Press [*] to activate the lock-electronics.
Legitimate user can then input the code of up to 60 digits and finish
code entry by pressing the "number sign" [#].
CodeLock will then check the code just entered and, if correct,
energize some electromagnet/electromotor for release of a locking-mechanics.
Yet, if the code entered was not correct, then CodeLock will be blocked
for at least 8 seconds. This effectively
inhibits multiple attempts of "brute-forcing" the correct combination.
The solution utilizes position switches ("end-switches") to ensure that
the door/bolt is completely extended, rejected. This feedback is quite
useful for an energy-efficient operation, but is not an obligation.
Get more information regarding the logic control in my
and the details of the
Right here, we will focus on electronic details.
As already mentioned, one fundamental of this
code-lock-concept was minimum power consumption that will allow continued
operation on batteries. These are required to deliver higher currents
only for the short time when electromotors or solenoids are being energized.
The "Standby" state of the appliance is rather a switched off state.
The circuit will have no measurable operating current then.
And that's how it works: The PNP transistor T3 (BC327) is utilized as an
electronic switch between battery and logic. Since the base terminal
of T3 is being held on positive voltage by R7 (47 k), i.e. emitter voltage level,
the transistor won't become conductive and is effectively "switched off".
However, if the user presses "asterisk" key on the numeric keypad, a base
current of several milliamps will flow through R10, keypad contacts
X1-Y4 and R23 (several milliamps) to ground. Now T3 will forward unstabilized
positive current from the battery to voltage regulator VR1 (78L05) and
The microcontroller itself can now secure its power supply by rising portline
PD1 to switch T4 and thus pulling the base of T3 permanently to ground.
After the programe had done its job, or time-out of the CodeLock application
has expired, the controller can also detach itself from power supply by T4/T3.
After this, the lock may be re-energized by pressing [*].
VR1 is a conventional linear regulator (78L05) that provides pretty
good protection against voltage drops and peaks and noise caused
by dc-motor. However, this type of regulator will draw a quiescent
current of no less than 5 mA (see data
). This is no problem in here, since we always disconnect the
whole microcontroller plus stabilizer from the battery.
To enable programming of the microcontroller via ISP-intermediate
socket right on-board, we may short X6 (MASTER
KEY) by a simple jumper. This will provide permanent electric power
to the logic part.
Additionally, this input may be used for a "Master-Button" that allows
to open (and close) the locking system from the
"other side" (inside the domicile).
The fact, that motor voltage supply and logic control supply are
provided by the same battery, is way not so problematic. Some testing
in a 12-V-system showed up, that the controller won't even crash if the
load is a "mechanically locked DC motor". If the shunt resistors (see
below) are not too low impedance, there should always be enough voltage
provided to ensure safe operation of the controller. Should however,
the battery voltage collapse and fall below the minimum voltage for the
controller (Brown-out detector), then a Reset is automatically applied
and it's a matter of fact that the circuit was designed such way that
power-drop in the logic part will cause safe switch-off of the load.
Relay energizing voltage depends on battery voltage. Battery voltage
depends on motor voltage. Consequently for this CodeLock circuit,
any operating voltage in the range of 6 to 24 V is safe.
All control lies within IC1, an AVR-ATtiny2313
microcontroller. The micro doesn't have to calculate very fast, so it
shall be fed either with internally generated clock of 500 kHz (derived
from 4-MHz-RCO and division by 8) or internal 128 kHz that are
provided by the Watchdog-Oscillator that will be needed anyway.
H-Bridge output with motor brake feature (X2):
Re1 and Re2
present a classic
H-bridge that powers motor terminals X2a
and X2b with positive or negative current of (full) supply voltage.
Electromotors or solenoids should be connected ground-free (floating)
to the CodeLock circuit, and sufficient filtering (chokes, capacitors)
is recommended for DC-motors. The resistors R1 and R2
in series with supply voltage are intended to limit maximum load
current, particularly in case of a
locking mechanism being blocked or motor terminals even short circuit.
Dimensioning of R1 and R2 must consider that worst-case fault current
should not excite 4 Amps with respect to the maximum current
for this type of relays. On the other hand, the motor should be
provided with sufficient
starting current even inspite of a
weak battery. For many small and
medium motors in question, the values of R1+R2
are ranging between 2...10 Ohms.
