TI Training home
Anti-tamper techniques to thwart attacks on smart meters
Detecting magnetic tampering using hall-effect sensors Detecting magnetic tampering using hall-effect sensors: Tamper detection magnetic sensing design
Anti-tamper techniques to thwart attacks on smart meters
3.1 Detecting magnetic tampering using hall-effect sensors: Tamper detection magnetic sensing design
For anti-tampering it is common to try to detect the presence of a strong magnet. In this section, we will cover the use of hall sensors for low power detection of strong magnetic fields in three dimensions. Details on our magnetic tamper protection reference design TIDA-00839 will be provided, as well as some of the design considerations that are kept in mind when creating this reference design. One common way to deal with magnetic tampering is to first detect strong magnetic fields. This is commonly detected by using the hall effect sensors.
The TIDA-00839 TI design showcases how TI's DRV5033 devices could be used to detect strong magnetic fields in three dimensions. These devices are omnipolar, so they should detect that both the south and north poles of a magnet being applied to the hall effect sensors. The DRV5033 has a magnetic flux density operating point of plus or minus 6.9 millitesla.
So whenever the sensed magnetic field goes beyond this range, the hall effect sensor's output will be pulled low. Once the sensed magnetic field falls within plus or minus 3.5 millitesla, the output will be pulled to high. In this design, a MSP430F67791A device is used to log the time of magnetic tamper attacks. In addition, it does the necessary metrology calculations.
If a magnetic field is detected, then it would apply a penalty in metrology calculations. Since the DRV5033s may be powered by a battery if there's a power outage, it is important to reduce the average current consumption of these hall sensors. To reduce the average consumption of each DRV sensor, the power to the DRV5033 sensor is duty cycled by connecting or disconnecting each sensor's ground pin.
Also, another feature of the DRV5033 is that it has an open drain output. This allows the output of multiple hall effect sensors to be orged together just by connecting them directly. Therefore, if only one of the three hall effect sensors detects a magnetic field, then the shared output will be pulled low to indicate that a magnetic field has been detected. If it is desired to determine which hall effect sensor has detected a magnetic field, you could insure that only one hall effect sensor is turned on at a time and associate the output at a particular point in time to the hall effect sensor that was activated at the time.
Here we see a larger picture of the TIDA-00839 block diagram. In the design there are two sets of DRV5033 hall sensors where each set has three sensors. One set of hall sensors are placed near each CT, and other set is placed near the transformer, which is near the center of the UCC28910 base power supply. The hall sensors placed near the power supply transformer are oriented so that they could sense in three dimensions and are the primary sensors in the design.
All hall sensors in a set share the same GPIO pin, which is a way of orienting the magnetic tamper results since the outputs are open drain outputs. In addition, the ground pin of each DRV5033 is connected to a different GPIO pin, which would allow individually enabling or disabling the hall sensors. In the design, the MSP430F67791A device is responsible for driving the LCD in the system, calculating metrology parameters, interfacing to a PC GUI, keeping track of time, as well as powering the DRV5033 devices.
In addition to the DRV5033 and M030, this design also has isolated RS-232 communication. Through the use of the ISO7321 isolators, TRS3232 RS-232 line driver, and TPS70933 LDO. This isolated RS-232 is used to communicate metrology results to a PC GUI, as well as calibrating the board. Also, this board has an option to select a UCC28910 transformer based power supply, or a TPS54060 cap drop based power supply for providing the primary power to the board.
If there's an issue with one of these power supplies, such as a power outage, and there is an alternative power supply, such as a battery connected to the AUXVCC1 VVC1 pin, the MSP430 would switch the power to itself, and the DRV5033, automatically to this AUXVCC1 supply. The typical current consumption of one DRV5033 device is 2.7 milliamps, which is excluding the current consumption of the pull up resistor needed for the sensor.
This current consumption is too high to be powered from an alternative power source such as the battery. As a result, the power to the DRV5033 sensors are power cycled at a rate of 4 times per second in order to reduce the current consumption. The minimum turn on time for the DRV5033 sensor is 50 microseconds, which allows the average current consumption to be greatly reduced. To reduce the current consumption to be as small as possible, the time the DRV5033 is turned on should be set to approximately 50 microseconds.
When the chip is powered from an alternative power source, this application turns on a hall sensor for approximately 50 to 60 microseconds. When powering from DBC to simplified timing, the turn on time for the DRV5033 is increased to 240 to 300 microseconds. This increase in the on time does not have too large of an effect on the current consumption because the device will be powered from mains voltage instead of a battery.
Since the power to each DRV5033 duty cycled, using a multimeter to measure the current consumption will not provide accurate readings for the average current. As a result, the current assumption of a set of DRV sensors is tested by estimating an upper bound of the voltage across a resistor with known resistance. This average voltage is then converted back to current through Ohm's law. Using this method, the following current consumption readings were obtained.
Whenever magnetic tampering has been detected in the design, the time and date of the first magnetic tamper event, along with the current magnetic tamper state, is logged and shown on the LCD. For magnetic tampering when the chip's main power supply is used, LEDs also display the current magnetic tampering status. There is one LED associated with each of the six hall effect sensors.
For example, if the LTD labeled LED1 on the board is on, this indicates that hall effect sensor 1 is detecting a magnetic field. In addition, to deal with magnetic tampering, there is an option that would apply a penalty to the customer whenever a magnetic field is detected. For example, in this application, whenever magnetic tampering has been detected and the chip is calculating metrology parameters, the metrology parameters will be calculated with the maximum current, a 100 amps, instead of the current that is actually being sensed, or the current actually being used-- thereby, leading to purposely overcharging the customer for a high magnetic field.
April 12, 2017
This module covers how to the use Hall-effect sensors for the low-power detection of strong magnetic fields in three dimensions. Details are provided for the TIDA-00839 magnetic tamper detection reference design which showcases how to use the DRV5033 Hall-effect sensor for low-power detection of strong magnetic fields.
This course is also a part of the following series