings near the side of the board where the push-button is located. It may be possible to only partially open the case at a location far from the push-button, for this opening not to be detected.
One alternative to the mechanical implementation of case tamper protection is to instead use inductive sensing. This can be implemented by using the LDC0851 [INAUDIBLE] comparator. The LCDC0851 works by creating an AC current flowing through inductors, to generate an AC magnetic field. If a conductive material such as a metal object is brought into the vicinity of one of the conductors, other magnetic fields will induce a circulating current on the surface of the conductor.
The eddy current is a function of distance, size and composition of the conductor. The eddy current generates its own magnetic field which opposes the original field generated by the sensor inductor. By opposing the original field, the original field is weakened. This produces a reduction inductance compared to the inductor's free space inductance.
The LDC0851 compares to inductiveness of a reference coil and sense coil. The output switch is high or low, depending on which coil has less inductance. The switching point is at the point where the reference sense calls have the same inductance. As an example, if a target metal is already near the sense coil without there being a similar metal near the reference coil, and the metal is removed from near the sense coil, the inductance of the sense coil would increase. Once the sense inductance is greater than the adjusted reference inductance reading, the output will switch from being low to being high.
The TIDA-01377 TI design showcases using the LDC0851 for detecting the opening of an e-meter case. There are certain advantages in using this inductive base case tamper protection implementation.
First, compared to a system where a combination of a Hall effect sensor and magnet are used, there's an advantage in that it does not require a magnet. The main items that are necessary are the inductors, which can be fabricated onto the PCB of an e-meter, as well as the target metal. In addition, it is immune to DC magnetic tampering, which is an issue for e-meters.
Compared to traditional push-button implementations for case tampering, the solid state switching of deductive switch eliminates the failures due to the mechanical switching of the push-button implementation.
Also with the LDC0851, it is possible to configure the system to sense openings at multiple locations of a case, using only one LDC0851, by having multiple coils in series. This could be used to detect opening both turn block cover as well as the main cover. By placing sensing coils at the diagonal corners of the case, you could also maximize the coverage area of sensing across the perimeter of the case.
In addition to the LDC0851, the design also use a M230F677918 microcontroller, that has an internal RTC with capture pins that will log the time of case happening.
The microcontroller also provides the necessary enabled pulses that are used to enable and disable the LDC0851 to reduce the current consumption. This reduction of current consumption is important, because when there is a power outage, the system runs off of a backup battery. So by reducing the average current consumption, this would allow the system to maximize battery life when running from a battery.
By [INAUDIBLE] the LDC0851, the current consumption of the LDC0851 could drop to below 2 to 3 microamps, for a sampling rate of 1 Hertz. In addition, the microcontroller provides the power source for the LDC0851. This power source has support for backup battery, so that the LDC0851 could effectively be powered from mains when it is available, and automatically switched to a backup power source when it is not available.
Going into more details on the LDC0851, this slide shows the LDC0851 sensor components. The LDC0851 sensing circuitry primarily consists of the LDC0851 ducted switch core, which drives the sensor inductor, reference inductor, and total capacitance. This total capacitance is the sum of the parasitic capacitance from the l.com pin, the parasitic capacitor from the PCB, and the discrete capacitor.
The parasitic capacitor from the l.com pin is 12 picofarads from the data sheet. The board parasitic capacitors could be found by measuring the capacities of the PCB when it has no components populated. The sensor capicitance is selected by the user, as a way to adjust the total capacitance.
One constraint from proper operation of LCD0851 is that the total capacitance must be greater than 33 picofarads. There is a similar constraint for the sensor inductance, in that the sensor conductance should be greater than minimum inductance value as defined by the form of a center, where the value for ISENSOR_MAX could be found in a data sheet.
Total capacitance along with excess inductance, determine the frequency of the sensor. The formula on the top right shows how to calculate this sensor frequency, which must be less than 19 megahertz for proper operation of the LDC0851.
April 12, 2017
This module covers the traditional mechanical implementation for determining when someone opens the case of a meter. The limitations of this mechanical case tampering implementation are discussed as well as a new inductive switch based implementation that uses the LDC0851 to address the shortcomings of the mechanical implementation. Details on the basic operation and reference design of the LDC0851 will be provided in this module.