It is plain to see that, when in idle/unpowered state, both terminals
and X2b are permanently tied to GND. This provides for a "motor
brake" that will stay in force even with battery power switched off;
this feature can effectively defeat attempts to manipulate motor driven
locking mechanisms by means of "rock-and-shake".
Bigger motors (from 2 Amps up) should not be
stopped directly by short-circuit because of considerable electrical
stress imposed by this method. It is better with such motors to first
short them with a
shunt resistor before direct short circuit.
Such "soft-brake" is also considered in this circuit concept: With both
relays being energized at the same time, both motor terminals are being
connected to their respective series resistor, and its generator
current will flow thru the series-impedance of these resistors and
quickly slow down the rotor and other gyrating
parts in a gentle way.
Since we've always using both contact-sets in parallel, we may expect
maximum switching current to be about double the rated contact current
The endswitches provide important information,
whether the latch is fully retracted or extended. It is also possible
to drive the electric motor into the blue and cut off after some
seconds. But even if the mechanics can cope well with that, this would
impose significant burden onto the batteries. (Timeout-method is
supposed to be only 'Plan B' if there is no signal coming from the
The signal ES1/ES2 from X3 should as usual be floating or switched
against circuit ground. It is recommended to have separate wiring for
every end switch that is preferably shielded against motor-power, to
It turned out that the relatively high-impedance of the controller's
ports (around 20 kOhm) are not that problematic, since the signal is
not very demanding by nature, and the Firmware can apply generous
debouncing/denoising on that signal. Yet, protection of the controller
from induced voltage spikes may be necessary to prevent hardware damage
to the microcontroller. The block capacitors C7+C8 (100nF ceramic)
provide a certain level of protection.
This is for connection of a numerical keypad
(3 x 4 matrix). Note, that keypads with single
contacts (13 wires) could NOT be used with this code lock.
The CodeLock firmware already provides for a comparably low multiplex
frequency of only 25 Hz. However, connecting the keyboard by longer
cable is not that trivial, if you want to have a secure solution. The
steep, unfiltered square wave multiplex features higher frequency
components (harmonics) that could in fact lead to "compromising emissions" on a
longer cable. Too many hobbyist and commercial circuits don't show
the slightest awareness for this vulnerability. Different with CodeLock!
The series resistors R15 to R21 not only provide portline protection
but also increase line impedance that will attenuate RF harmonics of
the keypad-matrix signal. In combination with basic shielding on/around the
keypad, its wiring and the CodeLock assembly, it became very hard to detect
anything (with amateur equipment) in a distance of more than 10 cm.
Amount of RF-blocking may be further improved by ferrite rings/chokes.
For example, one could solder R15-R21 in upright position each with one
additional ferrite bead.
Keyboard cable should be as short as possible, shielded or at least
flat ribbon type with alternating ground lines. Unfortunately, even with all
those protective measures in place, RF-specialist people may
experience "frequency-selective surprise" from time to time.
What looks like an exemplary EM-safe appliance up to the UHF band,
could become a pity when exposed to microwave radiation.
Just saying: Stay alert!
The terminals provide the switched, unstabilized
battery voltage (minus 0.7 V drop off T3) that may operate an Indicator-LED
or keypad illumination. Current limiting resistor R12 dimensioned accordingly.
We may short this connection with a Jumper to
get permanent power supply for testing purposes or programming sessions
on the ATtiny (i.e. via ISP-adaptor socket). The X6 goes to the base of
T3 over R8 (10 k) and is connected by D5 (BAT42) to the port input PD0
X6 is also intended for a MASTER-KEY when CodeLock is being used as a
doorlock. In such application the numeric keypad will be located
"outside", and we will need a separate button to easily activate the
door-close or door-open functionality.
Well, no problem with some fancy button at X6: A short stroke on that
MASTER button will regularly activate the lock and trigger "lock"
functionality (if the locking mechanics was not already closed).
However, a long press on this button will activate the "unlock"
sequence (if the door was not already opened). To enable this, the
microcontroller evaluates the button status via certain port line PD0.
It is therefore impossible to activate the "unlock" function by any
activities or manipulations with keypad signals accessible from the
outside. (For more details, see Firmware
X6 could also be activated by relay or open collector of any other
Considerations regarding Phreaking / TEMPEST / RF
It's a matter of fact that security devices such as
a code lock should send out none or minimum radio frequency energy as
possible to disengage passive RF attacks. Else, in a very bad designed
code lock, an attacker could literally "record the code entry of a
legitimate user" from many meters of distance with sophisticated radio
equipment and certain knowledge about the target electronics.
With active RF flooding, the attacker could remotely "illuminate" the
target system with pulsed high-frequency energy (microwaves) to gain
modulated echo signal by the attacked system components. Yet, with a
carefully designed circuit, such attacks will not provide any
significant informations because the modulation effects of various
components and adjacent electronics devices will mix and interfere in a
way that no distinct echo could be gained from the circuit parts and
signals of interest. If, on the other hand, the attacker got physical
access to the target, he could have built in kind of a passive "bug" at
an appropriate place. This may be unsuspiciously lookin' "standard
components" which will produce well-defined modulation when coupled
with RF energy of a certain wavelength and thus send out the signal of
interest into the world.
The few leaked documents about the NSA division 'ANT' indicate that spy
organizations today have a wide range of radar/rf technology and
procedures at hand to compromise target systems.
Good news is, that the same measures which inhibit RF emissions, are
also effective precautions against RF-penetration. High-quality metal
housing is one of the most important countermeasures. More to suggest
(with focus on simple applications like code locks):
- Peripheral wiring as short as possible. Ferrite chokes.
- RF-blocking capacitors.
- Shield keyboard cable, shield keypad in metal case.
- Main PCB in metal case. All incoming and outgoing signals blocked
for RF (chokes, capacitors)
- Prevent manipulations: sealing, tamper switches, link to an alarm
system, other surveillance
- Photograph device details after every maintenance inspection
(suspicious alterations could be recognized).
The board layout enables isolated mounting of
the CodeLock circuitry. Ground of the circuit is not necessarily tied
to chassis by mounting bolts. Though it appears that such "floating"
installation is only
desirable in a few special situations. In most cases, it is clearly
better to have a direct electrical connection of the circuit ground to
the chassis at exactly one point. This provides for defined ground
conditions and reduces uncontrollable interference coupling, RF
emissions andsusceptibility to RF flooding. If the keypad in located in
a separate metal housing with no direct connection to a common
ground/chassis (like a steel door), it is of course to be explicitly
grounded by the ground line provided by CodeLock PCB (GND X4-4).
CodeLock's circuit board data is provided in a
300-dpi-graphics which prints out to a layout of
100 x 53 mm. The files are provided in the download
packet. (NOTE: As mentioned elsewhere, Julien Thomas does not
support proprietary or vector formats nor does he make use of such
stuff. So, please
refrain from asking.)
To ensure reliable operation in a humid or corrosive environment, the
whole circuit should
placed either in a sealed case or protective coating should be applied
at least on the solder/copper side.
These components depend on the actual voltage of battery power supply:
Relais: DIL miniature relay. Coil voltage =
unstabilized battery voltage = nominal voltage of DC-motor
Tested with 6 V:
Finder 30.22.9-6V (switching current per contact up to 2A); Takamisawa
RY5W-K (only small load up to 500 mA!)
Tested with 12 V:
Since we have both sets of contacts in parallel, the rated maximum
contact current will roughly double up.
Series resistor R12 (LED at X5):
For illuminated keypads, assuming maximum current of about 50 mA and
green or yellow LEDs:
6V ~ 100 Ohms / 12V ~ 220
Ohms / 24V ~ 470 Ohms
For indicator LED only:
6V ~ 1 kOhm / 12V ~ 2.2 kOhm
/ 24V ~ 4.7 kOhm
Series Resistors / Shunts R1 + R2 (current limitation on DC-Motor,
motor soft brake):
These resistors should be dimensioned by the following criteria:
provide sufficient starting current of the respective motor (and sort
of "soft start" capability), and protection of battery and relays from
excessive current loads in case of motor being blocked / short-circuit.
Typical values range from 2.2 ... 10 Ohms and should be rated 5 Watts
Power Supply and motor connectors:
Connector X1 (and other
connections associated with a battery pack) and connector X2 must be
electrically and mechanically "rugged", i.e. capable of carrying the
maximum motor current expected. Screw terminals may be used either
(grid 7.5 mm).
0.8 mm for most electronic
mm for the connectors and relays; 3,0 mm for mounting holes (M3
Hall of Shame